Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wifiphisher: Fast automated phishing attacks against WPA networks

github.com

Post reply on HN
Print view View original

31–40 of 58 posts

Re: Wifiphisher: Fast automated phishing attacks against WPA networks

#31

Post by yoshamano »

drinkyouroj wrote: post #15
ytjohn wrote: post #11

The reason I don't think this would work is because no one knows their wifi password.

This was my thought, too - and those that do would recognize the fake control panel. I think it's becoming more and more common for the PSK to come on a sticker from the all-in-one router/modem your ISP sends you. So, the user never sets a passphrase, never sees the control panel, and has the key ready to hand out by just looking at their "internet box." This attack is perfect for that.

If you bump into enough of these devices you'll learn that most use a limited keyspace for their encryption key. Case in point, the Motorola NVG510 used by AT&T Uverse HSI ADSL2+ (not to be confused with AT&T Uverse VDSL). They are all programmed with a SSID of ATT### and use a ten digit numerical PSK. As far as brute forcing them, it took my GeForce 550 three days to find the key of my test unit, and if I remember correctly five days to scan the entire keyspace. A newer and faster video card could have done it in hours.

If manufacturers stopped using fixed length keys for a particular product line and made use of the entire alphabet it would make this kind of exercise infeasible.

Re: Wifiphisher: Fast automated phishing attacks against WPA networks

#32

Post by drinkyouroj »

ytjohn wrote: post #29
drinkyouroj wrote: post #15

Earlier quoted context omitted.

This was my thought, too - and those that do would recognize the fake control panel. I think it's becoming more and more common for the PSK to come on a sticker from the all-in-one router/modem your ISP sends you. So, the user never sets a passphrase, never sees the control panel, and has the key ready to hand out by just looking at their "internet box." This attack is perfect for that.

You do have a good point there. It could work for home/apartment building attacks. I'm not sure how many people know about the WPS button most routers have now, but I've got several people using it. It's rather slick when it works (I've only had it fail on HP printers). Windows 8 actually tells them to press the button. I think Android could make this more blatant to spread adoption. You select the network on your de…

WPS makes stealing the WPA PSK as trivially easy as WEP. Basically, WPS protects the WPA key with a 7-digit PIN - cracking that PIN is enough to authenticate with the router and have it provide the encryption key.

It seems like this should be easy to defend against, but everything I've ever read about WPS says no one seems to be putting any such protections in place.

http://en.wikipedia.org/wiki/Wi-Fi_Protected_Setup#Brute-for...

Re: Wifiphisher: Fast automated phishing attacks against WPA networks

#33

Post by hartator »

Scarbutt wrote: post #16

A bit off-topic - I have noticed that python is used way more on the hacker/security community than other scripting langs (Perl,Ruby), anyone know why?

Actually Ruby is more popular in hacker/security community. It's the official language of Metasploit.

Re: Wifiphisher: Fast automated phishing attacks against WPA networks

#34

Post by dionyziz »

ssully wrote: post #28
dionyziz wrote: post #4

Earlier quoted context omitted.

Where does it say that this is testing the security of a setup?

When something calls itself a security tool it's usually assumed (if not explicitly stated) that it serves some purpose for assessing the security of something. Otherwise it is just a tool made for making attacks easier to perform, which is pretty frowned upon.

It's a proof-of-concept to illustrate that users will put their passwords anywhere they are asked to and click through any warnings that may appear on their screen.

Re: Wifiphisher: Fast automated phishing attacks against WPA networks

#35

Post by johnsoft »

drinkyouroj wrote: post #32
ytjohn wrote: post #29

Earlier quoted context omitted.

You do have a good point there. It could work for home/apartment building attacks. I'm not sure how many people know about the WPS button most routers have now, but I've got several people using it. It's rather slick when it works (I've only had it fail on HP printers). Windows 8 actually tells them to press the button. I think Android could make this more blatant to spread adoption. You select the network on your de…

WPS makes stealing the WPA PSK as trivially easy as WEP. Basically, WPS protects the WPA key with a 7-digit PIN - cracking that PIN is enough to authenticate with the router and have it provide the encryption key. It seems like this should be easy to defend against, but everything I've ever read about WPS says no one seems to be putting any such protections in place. http://en.wikipedia.org/wiki/Wi-Fi_Protected_Setup…

>WPS protects the WPA key with a 7-digit PIN - cracking that PIN is enough to authenticate with the router and have it provide the encryption key.

Not only that, but routers verify the first and second halves of the PIN separately. So instead of brute forcing in a keyspace of 10000000, you only need to find one number up to 10000, and a second number up to 1000. (The second half of the PIN is actually a 4-digit number as well, but the last digit is just a checksum digit.)

If it weren't for that issue, attacks would take months/years instead of minutes/hours.

