Slashdot Mirror
WPA-PSK Cracking As a Service
An anonymous reader writes "Moxie Marlinspike, a security researcher well known for his SSL/TLS attacks, today launched a cloud-based WPA cracking service, where for $34 you can test the security of your WPA password. The WPA Cracker Web site states: 'WPA-PSK networks are vulnerable to dictionary attacks, but running a respectable-sized dictionary over a WPA network handshake can take days or weeks. WPA Cracker gives you access to a 400CPU cluster that will run your network capture against a 135 million word dictionary created specifically for WPA passwords. While this job would take over 5 days on a contemporary dual-core PC, on our cluster it takes an average of 20 minutes.'"
So for $34 you can make sure your password is part of their dictionary?
I think the tool is not being sold to people wanting to crack into a WiFi network, rather selling to people so that they can test their WiFi network.
because?
Well, you could impress a client if you were a security contractor. For $35, that's a bargain! You could also screw with your neighbor... if they so deserve it.
Copyright 2010. All rights reserved. This comment may not be copied in any way including, but not limited to caching.
While this job would take over 5 days on a contemporary dual-core PC, on our cluster it takes an average of 20 minutes
Anyone interested in testing their own key would not care about it taking 5 days. During a weekday, you're not around most of the time anyway. I doubt anyone cares enough to spend $40 for something that can be done for free.
Please help metamoderate.
Maybe somebody might want to crack their neighbor's wifi now so you so can connect if they have an outage.
$34 to see if your password can survive a dictionary attack? Hell pay me $20 and I'll gladly save you some money and provide you with a password guaranteed to be unbreakable by brute force. I'll even sign an NDA to ensure I don't disclose it to anyone but rest assured even I won't be able to remember it!
Did you ever wake up in the morning, with a Zombie Woof behind your eyes? -- FZ
... you dont use d!ct!0n@ryw0rd50r@tl3@st make them hard to be brute forced.
I cant really see how this is service is legal but I am willing to be educated how it could be.
"Old Rallydrivers never die - they just fail to book in on time"
Only an idiot would pay $34 to see if their password was '12345'.
You can get a nice entropic password for free.
"Marlinspike declined to say who operates his compute cluster"
I guess he can't come out and say he's using botted boxes, right?
For that price you can get a backup internet connection.
I think the tool is not being sold to people wanting to crack into a WiFi network, rather selling to people so that they can test their WiFi network.
[x] Check this box if you are above the age of 18 and promise not to use this tool for malicious intends.
[BUY NOW!!!]
Yeah, I'm sure that's the actual usage they're expecting.
Nothing a trip to the coffe shop around the corner won't fix.
A friend of mine has a modified ThinkPad fitted with threee WiFi adapters (one IWL, one Atheroes with AP/bridge functionality, another Atheros for quick scanning and data dumps on multiple channels) with external high-gain antennas and basically the only thing that keeps him from having net access virtually everywhere is the CPU power to crack keys. Luckily for him, the biggest telecom around here gives out wireless routers with preset (permanently!) WPA keys generated from the subsciption ID - they're all of the same length and share some character patterns, so a laptop CPU is able to crack them in a few hours. For others, he could be actually interested in such a service, maybe if it were a bit cheaper.
This is Slashdot. Common sense is futile. You will be modded down.
Just wait for the iPhone app, so you can use your mobile connection to break into the faster wifi broadband.
...$34 is the super-fast price.
I think the tool is not being sold to people wanting to crack into a WiFi network, rather selling to people so that they can test their WiFi network.
And the majority of bittorrent traffic is Linux torrents and WoW patches.....
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
"WPA Cracker gives you access to a 400CPU cluster that will run your network capture against a 135 million word dictionary created specifically for WPA passwords"
400 CPU cluster or 400 node botnet? Wonder where's he's getting the funding to pay for a farm like that? I mean you'd need to set up everything in advance of making any money off it. So again, where do the cycles come from I wonder.
