Hashcat Developer Discovers Simpler Way To Crack WPA2 Wireless Passwords (hashcat.net)

New submitter Woodmeister shares a report: While looking for ways to attack the new WPA3 security standard, Hashcat developer Jens "Atom" Steube found a simpler way to capture and crack access credentials protecting WPA and WPA2 wireless networks. The attacker needs to capture a single EAPOL frame after requesting it from the access point, extract the PMKID from it by dumping the recieved frame to a file, convert the captured data to a hash format accepted by Hashcat, and run Hashcat to crack it. Once that's done, the attacker has the Pre-Shared Key (PSK), i.e. the password, of the wireless network. Depending on the length and complexity of the password and the power of the cracking rig, that last step could take hours or days. "The main difference from existing attacks is that in this attack, capture of a full EAPOL 4-way handshake is not required. The new attack is performed on the RSN IE (Robust Security Network Information Element) of a single EAPOL frame," Steube explained. This makes the attack much easier to pull off, as the attacker doesn't depend on another user and on being in range of both the user and the access point at the exact moment when the user connects to the wireless network and the handshake takes place.

Comments

Use good passwords

[dlakelan]

A good password for wifi, since it doesn't really need to be memorized, is one generated by something like keepass2: 15 characters long random letters numbers and punctuation:

DHDukBDL04Pt2ZT

for example (note that is not a password I use, just one I randomly generated).

Since no-one actually has to type this in more than once per device, it's really not a major problem that you can't memorize it.

Re:Use good passwords

[omnichad]

No, but it makes it take longer. If you're not the easiest target on the block it will at least stop casual leechers.

Re:Use good passwords

[Anonymous Coward]

I target all of my neighbors. Any SSID within earshot. Hashcat crunches all of them in the background. It's not much effort.

Re: Use good passwords

[tysonedwards]

Is that randomly generated password more secure than something like âoeEasiest-Target-4-Casual-Leechersâ which someone could easily remember?

Re:Use good passwords

[olsmeister]

I whitelist the MAC addresses I allow to attach to my router.

Re: Use good passwords

[omnichad]

Both are stronger than your neighbors'.

Re:Use good passwords

[gtwrek]

Someone's going to need to translate the likely length of a crack. The quote "that last step could take hours or days" isn't all that helpful.

If we have a WPA2 (max) 63 printable ASCII character random password, is the crackable time of this attack still on the order of "a couple of days"?

i.e. can casual users mitigate this attack by just increasing their WPA2 password length? To what size?

Or is this attack some sort of end-around where the size of the WPA2 ascii key doesn't matter. It's not clear to me, but then again, I'm no security expert either...

Re:Use good passwords

[Anonymous Coward]

I sniff those too. Easy enough to spoof. Sometimes I have to wait for the impersonated device to be offline. Depends on the AP and the device.

Re:Use good passwords

[Anonymous Coward]

Very few of them, actually.

Moreover, if some attacker is going to use this approach, (s)he is likely not looking for the easiest target on the block, but for the ones worthy of his/her attention because (s)he has specific plans. If someone a worthy target, the attacker just passes by the relevant house or office, collects the data, and patiently cracks it. It doesn't matter if it takes them 1 day or 50. If the target is worth and the crack is computationally feasible, they'll do it and wait as long as needed.

Re:Use good passwords

[Xenolith0]

MAC whitelists do NOTHING for security.

First, anyone who can sniff the wifi traffic can see all the mac addresses.
Second, in Linux you can change your MAC to whatever you want with one command:

ip link set dev enp0s3 address DE:AD:BE:EF:CA:FE

Re:Use good passwords

[sims 2]

Ahahaha.

I really hope you were being sarcastic.

Re:Use good passwords

[skoskav]

You clearly never have guests over.

Re: Use good passwords

[Anonymous Coward]

What i have at home is a faraday cage with the router and a comfy chair inside it.

Re: Use good passwords

[c6gunner]

That's what a guest network is for. Enable it when they show up, disable it when they go away.

Re: Use good passwords

[Anonymous Coward]

What am I, a network administrator? Who's got time for that

I give them my neighbor's SSID and password, which I've cracked. Problem solved.

Re:Use good passwords

[Anonymous Coward]

Actually it will stop hashcat from cracking the password. This attack is still just a brute force attack, which means you blindly try passwords until you find one that matches. 15 characters randomly chosen from uppercase letters + lowercase letters + numbers + punctuation create an effective key length of log2(26+26+10+10)^15) = 92 bits. That's enough to make finding the key practically impossible. Make it 21 characters long to get 129 bit key strength.

