3 ms·

Not really, this is a known "vulnerability" with WPA2 and has been demonstrated to work a lot of times. https://www.aircrack-ng.org/doku.php?id=cracking_wpa#st

Not really, this is a known "vulnerability" with WPA2 and has been demonstrated to work a lot of times. https://www.aircrack-ng.org/doku.php?id=cracking_wpa#step_4_-_run_aircrack-ng_to_crack_the_pre-shared_key https://www.aircrack-ng.org/doku.php?id=cracking_wpa#step_4_... This is done completely offline once you have the handshake captured and can be easily scaled.

austinheap 7y ago
When I’ve been hired to do red teams we always use giant antennas and find a nice parking lot a few blocks away to capture the necessary handshakes. This works great even in downtown SF where the RF interference is absurd.
- munk-a 7y ago
  Yea, this ^. This attack approach is interesting but any company that's serious about security needs to realize that anything opened up on wifi is a big hole - this used to be more amusingly exploited by war-driving, just driving around a neighborhood looking for someone with an open network that spills out into the street so you could download the latest episode of friends. I don't work in this sort of security and it seems terrifying, the social engineering side is especially crazy.
  - zeta0134 7y ago
    I used to do this as a kid in rural Texas, when we could only afford dial-up at the house and my parents didn't let me on the network very often. Good times! I'm terrified of the prospect now, but back then I really appreciated all my neighbors who ran unsecured wireless networks named "linksys"
  - austinheap 7y ago
    The social engineering side is 100x the threat. Handshake brute forcing is a show pony trick.
gowld 7y ago
Hacking obsolete protocols is shooting fish in a barrel. Classy hackers hack modern protocols like WPA 3. https://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#Dragonblood_attack https://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#Dragonb...
- 867-5309 7y ago
  which nobody uses yet. last time I checked around a month ago there was only one WPA3 on WiGLE. there are next to nil WPA3 fish in the barrel yet.

austinheap 7y ago

When I’ve been hired to do red teams we always use giant antennas and find a nice parking lot a few blocks away to capture the necessary handshakes. This works great even in downtown SF where the RF interference is absurd.

munk-a 7y ago
Yea, this ^. This attack approach is interesting but any company that's serious about security needs to realize that anything opened up on wifi is a big hole - this used to be more amusingly exploited by war-driving, just driving around a neighborhood looking for someone with an open network that spills out into the street so you could download the latest episode of friends. I don't work in this sort of security and it seems terrifying, the social engineering side is especially crazy.
- zeta0134 7y ago
  I used to do this as a kid in rural Texas, when we could only afford dial-up at the house and my parents didn't let me on the network very often. Good times! I'm terrified of the prospect now, but back then I really appreciated all my neighbors who ran unsecured wireless networks named "linksys"
- austinheap 7y ago
  The social engineering side is 100x the threat. Handshake brute forcing is a show pony trick.

gowld 7y ago

Hacking obsolete protocols is shooting fish in a barrel. Classy hackers hack modern protocols like WPA 3. https://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#Dragonblood_attack https://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#Dragonb...

867-5309 7y ago
which nobody uses yet. last time I checked around a month ago there was only one WPA3 on WiGLE. there are next to nil WPA3 fish in the barrel yet.