"Beer is proof that God loves us and wants us to be happy - Benjamin Franklin"
Alternatively you could actually not be an asshat, get on with your neighbour and negotiate with them (over a 6 pack of beer) to allow legal access in the event of an outage.
Who uses WPA or WEP anyways? Either you leech your neighbor's unprotected WiFi, you live far enough away from other homes so that your signal doesn't leave your property, or you maintain a separate DMZ of wireless IPs that can't get into the good stuff, but can access the Internet.
Next people will say that MAC address security is actually meaningful.
I want to delete my account but Slashdot doesn't allow it.
Nobody is going to brute force my randomly generated 63 character alphanumeric key. Not before a vulnerability in the encryption appears or the hardware gets replaced with a new standard
Isn't it cheaper, easier, and less douchebaggy to just get an aircard?
I want to delete my account but Slashdot doesn't allow it.
Given his infamous reputation for exploiting SSL, do you trust moxie?
What happens if he says your passphrase survived the 20 minute test dictionary run, you put it in production, and he leaves the system running and breaks it later in a brute force attack? Would they tell you that it was cracked then?
This is bad ass and probably worth the $17 for the half-CPU cluster time. However, on a sour note, I can see it getting abused for it's short worth of security affirmation. With monetary gain at stake, I can imagine funding this service is going to far outweigh validating who's using it for malicious intent. It's a far stretch and would get rather expensive for some d0uch3b4g pwning neighboor networks, but if there a network of value to get into, the $17 (or $34) can't even fill my gas take.
They don't discuss it, but I wonder if they don't just fire up 400 Amazon instances, do the work, then shut them off. For $34 (an oddly specific number), they can't afford to have 400 CPUs around. However, if they allocate on a job-by-job basis, then their overhead is very low.
This kind of work (high computation, high parallelization, infrequent request) might be the most brilliant and non-obvious use of cloud computing. Low overhead due to using someone else's hardware (rather than having 400 CPUs laying around). If this is truely what they are doing, I am very impressed.
For $30 I'll run the command-line random number generator I found on the web and send you a 60 digit number.
If you act today, that's only 50 cents a number!
That's far too short. "yourmomdrinksassmilk" would take longer brute force.
"Hi. This is my friend, Jack Shit, and you don't know him." - Lord Kano
"where for $34 you can test the security of your WPA password"
Um, what? If you know your own WPA password, you can just type it into say, dictionary.com or even into their web site. they should be able to tell you if it's in their list of strings they try for a lot less than $34...
Sleep your way to a whiter smile...date a dentist!
What's the chance of this happening to a non-English speaker? most of the development of this kind of tuff seems to be happening in the the US so hurray for the rest of the world I guess.
Dyslexics are teople poo
I’m sorry, but if your password is found in a dictionary, you fail, and deserve to be cracked. I don’t care if you’re 50 year old steel worker with no higher education. You are still a human. The most intelligent being on the planet! Behave like one, would ya?
Protip: Adding just ONE special character to your password is going to wreck even faster brute force attacks. Let alone dictionary ones.
If you want your password being “penis”, and it complains that it’s too short, no problem. Add a exclamation mark, or maybe more than one, and you’re not good. You’re great!
I repeat: “penis”: BAD. penis!!!1“: GREAT. ^^
I found some other nice techniques:
1. Use 1337(0d3. ^^ (Or some other keys that only you know what they mean.)
2. (My favorite:) Draw one, two or even more big letters on your keyboard, using all the keys. This works especially well with a custom keyboard layout (I use the German Neo 2.0 layout, which is rather rare. Which makes it rather hard to enter the password on other keyboards though. Then again, that is a feature. As then nobody can log your input on his computer.)
3. If you can, use public key authentication. Let’s see them brute-force a 2048 bit key!
X. Do them all together. E.g. draw “p3n“ on the keys of your keyboard, to decrypt a public key.
But: No, I do *not* expect Joe Sixpack to know that. Then again, he also does not need it. It’s just a bit of evolutionary advantage for us experts. ^^
Any sufficiently advanced intelligence is indistinguishable from stupidity.