Re: Use good passwords

[Anonymous Coward]

and use VLANs to ensure the guest network doesn't have access to anything but the internet.

Re:Use good passwords

[Petersko]

Why would you limit yourself to 15 characters? Mine is 63 characters of gibberish. Cut/Paste from my phone's KeePass client.

If you must give it to somebody, do it in email with no context. Knowing the password doesn't help when you don't know what network it's for.

Re:Use good passwords

[hawguy]

A good password for wifi, since it doesn't really need to be memorized, is one generated by something like keepass2: 15 characters long random letters numbers and punctuation:

DHDukBDL04Pt2ZT

for example (note that is not a password I use, just one I randomly generated).

Since no-one actually has to type this in more than once per device, it's really not a major problem that you can't memorize it.

It may not need to be memorized, but it does need to be typed into every Wifi device you own, sometimes through a clunky on screen or "scroll through the letters" LCD interface. So random string passwords are annoying enough that many people avoid them.

Re: Use good passwords

[Anonymous Coward]

might as well use ethernet, or tin cans with a string...

R O

Re:Use good passwords

[Anonymous Coward]

Basic combinatorics: (size of character set)^(number of characters in password) is the size of the key space. To span an equivalent key space with just ones and zeros, you need log2(size of key space) bits. There are 95 printable ASCII characters: log2(95^63)=413 bits. The actual key derived from the passphrase is just 128 bits long, so that's overkill. You can max out the key strength with just 22 randomly (!) chosen characters from uppercase+lowercase+numbers. If your password is not completely random (it contains words, you typed "randomly", etc.), then you need more characters.

Re: Use good passwords

[93 Escort Wagon]

That's what a guest network is for. Enable it when they show up, disable it when they go away.

Trivially easy to do on some routers, like Apple’s Airport series. Too bad they discontinued them...

Re:Use good passwords

[marklark]

Why couldn't I defeat port-knocking by watching for the connection behavior of successful users and then mimicking them? - spoofing MAC address, etc, if necessary.

Re:Use good passwords

[Anonymous Coward]

Oh, and the attack is still just brute force. In an offline brute force attack, you need something that tells you if the password you're trying is the/a right one (an "oracle"). The new attack makes it easier to find that thing that you "compare" against while brute forcing the password. It does not give the attacker any information about the password itself.

Re:Use good passwords

[The-Ixian]

I just used an NFC tag to put the password in. Stuck the tag to a central location in the house and any guest can just tap their phone to the tag.

Re:Use good passwords

[Bert64]

Password cracking tools have rules to take dictionaries and perform common substitutions like o->0, case toggling, appending of random characters and numbers, concatenating of words etc... They can also try many thousands or even millions of attempts per second depending on the algorithm and available processing power.

A dictionary word with numbers or a couple of random chars appended will not last long.

Re:Use good passwords

[bjwest]

You clearly never have guests over.

My guests come to visit me for things like dinner and conversation, to watch a movie or play games, they don't come to leach off my internet sitting on the couch tweeting and facebooking.

Re: Use good passwords

[bjwest]

That's what a guest network is for. Enable it when they show up, disable it when they go away.

Trivially easy to do on some routers, like Apple’s Airport series. Too bad they discontinued them...

Or buy a decent router you can upgrade to a third party firmware instead of using the crap from the manufacturer.

Re:Use good passwords

[gtwrek]

Is that what this crack is - a quicker (perhaps offline) tests of the randomly guessed (128 bit) password?

If so, then nothing to see hear, move along. 128-bit passwords will be okay for a while longer, I think - even with an accelerated compare.

Re:Use good passwords

[Swave An deBwoner]

That suggests a benefit in periodically changing the passphrase then. So they'll have to start cracking it all over again from the beginning.

Re: Use good passwords

[skoskav]

Completely agree about guest networks, but I still despise randomized alphanumeric passwords as a general policy. Comparing passwords using the zxcvbn library via https://www.bennish.net/passwo..., I note that "DHDukBDL04Pt2ZT" is about as secure as "my flemish glassblower costume", but only one of them allows me to go into another room and enter it into a new device.

This password strategy works even better for Germanic languages which can construct a near-infinite amount of nonsensical compound words, which inconveniences dictionary attacks.

