4 ms·

nobody is going to spend the atrociously high cost of cloud gpus to crack someones home wifi password in an un-targeted attack. your home wifi threat actor is y

nobody is going to spend the atrociously high cost of cloud gpus to crack someones home wifi password in an un-targeted attack. your home wifi threat actor is your neighbors kid playing with aircrack. in a corporate environment, use wpa2-enterprise, then password entropy doesnt matter quite as much.

stefan_ 8y ago
I thought enterprise was even more fucked thanks to the horror that is MSCHAPv2 and that no one bothers to setup the PKI stuff to authenticate the APs.
- dfox 8y ago
  In WPA-EAP the AP is not active part of the authentication flow (it only forwards the frames) and as such does not directly authenticate itself to the client (it happens indirectly by the fact that it can forward the frames). The configuration space of WPA-EAP is huge and most combinations are horribly insecure, but as long as you stick with one of the "tunnel everything through TLS" EAPs (EAP-TTLS or PEAP) the result is safe against passive attackers even when you don't verify server certificates (obviously you should verify the certificates, because the active attack is trivial and does not have to interact with your network).
  - spockz 8y ago
    How would one setup the certificates in a right way? I presume that needs MDM anyways to conveniently distribute the certificates?
    - angry_octet 8y ago
      You can do it without MDM, just distribute via an https webpage. Most universities do this, because it is 90% byod or guest access (you can only be enrolled in one MDM).
      - spockz 8y ago
        So guests coming to your home would need to first download certificates in order to be able to trust your network. But they would then need to trust that certificate not to be used to MITM their own EAP servers... This doesn’t sound very user friendly. Am I missing something?
        angry_octet 8y ago
        Certificates, not CAs.
        spockz 8y ago
        Right. Of course.
  - tialaramex 8y ago
    This is the model for "Eduroam" (Academics and students at various educational institutions, particularly in Europe but these days around the world have a single network). Each device is configured with certs for their home institution, their username lets any member figure out where that home institution is, and so their password or other authentication flows only to an IdP for that institution, which under the Eduroam agreement is trusted to authenticate them at all other member institutions. So you set up "eduroam" once on your phone, and then it works the same in a lecture theatre at Stanford, or in Nantes (France). So that's nice, and as dfox observes the AP isn't much involved, so the inevitable frailty of individual WiFi setups in less sophisticated institutions isn't a huge flaw in Eduroam or a grave risk for your home institution.
buth_lika 8y ago
> your home wifi threat actor is your neighbors kid playing with aircrack. When working for an ISP it came up quite a few times that customers had extensive questions about security because they were genuinely worried about their ex-spouse spying on them. Even if they were all just "paranoid" in their specific cases (I wouldn't know), I think it's a fair concern. If all it takes is some googling and a bit of money to rent cloud GPU's, well, scorned lovers have done way more expensive and less effective things to cause damage or violate privacy.
Tharkun 8y ago
I've tried setting up WPA2 Enterprise but have been unable to set it up in a way that works with all client hard/software in the enterprise. Windows was especially horrible. Most Linux distros and OSX seemed to kind of Just Work for the most part. If anyone knows of a WPA2 Enterprise setup guide that works well with minimal hassle (no CA/certificate installation hell, Linux+BSD+OSX+Windows as old as 8), I'd be eternally grateful.
dogma1138 8y ago
With home security systems being hooked up to WiFi these days and a cost of cracking a WPA password being less than $100 a casual targeted attack isn’t that unlikely.
shpx 8y ago
I'm not disagreeing with you but you might be interested to know that there's a distributed WiFi password cracking project. You can upload packet captures and other people will extract the handshake(s) and volunteer GPUs to crack them. The passwords aren't made available but you can see if someone managed to crack the password. https://wpa-sec.stanev.org/ https://wpa-sec.stanev.org/
knorker 8y ago
I know at least a couple of hackers who cracked other people's wifi, and used a yagi to not just crack their their closest neighbour but someone a bit further away (for safety). Last time I ran the numbers an ISP default pattern password for ISPs around where I live (assuming perfect randomness within the ISP's pattern) was like $70 on Google Cloud GPUs (with half that on average). And if your wifi has a default pattern SSID, then it probably has a default pattern password. $70 is not atrociously high cost for a "last mile" security hop. And if you have a botnet already then it's free. These are people who would crack your wifi for the lulz (and have the stolen capacity to do it), get your house raided because they hack companies from behind your Internet connection... ... and then are stupid enough to when they hack and get access to a sensitive government database run a search for their own fucking name... and members of their family.