Any clued neighbor wouldn't be allowing others onto their wi-fi. I wouldn't want to be implicated if the neighbor has a taste for the "young'ons", nor do I want my IP to be considered enough evidence to win an IP infringement lawsuit because someone wants to bum Internet access for downloading the latest pr0n flick or the latest Britney Spears album.
If I were going to give wi-fi access, it will only be to allow others to connect to an OpenVPN port on an offshore provider. Then if I get a motion of discovery dropped on me, I can point to the offshore provider account belonging to someone else and go about my business.
e.g. a sentence. With capitalization and punctuation. You won't really have to worry about dictionary attacks that way.
Will it help me break into my neighbours WiFi?
An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"
I'm sure they're willing to "test" their geolocation analytics while they test your wpa passwords too...
Michael J. Ryan - tracker1.info
or go to your local coffee shop that offers free wifi
O.o
Not if what you want to get to is only on that network...
If their password appears in a dictionary, even one of 135 million words, then you could probably impress that client with shadow puppets, or blowing bubbles.
Because I really find value in testing my OWN network.
An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"
FTA: 20 minutes instead of 5 days.
If 360 people were using this system simultaneously,
There aren't that many idiots here. They're all at the mall.
An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"
Because I really find value in testing my OWN network.
If you don't, then you don't really understand security.
The point is, these dictionaries are already available to the people with their evil bit set.
If you're going "nobody's going to figure out this password," especially if you're running a business, you really should be _making sure_ that nobody's going to figure it out, rather than going on faith.
Unless you have a multi-tens-of-millions word dictionary yourself, so you can make sure that your WPA passphrase isn't in it, you're not properly protecting your network.
"City hall" in German is "Rathaus" Kinda explains a few things......
There's a piece of free software http://code.google.com/p/pyrit/ that could crunch through 135 million passwords in a few hours.
On my GTX275 it would take about 3.5 hours. I think i will save myself $34.
Abort, Retry, Ignore?
Moxie Marlinspike. That's a Gnome name if ever I heard one.
Living in fear must suck, huh? I have 4 open WiFi networks available to me at the moment (in a subdivision with 1/2-acre lots, not in a dense apartment complex). I've hopped onto a neighbor's network when my phone was out, and I have DHCP logs showing when they've been on mine. If I got hit with a subpoena, it'd be a piece of cake to show how many other people are using my router. That's a lot better approach for me and my neighbors than shutting each other out in a moral panic.
Dewey, what part of this looks like authorities should be involved?
You sound like a salesman, "for only $34 you can be sure that your network is secure".
An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"
So.... I guess you really like penises?
A medium 'high-cpu' linux instance at Amazon is $0.17/hr.
($0.17/hr) x (20min) x (400 instances) = $22.66666... +50% = exactly $34
That's far too short. "yourmomdrinksassmilk" would take longer brute force.
I would imagine that would take brute force, yes. I can't imagine my mom agreeing to it.
I should know, I do deauthentication attacks against WPA-PSK encrypted networks, hence my site has a few captured packets then need cracking: http://www.md5decrypter.co.uk/forum/forum_topics.asp?FID=9 I currently only have 1 cracked but tbh, as long as you use a very good password, no one is going to crack it. We'll all have to wait until someone figures out a major hole like in the WEP encryption ;) 5-10 mins, no problem!!
It's a horrible myth that L337SP33K is very secure. Special characters just aren't that great.
Try something like "the quick brown fox shat all over the lazy dog".
Or "twinkle twinkle like a rolling stone".
Or any other phrase that makes sense to your twisted and uniquely messed-up gray matter.
Plaintext is easier for a human to remember than quasi-random characters, and it will be just as secure.
Mod parent up! That's some pretty compelling math.
In Italy, where I live, it is illegal to set up an unprotected wifi point, but since the vast majority of ADSL modem/routers are sold to homes or small businesses, I see a lot of unprotected access points, with names like "D-link "; I doubt that getting people to use robust passwords would work as well as having them use ANY password.