Re:Use good passwords

[F.Ultra]

I use the full 63 key length in WPA2 with random characters. It's a royal pain when you buy new mobiles or other appliances that needs internet connectivity but that's the price you have to pay.

Re:Use good passwords

[skoskav]

You're making it into a bit of a false dichotomy. My guest Wi-Fi is generally only used when sharing pictures/video or troubleshooting my family members' devices.

Re:Use good passwords

[gregstumph]

Mmmm... Dead beef.

Re:Use good passwords

[AHuxley]

The math protected the encrypted network.
The network was not secure when it first starts.
The network has to communicate about shared keys when first connecting.
That first, initial communication is altered by another computer in the middle.
That will reset further communication and the computer in the middle is then trusted.
That nonce “number used once” is then well in play before any long password.
ie the middle has a trusted way in and has part of what is needed to later be trusted. The needed math to then work out what the user was encrypting is then much more easy.
The data stream has an extra user.

Re: Use good passwords

[Bender0x7D1]

might as well use ethernet, or tin cans with a string...

That would require multiple dongles if he has a Mac.

Re: Use good passwords

[c6gunner]

I'm aware of all this; the passwords I actually want/need to remember are all composed of at least 4 words, in at least two different languages. However the vast majority of my passwords (especially the ones I rarely have to type) are random alphanumeric strings stored in an encrypted container.

Why? Because I have upwards of 100 accounts I've signed up for over the years, and I do not reuse passwords. No matter how "easy to remember" I might make them there's no way I'm memorising more than a dozen passwords, let alone 100+.

Re:Use good passwords

[AmiMoJo]

I posted this comment on the firehose submission. TL;DR with a good password it's still impractical to crack via brute force, all this does is make dictionary/rainbow table attacks a bit more practical by easing the gathering of the necessary data.

I had a look at this and it's interesting, but I wouldn't say that WPA2 is "cracked".

Previously you had to capture the handshake from a real user and then crack the crypto. The crypto wasn't bad but was vulnerable to dictionary attacks, rainbow tables and the like. But if you used a good key you were, and still are, quite secure.

This new attack means that the attacker doesn't have to wait for an authenticated user to connect any more. It fixes a lot of the problems that made cracking even weak passwords difficult, like the potentially large amount of time needed and the possibility of necessary packets failing to capture due to interference or poor signal. But crucially it doesn't affect the crypto, so you still need to do that very expensive offline attack on the key.

Re:Use good passwords

[AmiMoJo]

Unless they have an iPhone, where the NFC can only be used for Apple Pay and nothing else.

For lowly iPhone users a primitive QR code works, but of course you have to print a new one every time you change your wifi password.

Re:Use good passwords

[AmiMoJo]

It may not need to be memorized, but it does need to be typed into every Wifi device you own, sometimes through a clunky on screen or "scroll through the letters" LCD interface.

If the device's UI is that bad you have to wonder if their security is any better. Best to keep them off the network, or create a severely restricted second SSID just for them.

Re:Use good passwords

[AmiMoJo]

That's not the threat that port knocking defends against. If someone can observe connections to your server then port knocking won't help you.

If you have a port accepting incoming connections from the internet it will get hammered. People are scanning all the time, they will find it and throw every protocol and exploit imaginable at it.

Port knocking allows you to simply drop all packets until you see the knock, which makes it look like your host is offline or at least properly firewalled. At the very least it offers protection against zero-day exploits from botnets and port scanning script kiddies.

Re:Use good passwords

[Ingenium13]

Most routers or APs allow you to have a guest network that's isolated from your personal network (via VLANs typically, but Asus routers seem to bridge the interfaces with the same address space and use ebtables to separate them from interacting). You can use a weaker password for guests. And allow traffic selectively between the subnets if you want (for example, I allow access to my networked printer for guests).

Re:Use good passwords

[lsatenstein]

I have a password generator that is fairly simple.
I uses the website info, my reserved word and a salt string as input to the sha1sum program. I upper case every alternate letter.

That modified sha1sum output usually does the job. No two sites that I visit gets the same password string.

Re:Use good passwords

[hawguy]

It may not need to be memorized, but it does need to be typed into every Wifi device you own, sometimes through a clunky on screen or "scroll through the letters" LCD interface.

If the device's UI is that bad you have to wonder if their security is any better. Best to keep them off the network, or create a severely restricted second SSID just for them.

