Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

github.com

Post reply on HN
Print view View original

71–80 of 140 posts

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#71

Post by kees99 »

d33 wrote: post #33
throwasehasdwi wrote: post #28

Earlier quoted context omitted.

Yes, this is still a major problem with WPA. Also the fact that certain control packets aren't authenticated is nearly unforgivable. If correctly designed the only reasonable attack on wifi would be channel jamming, sadly after many years this still is not the case.

This is probably a good occasion for a call for WPA3: https://github.com/d33tah/call-for-wpa3

WEP, WPA, WPA2... why keep reinventing the same wheel? Each new iteration inevitable turns out to be less-than-perfect and keep adding more and more complexity and overhead - for one, join/leave times keep increasing, up to a point where we have a separate standard (802.11r) just to get back pre-WPA roaming speeds (at cost of even more protocol complexity overhead).

Here's crazy idea: Why not run open network + IPSEC, or heck, even OpenVPN? Obviously, drop all non-VPN traffic right on the AP (or first router after it) to nip freeloaders in the bud.

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#72

Post by phinnaeus »

stickfigure wrote: post #48
xori wrote: post #45

Earlier quoted context omitted.

I'm not sure how PAKE works, but how would an AP block you? MAC address are forgeable. And any nonce an AP sends down as a one-time salt would be visible to you and you could still just brute force it offline. EDIT: After reading up on SPAKE2, it's basically just a Diffe-Hellman exchange. You can still totally do a brute force because you know what the first encrypted payload should look like and you can listen in fo…

Blocking isn't really necessary. How many attempts could an AP process per second? Not enough to try a large dictionary with variations.

Wouldn't that effectively be jamming the AP at that point?

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#73

Post by JetSpiegel »

phinnaeus wrote: post #72
stickfigure wrote: post #48

Earlier quoted context omitted.

Blocking isn't really necessary. How many attempts could an AP process per second? Not enough to try a large dictionary with variations.

Wouldn't that effectively be jamming the AP at that point?

At what point you call security, or just look around the room and check who is jamming the WiFi.

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#74

Post by throwaway91111 »

amluto wrote: post #16
throwasehasdwi wrote: post #15

I'm not sure why this is amazing enough to make the first page but W/E it's HN :). Just so less informed are aware, this has been feasible for maybe 7 years (since GPU calculation became possible). Just so nobody freaks out, this is cracking weak passwords, not broken WPA. I have myself cracked countless WiFi passwords when security testing. It's easy if the passwords are bad, which is maybe 90% of the time for home…

> Just so nobody freaks out, this is cracking weak passwords, not broken WPA. I beg to differ. The fact that WPA is subject to a passive attack at all is a defect. It should use a PAKE, which would entirely avoid this type of attack. There are simple balanced PAKE protocols that would do the trick. DH-EKE, SPAKE2, J-PAKE, and even the venerable SRP would all work. I believe that several are old enough that no patents…

Agreed. However, WPA has been obviously broken for years; just use WPA2 instead. It's also way easier to set up on your grandmother's random router.

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#75

Post by jaimex2 »

webaholic wrote: post #39

To the script kiddies out there who read this: Do not try this on others wifi. It is a crime in the USA to crack network routers. Although the chance of you getting caught is low, better be safe than sorry.

whats the punishment in the US?

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#76

Post by joshjje »

rocqua wrote: post #27
mdeeks wrote: post #19

Earlier quoted context omitted.

Can someone define what is considered a weak vs strong password now for WiFi? The only guides I found online are years old. Is 10 characters considered weak for mixed case letters, numbers, plus punctuation now?

To do this formally, you need to consider information entropy. This is all about how you generated your password. 10 characters of totally random mixed case, numbers and punctuation gives about 60 bits of entropy which is strong enough. HOWEVER, that calculation only works if all 10 characters were generated uniformly and randomly. Humans are terrible at this. Now, maybe your trick for turning words into safe passwor…

There was a nice comic/picture of this. I tend to follow it. Basically using 3-4 short words as a phrase instead of random characters. You can toss special characters inbetween/before/after. They are also much easier to remember. Password "FoolMeOnce!ShameOnMe" for example.

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#77

Post by hyperdunc »

thomastjeffery wrote: post #67
throwasehasdwi wrote: post #15

I'm not sure why this is amazing enough to make the first page but W/E it's HN :). Just so less informed are aware, this has been feasible for maybe 7 years (since GPU calculation became possible). Just so nobody freaks out, this is cracking weak passwords, not broken WPA. I have myself cracked countless WiFi passwords when security testing. It's easy if the passwords are bad, which is maybe 90% of the time for home…

> but W/E it's HN Would you please simply type "whatever", instead of this "W/E" nonsense? Considering the amount of 8+ character adjectives you used, you clearly aren't trying to be less verbose.

In the same spirit of improving grammar and readability - I think you meant to type 'number' of 8+ character adjectives.

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#78

Post by Laforet »

samstave wrote: post #63
rocqua wrote: post #27

Earlier quoted context omitted.

To do this formally, you need to consider information entropy. This is all about how you generated your password. 10 characters of totally random mixed case, numbers and punctuation gives about 60 bits of entropy which is strong enough. HOWEVER, that calculation only works if all 10 characters were generated uniformly and randomly. Humans are terrible at this. Now, maybe your trick for turning words into safe passwor…

I would love to see a comparison between where physically and which modifiers are used for each character are, and the strength of a password. Is a password which is very easy/comfortable to type out physically any more/less strong than another of the same length? I ask this because I often use a visual pattern on the keyboard for a password and I don't recall which characters they may be, but I recall the pattern in…

Depends on how good the pattern is, however entropy is lower all likelihood because the layout of qwerty keyboard is standardised.

Most password crackong dictionary already include common keyboard patterns sich as "qwerfdsazxcv" or variations of it.

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#79

Post by hueving »

xori wrote: post #52
throwasehasdwi wrote: post #50

Earlier quoted context omitted.

You can't brute force a nonce offline when you don't know if you answer is right unless you ask the AP. Different protocols than sending hashes where you can tell if your hash is correct just by looking at it. You are right that the AP couldn't block you without blocking everyone, but since you need to check your answer with the AP for each guess your attack becomes extremely visible. I guess you could still DDOS the…

But you can capture the first encrypted packet from the router, and you know what the protocol is to test if your decoded version is correct. I still don't see how this helps.

Knowing the plaintext version of a packet does not allow you to get the key. That's called a known plaintext attack and AES is resistant to it.

Re: Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

#80

Post by TheAceOfHearts »

throwasehasdwi wrote: post #15

I'm not sure why this is amazing enough to make the first page but W/E it's HN :). Just so less informed are aware, this has been feasible for maybe 7 years (since GPU calculation became possible). Just so nobody freaks out, this is cracking weak passwords, not broken WPA. I have myself cracked countless WiFi passwords when security testing. It's easy if the passwords are bad, which is maybe 90% of the time for home…

In your opinion, is setting up a RADIUS server and using WPA2-Enterprise worth it for a consumer? I'm pretty paranoid, and also think it could be an insightful experience to tinker around with networking tools.

Any advice for what constitutes a strong or weak password in this context?

Post reply on HN