Slashdot Mirror
WPA-PSK Cracking As a Service
An anonymous reader writes "Moxie Marlinspike, a security researcher well known for his SSL/TLS attacks, today launched a cloud-based WPA cracking service, where for $34 you can test the security of your WPA password. The WPA Cracker Web site states: 'WPA-PSK networks are vulnerable to dictionary attacks, but running a respectable-sized dictionary over a WPA network handshake can take days or weeks. WPA Cracker gives you access to a 400CPU cluster that will run your network capture against a 135 million word dictionary created specifically for WPA passwords. While this job would take over 5 days on a contemporary dual-core PC, on our cluster it takes an average of 20 minutes.'"
Why not?
Most people try to crack WiFi because they don't have internet, in which case it would impossible to access a cluster. It would be cool if it got you internet anywhere there was wifi, but it won't work, because you can't log into the cluster without internet anyway, so what's the point? Besides stealing data of course.
So for $34 you can make sure your password is part of their dictionary?
we have your Password and IP, thanks!
because?
While this job would take over 5 days on a contemporary dual-core PC, on our cluster it takes an average of 20 minutes
Anyone interested in testing their own key would not care about it taking 5 days. During a weekday, you're not around most of the time anyway. I doubt anyone cares enough to spend $40 for something that can be done for free.
Please help metamoderate.
Good thing "yourmomispoo" isn't in the diction. Phew!
$34 to see if your password can survive a dictionary attack? Hell pay me $20 and I'll gladly save you some money and provide you with a password guaranteed to be unbreakable by brute force. I'll even sign an NDA to ensure I don't disclose it to anyone but rest assured even I won't be able to remember it!
Did you ever wake up in the morning, with a Zombie Woof behind your eyes? -- FZ
... you dont use d!ct!0n@ryw0rd50r@tl3@st make them hard to be brute forced.
I cant really see how this is service is legal but I am willing to be educated how it could be.
"Old Rallydrivers never die - they just fail to book in on time"
I'm not typically the one to bitch about terminology as this sort of technical jargon is in constant evolution and that's a normal and good thing, but, uh... cloud? We've been calling this sort of setup a "cluster" for ages, there's no indication in TFA that this is geographically distributed, and it doesn't really do remote data storage or anything like that, which are just a few of the typical aspects of "cloud" crap I can think of off the top of my head. How is this a "cloud" thing?
Only an idiot would pay $34 to see if their password was '12345'.
You can get a nice entropic password for free.
Steal your neighbors' wireless for a one time fee of thirty four dollars. Sixty percent of the time, it works every time.
"Marlinspike declined to say who operates his compute cluster"
I guess he can't come out and say he's using botted boxes, right?
...$34 is the super-fast price.
"WPA Cracker gives you access to a 400CPU cluster that will run your network capture against a 135 million word dictionary created specifically for WPA passwords"
400 CPU cluster or 400 node botnet? Wonder where's he's getting the funding to pay for a farm like that? I mean you'd need to set up everything in advance of making any money off it. So again, where do the cycles come from I wonder.
"Beer is proof that God loves us and wants us to be happy - Benjamin Franklin"
Who uses WPA or WEP anyways? Either you leech your neighbor's unprotected WiFi, you live far enough away from other homes so that your signal doesn't leave your property, or you maintain a separate DMZ of wireless IPs that can't get into the good stuff, but can access the Internet.
Next people will say that MAC address security is actually meaningful.
I want to delete my account but Slashdot doesn't allow it.
Nobody is going to brute force my randomly generated 63 character alphanumeric key. Not before a vulnerability in the encryption appears or the hardware gets replaced with a new standard
Given his infamous reputation for exploiting SSL, do you trust moxie?
What happens if he says your passphrase survived the 20 minute test dictionary run, you put it in production, and he leaves the system running and breaks it later in a brute force attack? Would they tell you that it was cracked then?
This is bad ass and probably worth the $17 for the half-CPU cluster time. However, on a sour note, I can see it getting abused for it's short worth of security affirmation. With monetary gain at stake, I can imagine funding this service is going to far outweigh validating who's using it for malicious intent. It's a far stretch and would get rather expensive for some d0uch3b4g pwning neighboor networks, but if there a network of value to get into, the $17 (or $34) can't even fill my gas take.
They don't discuss it, but I wonder if they don't just fire up 400 Amazon instances, do the work, then shut them off. For $34 (an oddly specific number), they can't afford to have 400 CPUs around. However, if they allocate on a job-by-job basis, then their overhead is very low.
This kind of work (high computation, high parallelization, infrequent request) might be the most brilliant and non-obvious use of cloud computing. Low overhead due to using someone else's hardware (rather than having 400 CPUs laying around). If this is truely what they are doing, I am very impressed.
For $30 I'll run the command-line random number generator I found on the web and send you a 60 digit number.
If you act today, that's only 50 cents a number!
What's the chance of this happening to a non-English speaker? most of the development of this kind of tuff seems to be happening in the the US so hurray for the rest of the world I guess.
Dyslexics are teople poo
I’m sorry, but if your password is found in a dictionary, you fail, and deserve to be cracked. I don’t care if you’re 50 year old steel worker with no higher education. You are still a human. The most intelligent being on the planet! Behave like one, would ya?