My printer has a 16 character LCD display and 5 buttons, that's all it needs, I don't want or need a better UI (and don't feel like paying any extra for it), and I don't see how I can make any assumptions between the quality of the UI and the security of the product.

In any case, all of my non-computer devices do live on their own SSID. Yet I still want that SSID to be secure.

Re: Use good passwords

[F.Ultra]

Meanwhile any sane person would understand that the keys are never used directly by any device, instead a hash of the key is which means that every single one of your devices will always use a full 256-bit PSK regardless of if your passphrase is one character or 63 as mine is.

May as well put this into WiFi driver

[mi]

If it is as easy as described, we may as well add the functionality to the WiFi-drivers:

1. Searching for WiFi-networks
2. Connecting to Boo, because it has the strongest signal
3. Cracking Boo's preshared key
4. Verifying Internet-connectivity
5. Connected! (Profit!)

Re:I don't use wireless

[Anonymous Coward]

CAT5 has been broken. You need to upgrade to CAT6.

How does this apply to full length keys?

[sims 2]

Like: 112364AB5F777752452A57CAC066DE0737DE451E0CC21BE86D01278A6050297B

64 character pseudo random hexadecimal key the max length supported by the standard.

Is that still considered secure or would that only take a few days to crack?

From what I read it looks like it should still be secure enough.

Re:How does this apply to full length keys?

[TechyImmigrant]

Like: 112364AB5F777752452A57CAC066DE0737DE451E0CC21BE86D01278A6050297B

It won't take very log. You've already given us the password.

Re:How does this apply to full length keys?

[Anonymous Coward]

RTFA: "Luckily, protecting one’s WPA and WPA2 wireless networks against this attack is as easy as setting a complex, long and random password – and not using the one generated by the router."

Re: How does this apply to full length keys?

[c6gunner]

It's no different than brute forcing any other 64 bit AES key. Hundreds of years using a single computer.

Re:How does this apply to full length keys?

[datavirtue]

...or you could just spoof the MAC of someone who has already authenticated and take their session. Preferably one who is sitting idle so they don't re-auth or call IT asking why they keep getting disconnected.

Re:How does this apply to full length keys?

[IMightB]

Like: 112364AB5F777752452A57CAC066DE0737DE451E0CC21BE86D01278A6050297B

It won't take very log. You've already given us the password.

All I see is **********************

Re:How does this apply to full length keys?

[TechyImmigrant]

Like: 112364AB5F777752452A57CAC066DE0737DE451E0CC21BE86D01278A6050297B

It won't take very log. You've already given us the password.

All I see is **********************

Take off the VR headset

Re:How does this apply to full length keys?

[93 Escort Wagon]

Yeah, this “discovery” still boils down to brute-forcing an encrypted password.

I’m not worried about my WPA2 network.

Re: How does this apply to full length keys?

[ls671]

Exactly, unless you have thousands of super computers at hand.

Some providers have fixed length passwords by default (8 hex digits, I have seen some with 10 hex digits). Some people use common dictionary words as passwords. Those are trivial to crack.

I have even seen providers using the first 8 hex digits of the mac address as wifi password. :)

Apart from that, you are pretty much safe.

Re:How does this apply to full length keys?

[93 Escort Wagon]

Like: 112364AB5F777752452A57CAC066DE0737DE451E0CC21BE86D01278A6050297B

It won't take very log. You've already given us the password.

No, that’s the combination to his luggage - “Hunter2” is his WPA2 password.

Re:How does this apply to full length keys?

[whoever57]

Have fun typing that in using the on-screen keyboard of a cellphone.

Re:How does this apply to full length keys?

[ls671]

If I remember correctly, this is not going to work. It isn't like stealing an http session cookie. Again, if I remember correctly, you need to know the wifi password to send valid traffic and/or to negotiate a valid temporary key in order to send valid traffic.

Anybody feels like confirming this?

Re: How does this apply to full length keys?

[lgw]

Exactly, unless you have thousands of super computers at hand.

How important is cracking that password? It's quite easy to get 10000 cores working in parallel for $80 per core-year.

If you're satisfied with it costing more to crack your password than it would cost for the attacker to just get his own Internet service, a medium-strong password is fine.

Re: How does this apply to full length keys?

[ls671]

So, what is your point with regards to what I wrote? 10000 cores might or might not qualify as 1 super-computer but this seems irrelevant.

