Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wifiphisher: Fast automated phishing attacks against WPA networks

github.com

Post reply on HN
Print view View original

51–58 of 58 posts

Re: Wifiphisher: Fast automated phishing attacks against WPA networks

#51

Post by jagermo »

chrisfarms wrote: post #9
ikeboy wrote: post #7

This looks really cool. However, when I first read the words "social engineering", I expected it to create another access point encrypted the same way , and get the code direct from the victim. This way seems less fool-proof. Is my suggestion at all possible, or is the code transmitted while connecting useless unless you already have it? (Well it's not useless , as it can be brute-forced by aircrack-ng locally. I'm w…

The key (nor a hash of the key) is sent over the air. It's a challenge. Since both sides should know the key they can challenge each other by saying things like "encrypt the word 'horse' using our secret key" ... then they can compare the result.

I think you forgot a "never" in an otherwise good explanation :)

Re: Wifiphisher: Fast automated phishing attacks against WPA networks

#52

Post by jagermo »

xanderjanz wrote: post #44

Why does this require a specific linux dist?

It does not, but Kali is designed for pentesters, so it already contains a lot of dependencies. It's based on Debian, so with a little fiddling you should get it running on most other distributions.

You need, however, a wifi card capable of packet injection. Some of them need special drivers or patches, so it makes sense that the author uses a distribution for securtiy/pentesting.

Re: Wifiphisher: Fast automated phishing attacks against WPA networks

#54

Post by peteretep »

eliben wrote: post #18
Scarbutt wrote: post #16

A bit off-topic - I have noticed that python is used way more on the hacker/security community than other scripting langs (Perl,Ruby), anyone know why?

Isn't Python, in general, significantly more widely used than Perl and Ruby outside their narrow popularity domains (sysadmin for Perl, RoR web apps for Ruby)? Just a guess.

No.

Re: Wifiphisher: Fast automated phishing attacks against WPA networks

#55

Post by pyre »

nightpool wrote: post #36
pyre wrote: post #21

Earlier quoted context omitted.

Without the password, it can't quite MitM yet. It presumably makes sure that they user connects to it because it doesn't have WEP/WPA enabled, so the client OS automatically connects to the AP with the same name, but doesn't warn the user that WPA is no longer enabled. It can't spoof the WPA connection because it doesn't have the password yet.

The problem here is that most OSs (read: Windows) do warn the user that the encryption has changed. Android won't even recognize it as the same network, you have to remove the old one and then reconnect. So I'm not really sure about the feasibility of this attack.

Was that even the case a couple of years ago though? I seem to remember that this was a valid attack at least a couple of years ago. Maybe it was on OSX or iOS devices?

Re: Wifiphisher: Fast automated phishing attacks against WPA networks

#56

Post by pyre »

tga_d wrote: post #40
limaoscarjuliet wrote: post #37

Earlier quoted context omitted.

Using good passwords (i.e. alphanum, case sensitive, perhaps with some special characters) in end user deployment is a support nightmare. Imagine you are trying to tell such password to user over a phone on a support call. The 10 digit number sequence is unsafe but is easy to handle - people are used to phone numbers and account numbers.

A 10 digit number sequence has 33.2 bits of entropy. 3 diceware words has 38.7 bits of entropy. I don't think 10 numerical digits is easier to relay than 3 words. Although either would be far short of the ~90 considered fully secure, I think it's safe to say there are plenty of designs that would have been both safer and easier to use.

The words themselves are prone to end-user screw-ups though. Think of how many people don't know how to spell correctly... :P

Re: Wifiphisher: Fast automated phishing attacks against WPA networks

#58

Post by ikeboy »

jagermo wrote: post #50
ikeboy wrote: post #42

Earlier quoted context omitted.

What about setting up a WEP access point to impersonate the WPA one, then getting the password from that? Still seems more likely to work than what it's doing now.

You'd still need the Pre-Shared key to create a legitemate looking access point, so it is kind of a catch-22. WPA/WPA2 as a system is actually not that bad (for home use).

Why? If WEP is vulnerable, then if victim connects to a WEP fake and enters their password, we should be able to read that. Like a downgrade attack.
Post reply on HN