7 ms·
>Once the warship locates a Wi-Fi network from the mail room or the recipient’s desk, it listens for wireless data packets it can use to break into the network.
by jason0597 7y ago
>Once the warship locates a Wi-Fi network from the mail room or the recipient’s desk, it listens for wireless data packets it can use to break into the network. The warship listens for a handshake — the process of authorizing a user to log onto the Wi-Fi network — then sends that scrambled data over the cellular network back to the attacker’s servers, which has far more processing power to crack the hash into a readable Wi-Fi password.
Breaking a hash to obtain the Wi-Fi password? Surely this is impossible?
- TheLastPass 7y agoIf it's not a strong hash and the protocol doesn't include salting, it's not impossible. Rainbow tables exist. And they really only need to find a collision. Wi-Fi protocols, especially WEP, have had vulnerabilities similar to this before. Similar in the sense that if you sniffed enough traffic you could figure out the password (don't recall the specific mechanisms - but this could be one).
- est31 7y agoIt's unfair to say that there is no salting. The PMK is derived from the WiFi network name (SSID) as well as the password [1]. The SSID acts as a salt here. Not perfect as SSIDs are often not unique, but it's certainly better than no salting at all. [1]: https://www.ins1gn1a.com/understanding-wpa-psk-cracking/ https://www.ins1gn1a.com/understanding-wpa-psk-cracking/
- Scoundreller 7y agoSo stupid they don’t use the MAC as the salt.
- TheLastPass 7y agoI said "IF" there's no salting. In any case, I'd be less concerned about SSID's not being unique as I am about the fact that the SSID of a specific target is trivial to obtain and almost never changed.
- est31 7y ago> I'd be less concerned about SSID's not being unique as I am about the fact that the SSID of a specific target is trivial to obtain and almost never changed. Salts don't need to be secret, only unique. In fact, in this case the unauthenticated client needs to be able to compute the PMK from the password alone, so you can't keep it on the AP.
- austinheap 7y agoThis is why we have rainbow tables.
- deleted 7y ago[deleted]
- scarejunba 7y agoUse Aircrack-ng. Doesn't require skill. The broken part is the handshake.
- Fabricio20 7y agoNot really, this is a known "vulnerability" with WPA2 and has been demonstrated to work a lot of times. https://www.aircrack-ng.org/doku.php?id=cracking_wpa#step_4_-_run_aircrack-ng_to_crack_the_pre-shared_key https://www.aircrack-ng.org/doku.php?id=cracking_wpa#step_4_... This is done completely offline once you have the handshake captured and can be easily scaled.
- austinheap 7y agoWhen I’ve been hired to do red teams we always use giant antennas and find a nice parking lot a few blocks away to capture the necessary handshakes. This works great even in downtown SF where the RF interference is absurd.
- munk-a 7y agoYea, this ^. This attack approach is interesting but any company that's serious about security needs to realize that anything opened up on wifi is a big hole - this used to be more amusingly exploited by war-driving, just driving around a neighborhood looking for someone with an open network that spills out into the street so you could download the latest episode of friends. I don't work in this sort of security and it seems terrifying, the social engineering side is especially crazy.
- zeta0134 7y agoI used to do this as a kid in rural Texas, when we could only afford dial-up at the house and my parents didn't let me on the network very often. Good times! I'm terrified of the prospect now, but back then I really appreciated all my neighbors who ran unsecured wireless networks named "linksys"
- austinheap 7y agoThe social engineering side is 100x the threat. Handshake brute forcing is a show pony trick.
- gowld 7y ago
- jki275 7y agoThere are numerous attacks to crack wifi hashes. In theory, a properly implemented hash should not be crackable -- but theory often does not match the real world.
- Retr0spectrum 7y agoNo, any hash will be crackable, it just depends on how fast. A well designed authentication protocol shouldn't expose any hashes to be cracked in the first place.
- jki275 7y agoSure -- if you define the heat death of the universe as "how fast".
- Retr0spectrum 7y agoYou can't guarantee that, and keep reasonable performance, if humans are generating the PSK
- jki275 7y agoI agree, but you can certainly build a system where humans don't generate the key.
- Retr0spectrum 7y agoThen how do humans share said key? QR codes and NFC tags etc. are nice, but not supported everywhere.
- deleted 7y ago[deleted]
- justsomeguy1 7y agoMy friend did this with his neighbor's wifi (with their permission of course) just to see if he could. He got trial access to some super computers in the Google cloud (sorry I'm not more specific, just recollecting what he told me) and was able to crack with that horsepower in a day or so.
- dijit 7y agoYour friend probably used the GPU enabled instances, which are absurdly efficient at generating WPA2 hashes.
- eswat 7y agoIf the password is a predictable, low-length alphanumeric password it’s not going to take long for something like a multi-GPU machine with some dictionaries to break it.
- edoo 7y agoWell for wpa2 the minimum is 8 characters and that is 2.6 days on the largest AWS instance at a peak cost of around $1560 if you got a PMK packet and about 50x longer if you don't.
- mevile 7y agoMaybe with a separate cellular antenna the device could capture all of the wifi data, communicate it to a server with more processing power and possibly break it there and communicate it back to the device.
- eswat 7y agoThat’s actually what the device in the article does. > The device, which cost about $100 to build, was equipped with a 3G-enabled modem, allowing it to be remote-controlled so long as it had cell service. > The warship listens for a handshake — the process of authorizing a user to log onto the Wi-Fi network — then sends that scrambled data over the cellular network back to the attacker’s servers, which has far more processing power to crack the hash into a readable Wi-Fi password. It’s not uncommon for red teams to do something similar: pull a bunch of ciphertext and hashes from the target network, ship them off to their GPU farm at the office, wait for results.