Slashdot Mirror
WPA-PSK Cracking As a Service
An anonymous reader writes "Moxie Marlinspike, a security researcher well known for his SSL/TLS attacks, today launched a cloud-based WPA cracking service, where for $34 you can test the security of your WPA password. The WPA Cracker Web site states: 'WPA-PSK networks are vulnerable to dictionary attacks, but running a respectable-sized dictionary over a WPA network handshake can take days or weeks. WPA Cracker gives you access to a 400CPU cluster that will run your network capture against a 135 million word dictionary created specifically for WPA passwords. While this job would take over 5 days on a contemporary dual-core PC, on our cluster it takes an average of 20 minutes.'"
So for $34 you can make sure your password is part of their dictionary?
I think the tool is not being sold to people wanting to crack into a WiFi network, rather selling to people so that they can test their WiFi network.
While this job would take over 5 days on a contemporary dual-core PC, on our cluster it takes an average of 20 minutes
Anyone interested in testing their own key would not care about it taking 5 days. During a weekday, you're not around most of the time anyway. I doubt anyone cares enough to spend $40 for something that can be done for free.
Please help metamoderate.
$34 to see if your password can survive a dictionary attack? Hell pay me $20 and I'll gladly save you some money and provide you with a password guaranteed to be unbreakable by brute force. I'll even sign an NDA to ensure I don't disclose it to anyone but rest assured even I won't be able to remember it!
Did you ever wake up in the morning, with a Zombie Woof behind your eyes? -- FZ
"Marlinspike declined to say who operates his compute cluster"
I guess he can't come out and say he's using botted boxes, right?
I think the tool is not being sold to people wanting to crack into a WiFi network, rather selling to people so that they can test their WiFi network.
[x] Check this box if you are above the age of 18 and promise not to use this tool for malicious intends.
[BUY NOW!!!]
...$34 is the super-fast price.
Alternatively you could actually not be an asshat, get on with your neighbour and negotiate with them (over a 6 pack of beer) to allow legal access in the event of an outage.
Who uses WPA or WEP anyways? Either you leech your neighbor's unprotected WiFi, you live far enough away from other homes so that your signal doesn't leave your property, or you maintain a separate DMZ of wireless IPs that can't get into the good stuff, but can access the Internet.
Next people will say that MAC address security is actually meaningful.
I want to delete my account but Slashdot doesn't allow it.
Isn't it cheaper, easier, and less douchebaggy to just get an aircard?
I want to delete my account but Slashdot doesn't allow it.
Actually, in this case, it's very straightforward. He's using Amazon EC2. EC2 charges by the hour, and all you have to do is spin up the number of servers you want. In fact, I happened to run the numbers on what the costs are for running 50 "8-core" servers, and it happens to be...$34/hour. So, what he did was say, "If I run two jobs an hour, I make a small amount of money. If I run 4-5 jobs per hour, I make more money"
This is, of course, a textbook use case for EC2, and I'm surprised no one has done it sooner.
me@mzi.to
They don't discuss it, but I wonder if they don't just fire up 400 Amazon instances, do the work, then shut them off. For $34 (an oddly specific number), they can't afford to have 400 CPUs around. However, if they allocate on a job-by-job basis, then their overhead is very low.
This kind of work (high computation, high parallelization, infrequent request) might be the most brilliant and non-obvious use of cloud computing. Low overhead due to using someone else's hardware (rather than having 400 CPUs laying around). If this is truely what they are doing, I am very impressed.
For $30 I'll run the command-line random number generator I found on the web and send you a 60 digit number.
If you act today, that's only 50 cents a number!
If their password appears in a dictionary, even one of 135 million words, then you could probably impress that client with shadow puppets, or blowing bubbles.
Because I really find value in testing my OWN network.
If you don't, then you don't really understand security.
The point is, these dictionaries are already available to the people with their evil bit set.
If you're going "nobody's going to figure out this password," especially if you're running a business, you really should be _making sure_ that nobody's going to figure it out, rather than going on faith.
Unless you have a multi-tens-of-millions word dictionary yourself, so you can make sure that your WPA passphrase isn't in it, you're not properly protecting your network.
"City hall" in German is "Rathaus" Kinda explains a few things......
I thought this was how you brute forced a password in less than 30 minutes.
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
Living in fear must suck, huh? I have 4 open WiFi networks available to me at the moment (in a subdivision with 1/2-acre lots, not in a dense apartment complex). I've hopped onto a neighbor's network when my phone was out, and I have DHCP logs showing when they've been on mine. If I got hit with a subpoena, it'd be a piece of cake to show how many other people are using my router. That's a lot better approach for me and my neighbors than shutting each other out in a moral panic.
Dewey, what part of this looks like authorities should be involved?
A medium 'high-cpu' linux instance at Amazon is $0.17/hr.
($0.17/hr) x (20min) x (400 instances) = $22.66666... +50% = exactly $34
Any clued neighbor wouldn't be allowing others onto their wi-fi.
Considering my neighbour is hot, blonde and single, if she wants to use my connection to download pr0n I'm sure we can come to some sort of arrangement...
People replying to my sig annoy me. That's why I change it all the time.
Well then it sounds like you have enough users connecting for plausible deniability. If it's only you and your neighbor sharing a private AP, you have the downsides of both the single-house private AP (no plausible deniability) and open AP (can't be sure what's passing over your network) approaches. The blame will fall on the owner of the connection that handled the offending traffic. If he downloads loli or pop culture warez over your connection and the authorities / the MAFIAA take notice, you're fucked, and all he has to do (assuming router logs are nonexistent / have been rotated out) to get off the hook is delete your AP password from his machine (which he can do when he sees the cops bust down your door / your name in the media). Once it's your word against his, you'll just seem like a guilty pedo / pirate trying to blame it on the neighbor.
"When information is power, privacy is freedom" - Jah-Wren Ryel
And this matters because..
#1: It's IT-related
#2: It's Security IT-related
#3: Within IT, it has to do with one of the most prevalent technologies in use today.
#4: And finally, it's here, because it sure as hell ain't gonna show up on CNN or the nightly news "tech" corner. Well, at least not for another 6 months or so, when it's "breaking news" to them.