Slashdot Mirror
WPA Weak Key Cracker Posted
Glenn Fleishman writes "The folks at TinyPEAP released a cracking tool to break Wi-Fi Protected Access (WPA) keys. WPA is the replacement for weak WEP keys in the original 802.11b specification. Robert Moskowitz of ICSA Labs released a paper almost exactly a year ago documenting how WPA keys that were short and lacked randomnness could be subject to cracks. This tool automates the process. Moskowitz advised choosing passphrases of more than 20 characters or generating random keys of at least 96 bits, but preferably 128 bits. Some tools exist to produce better keys, including chipmaker Broadcom's SecureEZSetup (in selected hardware) and Buffalo Technologies' hardware-based AOSS for automatic key generation and propagation. Enterprise-based WPA with 802.1X doesn't have this weakness: each user gets a long WPA key that's randomly generated and uniquely assigned--and can be frequently changed during a session."
NOT really a good idea to start a thread about morons, and then act like one.
_YOUR_ wlan card may have the MAC address burned into it. Once ALL NIC did. I think it was more than 10 years ago that I saw my first NIC that DID NOT HAVE a MAC address (it was all zeroes, and expected to be set in software).
_MY_ wlan card will _CERTAINLY_ let me change the MAC address - under Linux _or_ Windows.
http://www.theboyz.biz/Computers, parts, electronics, small appliances and more!
If you're not living on the edge, you're just taking up space!
Do your homework. Look up Supplicant, XSupplication, HostAP, 802.11i for Linux, 802.1x for Linux, etc, etc, etc... Lots of things going on.
ITMT... This crack is only for weak keys with WPA-PSK. Not applicable to WPA enterprise or WPA2.
No, you don't have to do this. Once the WEP key is broken (or if there is no WEP key, just MAC filtering), you simply listen to the traffic to get a MAC address that's allowed, and use that.
Regards,
--
*Art
Notice i said Kismac, not Kismet. This new tool doesn't do anything special when attacking WPA. It isn't even the first to do this non-special thing.
"Upon attaching the waterblock to my penis, I began to notice that I know nothing about computers." -- JRockway
Looked at OpenVPN? Seems a lot easier to configure than a VPN.
The best thing you can do in addition to using WEP, changing keys, and locking down the MAC addresses allowed, is to use ssh or VPN software to encrypt your connections. If someone spends enough time to crack WEP and spoof a MAC address then the most they can get is access through your access point. They would have to break ssh or VPN to look at your data. Of course you would need to have tools in place to identify a man in the middle attack to prevent them from spoofing your connections.
Of course if someone spends that much effort just to break into your wireless network you either have something really important or they are have way to much time on their hands. (and I doubt if anyone has anything that important on their network....)
MAC adresses are universally unique identifiers, except for a few duplicate runs in cheap-ass brand NICs.
It's just that they cannot be authenticated in any way. It's like allowing only people who claim to be you on your network, rather than people who can prove it in some way.
SCO employee? Check out the bounty
KisMAC has had this function for a long time. Someone used it at Hope 2004 to their wifi key. In addition, Josh Wright has had a working copy available for linux for some time. The LiveCD from Remote-exploit.org (Auditor) has included this tool for about a month now. This is not new...