"If a boss demands loyalty, give him integrity. But if he demands integrity, give him loyalty." (John Boyd, 1927-1997)
One more online cracking service for Oracle passwords: http://ops.conus.info/
Any clued neighbor wouldn't be allowing others onto their wi-fi.
Considering my neighbour is hot, blonde and single, if she wants to use my connection to download pr0n I'm sure we can come to some sort of arrangement...
People replying to my sig annoy me. That's why I change it all the time.
Assuming 5 days for a dual core, and thus 2.5-3 days for a quad core, that's not really a huge amount of time on a machine that's easily available. I certainly wouldn't want to spend $34 when i can just leave a spare quad core box running this in the background for a few days.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Capitalism-wise, it's genius. Nearly as smart as prostitution.
"Let me perform a service, charging you by the hour, but the longer I go the happier you are."
-Styopa
Well then it sounds like you have enough users connecting for plausible deniability. If it's only you and your neighbor sharing a private AP, you have the downsides of both the single-house private AP (no plausible deniability) and open AP (can't be sure what's passing over your network) approaches. The blame will fall on the owner of the connection that handled the offending traffic. If he downloads loli or pop culture warez over your connection and the authorities / the MAFIAA take notice, you're fucked, and all he has to do (assuming router logs are nonexistent / have been rotated out) to get off the hook is delete your AP password from his machine (which he can do when he sees the cops bust down your door / your name in the media). Once it's your word against his, you'll just seem like a guilty pedo / pirate trying to blame it on the neighbor.
"When information is power, privacy is freedom" - Jah-Wren Ryel
Really. If you need to spend money to test if your password is secure. Its not. Get a better P@$sW0rD!. Otherwise Looks like I am finally getting FIOS!! lol.
$35 is a one time fee. Much like the activation of any backup anything. Hey and no monthly cost. Unless your caught.
Airs cards average $60 a month and have a 5GB soft cap.
Riiight. It does a dictionary attack on the password. Want to know if your wifi is secure against this? Does it have a dictionary word in it? Then no. Is it a random string? Then yes.
You can pay me now.
Really. If you need to spend money to test if your password is secure. Its not. Get a better P@$sW0rD!. Otherwise Looks like I am finally getting FIOS!! lol.
Right, because it's so simple as just a password. We're not talking about your shitty residential ISP going to your moms basement hooked in to your DD-WRT router. We're talking about businesses who do their own internal audit on their network security. If $34 is all it would cost to make a point to your manager to approve infrastructure upgrade or serious changes, then that's well worth it.
You'd be very surprised how even a very complex password can be cracked with a dictionary attack, including "P@$sW0rD!".
Posts not to be taken literally. Almost everything is sarcasm.
Considering my neighbour is hot, blonde and single, if she wants to use my connection to download pr0n I'm sure we can come to some sort of arrangement...
I told most of my friends to avoid using someone's connection because there's a lot of creeps out there who will probably intercept their information. Parent is a perfect example.
Posts not to be taken literally. Almost everything is sarcasm.
You'd be very surprised how even a very complex password can be cracked with a dictionary attack, including "P@$sW0rD!".
What about: C5&}+6@.lf2^?5Im^j~~+:VBYWe>EPohr@j)R\cwVeb/tqrm,CQDGNk)4p2X=7{;12$?Kvppgx?OWd5*eR,APZxgX^g[/\Xi_t>mwL;tCu_wvIVV{F;V'h:QGOA.o__WU6K7-v'`&&"BbbdkpFs*0I0u$eB$L$m9^vM_P>1nALd%>rbNW`uCnCF'f{][uANt`a6N`n>fKS~c;Y6-!rKS4Mzom0GFOP_-{,&@X52lym:ttAFaR"Kc"oMRQ*^-(fKA;UT/[XXdV+aHO!&Lmk?9h'"D%zp]l\g1G{k$$9tw@w!gFTXoi>cwiW-c'KfG
An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"
That's lovely, but your contract will almost certainly make you liable for all traffic going over the connection you signed the contract to lease. Logs or not, it's your credit card paying the bill, and it'd your address the line is leased to.