Protip: Adding just ONE special character to your password is going to wreck even faster brute force attacks. Let alone dictionary ones.
If you want your password being “penis”, and it complains that it’s too short, no problem. Add a exclamation mark, or maybe more than one, and you’re not good. You’re great!
I repeat: “penis”: BAD. penis!!!1“: GREAT. ^^
I found some other nice techniques:
1. Use 1337(0d3. ^^ (Or some other keys that only you know what they mean.)
2. (My favorite:) Draw one, two or even more big letters on your keyboard, using all the keys. This works especially well with a custom keyboard layout (I use the German Neo 2.0 layout, which is rather rare. Which makes it rather hard to enter the password on other keyboards though. Then again, that is a feature. As then nobody can log your input on his computer.)
3. If you can, use public key authentication. Let’s see them brute-force a 2048 bit key!
X. Do them all together. E.g. draw “p3n“ on the keys of your keyboard, to decrypt a public key.
But: No, I do *not* expect Joe Sixpack to know that. Then again, he also does not need it. It’s just a bit of evolutionary advantage for us experts. ^^
Any sufficiently advanced intelligence is indistinguishable from stupidity.
FTA: 20 minutes instead of 5 days.
If 360 people were using this system simultaneously, and God forbid there be more than that, you would be better off running the crack yourself.
Unfortunately, the wpacracker.com dictionary will even crack your "expert" advice. The reason the dictionary is so large is because it encompasses simple tricks like these -- adding characters to the end of words, exclamation points, elite-speak, mixed case, and even keyboard patterns.
e.g. a sentence. With capitalization and punctuation. You won't really have to worry about dictionary attacks that way.
Will it help me break into my neighbours WiFi?
An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"
There's a piece of free software http://code.google.com/p/pyrit/ that could crunch through 135 million passwords in a few hours.
On my GTX275 it would take about 3.5 hours. I think i will save myself $34.
Abort, Retry, Ignore?
Moxie Marlinspike. That's a Gnome name if ever I heard one.
So.... I guess you really like penises?
This service cannot crack my WPA password. Because my password doesn't exsist in a nerds dictionary: "women"
A medium 'high-cpu' linux instance at Amazon is $0.17/hr.
($0.17/hr) x (20min) x (400 instances) = $22.66666... +50% = exactly $34
I should know, I do deauthentication attacks against WPA-PSK encrypted networks, hence my site has a few captured packets then need cracking: http://www.md5decrypter.co.uk/forum/forum_topics.asp?FID=9 I currently only have 1 cracked but tbh, as long as you use a very good password, no one is going to crack it. We'll all have to wait until someone figures out a major hole like in the WEP encryption ;) 5-10 mins, no problem!!
It's a horrible myth that L337SP33K is very secure. Special characters just aren't that great.
Try something like "the quick brown fox shat all over the lazy dog".
Or "twinkle twinkle like a rolling stone".
Or any other phrase that makes sense to your twisted and uniquely messed-up gray matter.
Plaintext is easier for a human to remember than quasi-random characters, and it will be just as secure.
Mod parent up! That's some pretty compelling math.
In Italy, where I live, it is illegal to set up an unprotected wifi point, but since the vast majority of ADSL modem/routers are sold to homes or small businesses, I see a lot of unprotected access points, with names like "D-link "; I doubt that getting people to use robust passwords would work as well as having them use ANY password.
"If a boss demands loyalty, give him integrity. But if he demands integrity, give him loyalty." (John Boyd, 1927-1997)
Almost the same thing about Oracle passwords: http://ops.conus.info/
One more online cracking service for Oracle passwords: http://ops.conus.info/
Assuming 5 days for a dual core, and thus 2.5-3 days for a quad core, that's not really a huge amount of time on a machine that's easily available. I certainly wouldn't want to spend $34 when i can just leave a spare quad core box running this in the background for a few days.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Capitalism-wise, it's genius. Nearly as smart as prostitution.
"Let me perform a service, charging you by the hour, but the longer I go the happier you are."
-Styopa
3. If you can, use public key authentication. Let’s see them brute-force a 2048 bit key!
Remember that you can't compare symmetric and asymmetric schemes like that. Usually, in symmetric schemes the bits refer to the length of the password, where in asymmetric schemes it refers to the size of the prime numbers involved. For instance it took a good amount of time to break 64-bit DES at distributed.net, but a 663 bit prime number has been factorized using a general purpose algorithm (http://en.wikipedia.org/wiki/RSA#Integer_factorization_and_RSA_problem).
My UID is prime. Hah!
Remember that you can't compare symmetric and asymmetric schemes like that. Usually, in symmetric schemes the bits refer to the length of the password, where in asymmetric schemes it refers to the size of the prime numbers involved. For instance it took a good amount of time to break 64-bit DES at distributed.net, but a 663 bit prime number has been factorized using a general purpose algorithm (http://en.wikipedia.org/wiki/RSA#Integer_factorization_and_RSA_problem).
That would be a 663 bit NUMBER. Even I can factorize prime numbers :P
My UID is prime. Hah!