Re: Wifiphisher: Fast automated phishing attacks against WPA networks

#36

Post by nightpool »

pyre wrote: post #21
eliben wrote: post #19

Neat idea, but why can't it spoof the Wifi authentication page/popup? Can't it dress up as a new device and try to connect to the wifi network, and then see what kinds of authentication page is returned by the router? Then just copy that.

Without the password, it can't quite MitM yet. It presumably makes sure that they user connects to it because it doesn't have WEP/WPA enabled, so the client OS automatically connects to the AP with the same name, but doesn't warn the user that WPA is no longer enabled. It can't spoof the WPA connection because it doesn't have the password yet.

The problem here is that most OSs (read: Windows) do warn the user that the encryption has changed. Android won't even recognize it as the same network, you have to remove the old one and then reconnect. So I'm not really sure about the feasibility of this attack.

Re: Wifiphisher: Fast automated phishing attacks against WPA networks

#37

Post by limaoscarjuliet »

yoshamano wrote: post #31
drinkyouroj wrote: post #15

Earlier quoted context omitted.

This was my thought, too - and those that do would recognize the fake control panel. I think it's becoming more and more common for the PSK to come on a sticker from the all-in-one router/modem your ISP sends you. So, the user never sets a passphrase, never sees the control panel, and has the key ready to hand out by just looking at their "internet box." This attack is perfect for that.

If you bump into enough of these devices you'll learn that most use a limited keyspace for their encryption key. Case in point, the Motorola NVG510 used by AT&T Uverse HSI ADSL2+ (not to be confused with AT&T Uverse VDSL). They are all programmed with a SSID of ATT### and use a ten digit numerical PSK. As far as brute forcing them, it took my GeForce 550 three days to find the key of my test unit, and if I remember c…

Using good passwords (i.e. alphanum, case sensitive, perhaps with some special characters) in end user deployment is a support nightmare. Imagine you are trying to tell such password to user over a phone on a support call. The 10 digit number sequence is unsafe but is easy to handle - people are used to phone numbers and account numbers.

Re: Wifiphisher: Fast automated phishing attacks against WPA networks

#38

Post by HackinOut »

gipsies wrote: post #22

This is misleading. When using WPA the client and access point perform mutual authentication. This means that if you don't know the password, you cannot set up a rogue access point that "copies the target access point's settings". Because you don't know the password! And if you'd use a random password, the client will refuse to connect to the rogue AP. The tool is actually creating a second, unencrypted network. On W…

Yes, that is why this password is called a Pre-Shared Key.

Re: Wifiphisher: Fast automated phishing attacks against WPA networks

#39

Post by HackinOut »

drinkyouroj wrote: post #32
ytjohn wrote: post #29

Earlier quoted context omitted.

You do have a good point there. It could work for home/apartment building attacks. I'm not sure how many people know about the WPS button most routers have now, but I've got several people using it. It's rather slick when it works (I've only had it fail on HP printers). Windows 8 actually tells them to press the button. I think Android could make this more blatant to spread adoption. You select the network on your de…

WPS makes stealing the WPA PSK as trivially easy as WEP. Basically, WPS protects the WPA key with a 7-digit PIN - cracking that PIN is enough to authenticate with the router and have it provide the encryption key. It seems like this should be easy to defend against, but everything I've ever read about WPS says no one seems to be putting any such protections in place. http://en.wikipedia.org/wiki/Wi-Fi_Protected_Setup…

WPS push button and WPS PIN are two separate features. If you only have WPS Push Button enabled you are not vulnerable.

Re: Wifiphisher: Fast automated phishing attacks against WPA networks

#40

Post by tga_d »

limaoscarjuliet wrote: post #37
yoshamano wrote: post #31

Earlier quoted context omitted.

If you bump into enough of these devices you'll learn that most use a limited keyspace for their encryption key. Case in point, the Motorola NVG510 used by AT&T Uverse HSI ADSL2+ (not to be confused with AT&T Uverse VDSL). They are all programmed with a SSID of ATT### and use a ten digit numerical PSK. As far as brute forcing them, it took my GeForce 550 three days to find the key of my test unit, and if I remember c…

Using good passwords (i.e. alphanum, case sensitive, perhaps with some special characters) in end user deployment is a support nightmare. Imagine you are trying to tell such password to user over a phone on a support call. The 10 digit number sequence is unsafe but is easy to handle - people are used to phone numbers and account numbers.

A 10 digit number sequence has 33.2 bits of entropy. 3 diceware words has 38.7 bits of entropy. I don't think 10 numerical digits is easier to relay than 3 words. Although either would be far short of the ~90 considered fully secure, I think it's safe to say there are plenty of designs that would have been both safer and easier to use.
Post reply on HN