Finally had enough. Come see us over at https://soylentnews.org/
Have fun remembering that off the top of your head.
Also, WPA2 passwords are limited to 256 bits, so the maximum length would be 64. Want a quick pseudo-random password? Type this into any bash prompt:
cat /dev/random | tr -dc [:alnum:][:punct:] | head -c64
Not reccomended for commercial application, but it'll keep that stupid kid next door from getting in.
Posts not to be taken literally. Almost everything is sarcasm.
Contract? Lease? WTF are you talking about?
Dewey, what part of this looks like authorities should be involved?
Having a way out of trouble doesn't negate the pain of getting in trouble in the first place. If someone does something naughty on your wifi, it's your computers who are getting confiscated, and you're paying for the lawyer to get it all back. Living in fear does suck, but that's the world we live in.
Give me Classic Slashdot or give me death!
I believe he is working towards your internet connection, you had to sign a contract and you pay that bill under your name correct?
You are all a bunch of idots.
Ehmm, which part of "coming to some sort of arrangement" is creepy? I was kidding along the lines of a shared network drive or something.
If I wanted to eavesdrop I'd just throw it wide open and sit back and watch the traffic roll.
People replying to my sig annoy me. That's why I change it all the time.
3. If you can, use public key authentication. Let’s see them brute-force a 2048 bit key!
Remember that you can't compare symmetric and asymmetric schemes like that. Usually, in symmetric schemes the bits refer to the length of the password, where in asymmetric schemes it refers to the size of the prime numbers involved. For instance it took a good amount of time to break 64-bit DES at distributed.net, but a 663 bit prime number has been factorized using a general purpose algorithm (http://en.wikipedia.org/wiki/RSA#Integer_factorization_and_RSA_problem).
My UID is prime. Hah!
Remember that you can't compare symmetric and asymmetric schemes like that. Usually, in symmetric schemes the bits refer to the length of the password, where in asymmetric schemes it refers to the size of the prime numbers involved. For instance it took a good amount of time to break 64-bit DES at distributed.net, but a 663 bit prime number has been factorized using a general purpose algorithm (http://en.wikipedia.org/wiki/RSA#Integer_factorization_and_RSA_problem).
That would be a 663 bit NUMBER. Even I can factorize prime numbers :P
My UID is prime. Hah!
i concur....this is a problem I have seen been used to convict innocent people of pretty damaging and life altering criminal charges. Too bad the legal system is not more knowledgeable of these things and allow a certain amount of plausibility to these circumstances.
Have fun remembering that off the top of your head.
That's ok ill post it on my blog for easy retrieval.
An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"
I called the local ISP and told them to activate the account. I never signed a contract or service agreement of any kind. And even if I did - that's inapplicable here. Suppose I'm renting a house and my lease says that I'm legally liable for anything that happens on the property. Two drunks kill each other on my rented front yard while I'm not home. Forget the lease; I'm not going to prison for it.
Back to the case in point, although I might be responsible to the ISP for breaking the terms of service in the contract (if there was one), that's a far cry from being legally responsible for a neighbor downloading kiddie porn just because my ISP thought I should be.
Dewey, what part of this looks like authorities should be involved?
Thanks for exposing my key! It took so long to memorize too! I thought I'd never have to change passwords........*grumble* *grumble*
zosxavius photography
I was wondering if this is a dictionary only attack. It is possible that is all they are looking at. I don't know how long a 400 cpu cluster can bruteforce a 64 charachter key, but I would say not long.
zosxavius photography
The article says it's a dictionary attack. It's possible they supplement that a bit, but their whole point (excuse) is that they check your key to see if it's "secure," i.e. not in their dictionary.
Not too much to make her do it, just to guess that she does.
LK
"Hi. This is my friend, Jack Shit, and you don't know him." - Lord Kano