By the way, cores suck at cracking WPA/WPA2 passwords. Hashcat uses GPUs for maximum efficiency.

Re: How does this apply to full length keys?

[edtice1559]

I think you are missing the point of cracking the password. It's not to get internet access. It's to sniff traffic on the network. If you sniff traffic on my home network you could watch This Is Us for free which isn't much of a gain. But if the network is home to higher value targets, getting a wireless connection is a gold mine as you will already be behind the firewall.

Re:How does this apply to full length keys?

[gtwrek]

Make a QR-code of the SSID/ (long) password. It's a standard QR field. Print it out and have available for anyone in your house to quickly snap, and you're done.

Of course there's readily available QR software for this on the web. But then using a web QR generator requires one upload their password out in the open to a random third party. I recommended a locally run QR generator.

Re: How does this apply to full length keys?

[ls671]

Exactly! The GP mentioned 10,000 cores like it was a big deal so I assumed that he meant CPU cores.

The smallest Amazon P2 instance has 2500 GPU cores, the biggest has 40,000 GPU cores.

Re-read the GP post and try to fit the price he mentioned with GPU cores offered by Amazon.

https://aws.amazon.com/ec2/ins... .9$/2500*24*365 = 3.15360

3.15$ by GPU core a year, not 80$ per core a year! So IMHO he meant CPU cores.

Feel free to review my numbers, I did this quickly.

Cheers,

Re: How does this apply to full length keys?

[lgw]

Pedantic much?

My point was just that anyone these days can grab may thousands of servers to crunch anything parallelizable, and it's not even that expensive. Supercomputers are no longer exotic.

And of course anything that depends on SHA-256 is even easier - you can pick up a box that can do 1 trillion hashes per second for ~$200, thanks to bitcoin.

Re: How does this apply to full length keys?

[Swave An deBwoner]

And you'll be able to capture all of the encrypted (SSH, TLS) traffic?

Re:How does this apply to full length keys?

[serviscope_minor]

That's funny, it looks like hunter2 to me!

Re:How does this apply to full length keys?

[14erCleaner]

That used to be my password (or something very similar). It was a pain because I couldn't tell the 0 and O characters apart, and had to try a few dozen times to get it right each time.

Re: How does this apply to full length keys?

[c6gunner]

Yes.

Re: How does this apply to full length keys?

[Bert64]

Why would it cost anything? If an attacker is willing to perform illegal intrusions onto your wifi network, they're not going to balk at compromising someone else's systems to use for password cracking so it wouldn't be the attacker who's paying for those cpu cycles.

Re:How does this apply to full length keys?

[sims 2]

I had that problem too using a random 63 character standard password but there are just too many characters that look the same under most fonts.

So I switched to a 64 character hexidecimal password.
Hexidecimal is limited to characters A-F and 0-9
So no o 0 problem anymore as hexidecimal doesn't have "o"s.

An alternative is just using a password generator that avoids using easily mistaken characters.

Re:How does this apply to full length keys?

[sims 2]

I think this would only work for bypassing a MAC address filter.

WPA2 uses a 4 way handshake or something meaning its not possible for a computer to carry on a conversation with the network without knowing the key.

WPA2 isn't just authentication it's also encryption.
It's the diffrence between using a site that uses https only for the login page (only initial authentication secured) and a site that uses https for all pages (fully encrypted).

Re:How does this apply to full length keys?

[sims 2]

It's much easier to type on a cellphone than a 63 character random standard password like: IZvmnyD.GI2HCv*SK!nkB2%JYFLV6y:p%QD;Zz6fS,7PH45pDW7E3PzEXZ=wl5;

Uppercase, lowercase is that an I, l, | or 1? o, O or 0?

Re: How does this apply to full length keys?

[edtice1559]

If you have unfettered access to the network and some basic skills, you will get in pretty deep. Capturing encrypted traffic won't be of much value. Your next step will be to try to gain access to one of the hosts. Even if all of the hosts are completely patch on day one, you can just be patient. All it takes is one exploit that you know about before the target and you've then gained additional access. If the target is an organization, there are likely many hosts and you only need to find one additional vulnerability now that you are behind a firewall. Probably takes zero skill. Rote use of nmap and metasploit will likely get you there. Boring for sure. I would lose my mind But some people actually find this type of exploitation fun.

Re: How does this apply to full length keys?

