Slashdot Mirror
Hashcat Developer Discovers Simpler Way To Crack WPA2 Wireless Passwords (hashcat.net)
New submitter Woodmeister shares a report: While looking for ways to attack the new WPA3 security standard, Hashcat developer Jens "Atom" Steube found a simpler way to capture and crack access credentials protecting WPA and WPA2 wireless networks. The attacker needs to capture a single EAPOL frame after requesting it from the access point, extract the PMKID from it by dumping the recieved frame to a file, convert the captured data to a hash format accepted by Hashcat, and run Hashcat to crack it. Once that's done, the attacker has the Pre-Shared Key (PSK), i.e. the password, of the wireless network. Depending on the length and complexity of the password and the power of the cracking rig, that last step could take hours or days. "The main difference from existing attacks is that in this attack, capture of a full EAPOL 4-way handshake is not required. The new attack is performed on the RSN IE (Robust Security Network Information Element) of a single EAPOL frame," Steube explained. This makes the attack much easier to pull off, as the attacker doesn't depend on another user and on being in range of both the user and the access point at the exact moment when the user connects to the wireless network and the handshake takes place.
A good password for wifi, since it doesn't really need to be memorized, is one generated by something like keepass2: 15 characters long random letters numbers and punctuation:
DHDukBDL04Pt2ZT
for example (note that is not a password I use, just one I randomly generated).
Since no-one actually has to type this in more than once per device, it's really not a major problem that you can't memorize it.
((lambda (x) (x x)) (lambda (x) (x x))) http://www.endpointcomputing.com a scientific approach to custom computing.
If it is as easy as described, we may as well add the functionality to the WiFi-drivers:
In Soviet Washington the swamp drains you.
You don't seem to understand this attack at all. It makes it possible to precompute the password to a WPA2-PSK network without having to wait for a valid client to authenticate against the network in the first place.
So you can just walk around an apartment block with your phone asking each AP for the needed packet. Go back home, crack it all offline and come back doing automated attacks on every network. Each visit takes a few minutes each time instead of having to wait for a valid authorized client for each network. Can be dronified of course for extra flare.
This breaks WPA2-PSK by making attacks trivial to do. I wonder how the Enterprise versions hold up.
Like: 112364AB5F777752452A57CAC066DE0737DE451E0CC21BE86D01278A6050297B
It won't take very log. You've already given us the password.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
The password for my home network is a correctly capitalized and punctuated sentence.
Everyone on my network can spell, and knows where the shift key is, even the guests.
To a Lisp hacker, XML is S-expressions in drag.
Like: 112364AB5F777752452A57CAC066DE0737DE451E0CC21BE86D01278A6050297B
It won't take very log. You've already given us the password.
All I see is **********************
It must have been something you assimilated. . . .
Was having fun with analogy.
The computer user password is not to protect against local access to the data.
PSK algorithm is not designed to protect against offline brute force campaigns. Well known property of PSK. It's why people have always had to chose increasingly absurdly long passwords to secure their APs.
You need to encrypt the files or entire drive like you are planning.
You need to use a secure authentication protocol like what's included with WPA3 to avoid susceptibility to offline brute force campaigns.
Only for WPA3 they chose a crappy authentication protocol out of the gate opting for a balanced PAKE when better (augmented) versions are readily available on similar terms.
Difference between balanced and augmented is a bit like the difference between a password file stored as plaintext or hashed.
If it's hashed (augmented) and stolen someone needs to crack it before they can login as you. If it's plaintext (balanced) as what was selected for WPA3 they can login as you immediately without cracking it.
A lifetime ago Cisco released an undocumented authentication protocol for username/password wireless authentication (LEAP) that was quickly revealed in all ways that mattered to essentially be MSCHAPv1.
At the time of release shortcomings of MSCHAPv1 were well known. Surely someone must have known yet they went ahead and did it anyway. While not nearly as egregious the same theme is being repeated with WPA3. Better algorithms with better properties are readily available yet they elect to go forward with the inferior one anyway.
Exactly, unless you have thousands of super computers at hand.
How important is cracking that password? It's quite easy to get 10000 cores working in parallel for $80 per core-year.
If you're satisfied with it costing more to crack your password than it would cost for the attacker to just get his own Internet service, a medium-strong password is fine.
Socialism: a lie told by totalitarians and believed by fools.
Exactly! The GP mentioned 10,000 cores like it was a big deal so I assumed that he meant CPU cores.
The smallest Amazon P2 instance has 2500 GPU cores, the biggest has 40,000 GPU cores.
Re-read the GP post and try to fit the price he mentioned with GPU cores offered by Amazon.
https://aws.amazon.com/ec2/ins... .9$/2500*24*365 = 3.15360
3.15$ by GPU core a year, not 80$ per core a year! So IMHO he meant CPU cores.
Feel free to review my numbers, I did this quickly.
Cheers,
Everything I write is lies, read between the lines.
...and you never have to worry about password or any of this BS. My open wifi in a densely populated neighborhood has been running for 6 1/2 years getting around 30 unique visitors/day, 200 unique visitors/month. Why are people so stingy with their wifi? Most everything is encrypted end to end nowadays.
That used to be my password (or something very similar). It was a pain because I couldn't tell the 0 and O characters apart, and had to try a few dozen times to get it right each time.
Have you read my blog lately?