stefan_ 8y ago

I thought enterprise was even more fucked thanks to the horror that is MSCHAPv2 and that no one bothers to setup the PKI stuff to authenticate the APs.

dfox 8y ago
In WPA-EAP the AP is not active part of the authentication flow (it only forwards the frames) and as such does not directly authenticate itself to the client (it happens indirectly by the fact that it can forward the frames). The configuration space of WPA-EAP is huge and most combinations are horribly insecure, but as long as you stick with one of the "tunnel everything through TLS" EAPs (EAP-TTLS or PEAP) the result is safe against passive attackers even when you don't verify server certificates (obviously you should verify the certificates, because the active attack is trivial and does not have to interact with your network).
- spockz 8y ago
  How would one setup the certificates in a right way? I presume that needs MDM anyways to conveniently distribute the certificates?
  - angry_octet 8y ago
    You can do it without MDM, just distribute via an https webpage. Most universities do this, because it is 90% byod or guest access (you can only be enrolled in one MDM).
    - spockz 8y ago
      So guests coming to your home would need to first download certificates in order to be able to trust your network. But they would then need to trust that certificate not to be used to MITM their own EAP servers... This doesn’t sound very user friendly. Am I missing something?
      - angry_octet 8y ago
        Certificates, not CAs.
        spockz 8y ago
        Right. Of course.
- tialaramex 8y ago
  This is the model for "Eduroam" (Academics and students at various educational institutions, particularly in Europe but these days around the world have a single network). Each device is configured with certs for their home institution, their username lets any member figure out where that home institution is, and so their password or other authentication flows only to an IdP for that institution, which under the Eduroam agreement is trusted to authenticate them at all other member institutions. So you set up "eduroam" once on your phone, and then it works the same in a lecture theatre at Stanford, or in Nantes (France). So that's nice, and as dfox observes the AP isn't much involved, so the inevitable frailty of individual WiFi setups in less sophisticated institutions isn't a huge flaw in Eduroam or a grave risk for your home institution.

buth_lika 8y ago

> your home wifi threat actor is your neighbors kid playing with aircrack. When working for an ISP it came up quite a few times that customers had extensive questions about security because they were genuinely worried about their ex-spouse spying on them. Even if they were all just "paranoid" in their specific cases (I wouldn't know), I think it's a fair concern. If all it takes is some googling and a bit of money to rent cloud GPU's, well, scorned lovers have done way more expensive and less effective things to cause damage or violate privacy.

Tharkun 8y ago

I've tried setting up WPA2 Enterprise but have been unable to set it up in a way that works with all client hard/software in the enterprise. Windows was especially horrible. Most Linux distros and OSX seemed to kind of Just Work for the most part. If anyone knows of a WPA2 Enterprise setup guide that works well with minimal hassle (no CA/certificate installation hell, Linux+BSD+OSX+Windows as old as 8), I'd be eternally grateful.

dogma1138 8y ago

With home security systems being hooked up to WiFi these days and a cost of cracking a WPA password being less than $100 a casual targeted attack isn’t that unlikely.

shpx 8y ago

I'm not disagreeing with you but you might be interested to know that there's a distributed WiFi password cracking project. You can upload packet captures and other people will extract the handshake(s) and volunteer GPUs to crack them. The passwords aren't made available but you can see if someone managed to crack the password. https://wpa-sec.stanev.org/ https://wpa-sec.stanev.org/

knorker 8y ago

I know at least a couple of hackers who cracked other people's wifi, and used a yagi to not just crack their their closest neighbour but someone a bit further away (for safety). Last time I ran the numbers an ISP default pattern password for ISPs around where I live (assuming perfect randomness within the ISP's pattern) was like $70 on Google Cloud GPUs (with half that on average). And if your wifi has a default pattern SSID, then it probably has a default pattern password. $70 is not atrociously high cost for a "last mile" security hop. And if you have a botnet already then it's free. These are people who would crack your wifi for the lulz (and have the stolen capacity to do it), get your house raided because they hack companies from behind your Internet connection... ... and then are stupid enough to when they hack and get access to a sensitive government database run a search for their own fucking name... and members of their family.