[lgw]

There's still an opportunity cost. Any botnet an attacker may control could be rented out or used to mine altcoin. Or, for a government attacker, there are always competing priorities.

Re: How does this apply to full length keys?

[ls671]

Well, be nice with him. Although expectations are low, some people win the lottery so he might find it early, who knows?

Re: How does this apply to full length keys?

[Swave An deBwoner]

I was thinking of "home" networks, not organizations. One would expect an "enterprise" organization to not be using WPA2/PSK but maybe something a little harder to defeat, but it's probably true that many just use a $50 router they bought "to keep expenses down".

Re:How does this apply to full length keys?

[ls671]

yep, yep, yep, well said!

Cheers,

Re:Bypassing login password by booting a different

[Anonymous Coward]

You don't seem to understand this attack at all. It makes it possible to precompute the password to a WPA2-PSK network without having to wait for a valid client to authenticate against the network in the first place.

So you can just walk around an apartment block with your phone asking each AP for the needed packet. Go back home, crack it all offline and come back doing automated attacks on every network. Each visit takes a few minutes each time instead of having to wait for a valid authorized client for each network. Can be dronified of course for extra flare.

This breaks WPA2-PSK by making attacks trivial to do. I wonder how the Enterprise versions hold up.

Re:Bypassing login password by booting a different

[barakn]

Your sarcasm detector is broken.

Re:I don't use wireless

[ArchieBunker]

I'm still using 10BASE5!

Re: Bypassing login password by booting a differen

[c6gunner]

This breaks WPA2-PSK by making attacks trivial to do

No, it doesn't; it merely makes it more vulnerable for users who aren't following good password guidelines (which, admittedly, is most of them).

WPA2 supports a maximum password length of 64 characters; if your target is using a password of sufficient complexity then the attack is going to be impossible rather than trivial.

Re:I don't use wireless

[ls671]

Hey me too! A millennial technician came to my place when I was away to pick up a machine that was attached to the network. It was the machine at the end of the coax. He didn't put the end plug back at the end of the cable thus taking the whole network down then, he left with his machine :)

 

Just use a pass phrase, already

[alispguru]

The password for my home network is a correctly capitalized and punctuated sentence.

Everyone on my network can spell, and knows where the shift key is, even the guests.

Simpler way ...

[fahrbot-bot]

... obviously involves a $5 wrench.

Re: Bypassing login password by booting a differen

[WaffleMonster]

Was having fun with analogy.

The computer user password is not to protect against local access to the data.

PSK algorithm is not designed to protect against offline brute force campaigns. Well known property of PSK. It's why people have always had to chose increasingly absurdly long passwords to secure their APs.

You need to encrypt the files or entire drive like you are planning.

You need to use a secure authentication protocol like what's included with WPA3 to avoid susceptibility to offline brute force campaigns.

Only for WPA3 they chose a crappy authentication protocol out of the gate opting for a balanced PAKE when better (augmented) versions are readily available on similar terms.

Difference between balanced and augmented is a bit like the difference between a password file stored as plaintext or hashed.

If it's hashed (augmented) and stolen someone needs to crack it before they can login as you. If it's plaintext (balanced) as what was selected for WPA3 they can login as you immediately without cracking it.

A lifetime ago Cisco released an undocumented authentication protocol for username/password wireless authentication (LEAP) that was quickly revealed in all ways that mattered to essentially be MSCHAPv1.

At the time of release shortcomings of MSCHAPv1 were well known. Surely someone must have known yet they went ahead and did it anyway. While not nearly as egregious the same theme is being repeated with WPA3. Better algorithms with better properties are readily available yet they elect to go forward with the inferior one anyway.

Re:I don't use wireless

[psergiu]

Hand in you geek badge when you exit.
Confusing 10Base-2 with 10Base-5 is a big offense here on /.

Re:I don't use wireless

[ls671]

Hand in you geek badge yourself buddy!

What makes you think I confused anything???

hint: vampire tap are optional

https://en.wikipedia.org/wiki/...:

As is the case with most other high-speed buses, segments must be terminated at each end. For coaxial-cable-based Ethernet, each end of the cable has a 50 ohm resistor attached. Typically this resistor is built into a male N connector and attached to the end of the cable just past the last device. With termination missing, or if there is a break in the cable, the signal on the bus will be reflected, rather than dissipated when it reached the end. This reflected signal is indistinguishable from a collision, and prevents communication.

Re: Bypassing login password by booting a differen

[Khyber]

I wonder if taking a two-pronged approach to this would work better. Hashcat plus the same AES-busting technique used to break the password on Julian Assange's Insurance files. First reduce the possible keyspace with the AES busting technique, then Hashcat the remainder.

Run an open wifi

[mea2214]

...and you never have to worry about password or any of this BS. My open wifi in a densely populated neighborhood has been running for 6 1/2 years getting around 30 unique visitors/day, 200 unique visitors/month. Why are people so stingy with their wifi? Most everything is encrypted end to end nowadays.

Re:Run an open wifi

[Anonymous Coward]

Because if someone uses your Wi-Fi for illegal purposes you will be the one getting visited by the police. You may be innocent of committing any crime, but you will spend time and money explaining yourself and be on the local cop's radar forever.

Re:Run an open wifi

[piers_downunder]

If I'm already doing illegal things, then locking down the password points the finger directly at me. At least in an open network, I have plausible deniability.

Re:Run an open wifi

[strikethree]

I used to do this. I am not in a position to do it currently.

I had realtors and police as the main users. I would see them park outside of my house. It felt good to share and nobody abused the privilege. This is how society should be.

As a security oriented person, I had limits and filters in place in case anyone decided to get too "uppity", but nobody ever hit any of those.

Re:Bypassing login password by booting a different

[KClaisse]

Here's a fun piece of information! On Windows 10, if you boot from a live linux distro and rename sethc.exe to sethc.exe.bak and copy cmd.exe to sethc.exe. Now when you reboot, at the Windows 10 login screen you can get an administrator-level command prompt by hitting the shift key 5 times. \o/

Security at its finest.

Re:I don't use wireless

[ELCouz]

WHOOOSH!

Re:Bypassing login password by booting a different

[WaffleMonster]

You don't seem to understand this attack at all.

I don't care about the distinctions. All irrelevant as far as I'm concerned.

It makes it possible to precompute the password to a WPA2-PSK network without having to wait for a valid client to authenticate against the network in the first place.

So what? Being patient or deauth yields same result. Hurdle to successful compromise has not substantially changed has it? Brute force campaign required in either scenario is substantially more labor intensive.

This breaks WPA2-PSK by making attacks trivial to do.

No more or less trivial than brute force campaign required to crack the password.

Length of the passphrase is most important

[raymorris]

The length of a passphrase is most important. Using punctuation or not doesn't make as much difference. That's true of passphrases generally.

For WPA2 specifically, it ends up being turned into a 128-bit key, which is 22 random keyboard characters. You can easily get the same 128 bits by using a few words, especially non-dictionary words such as Greystone or Jamerican.

Re:Length of the passphrase is most important

[Highdude702]

Correct, length is the major factor, its good to have some punctuation and special characters, it helps to add years to the brute force with the length, and seeing as its only for a wifi password i doubt anybody is going to point any kind of cracking/mining rig at it for any length of time. I use a self generated 18 character password that is easy for me to remember but to normal people looks completely random. i dont even think i own enough gpu's to brute force it if i gave hashcat half of the password before the life of the gpu's are up.

Good Luck

[nehumanuscrede]

If you can brute force my passphrase via Hashcat, you DESERVE to get access to my network.

Well, the Wi-Fi segment anyway. All my networks are isolated from each other. Wi-Fi traffic isn't allowed to talk with anything on the local network. Not even other clients.

The key you need to brute force:

Thirty two characters long. Upper / lower case, numbers and symbols.

Doing the math tells me I have nothing to worry about from Hashcat any time soon.

It's far more likely folks will resort to means other than brute force to obtain my key. Assuming access to my network is important enough for someone to try.

Which, it's not.

Re: I don't use wireless

[dohzer]

Lay them on the floor? Dude... you need to use cable stands or your SNR will degrade. Make sure you connect them in the right direction to control the electron flow for maximum sound performance.

Want a secure wifi?

[ebvwfbw]

Use radius. Problem solved.

Re: Bypassing login password by booting a differen

[strikethree]

Surely someone must have known yet they went ahead and did it anyway. While not nearly as egregious the same theme is being repeated with WPA3. Better algorithms with better properties are readily available yet they elect to go forward with the inferior one anyway.

This has been a common theme since wireless encryption has been a thing. I am reminded of a saying: Once is happenstance. Twice is suspicious. Three times is enemy action.

We have achieved the enemy action stage.