8 ms·

Weaponizing and Gamifying AI for WiFi Hacking: Presenting Pwnagotchi 1.0.0

336 points by dyslexit 7y ago

elif 7y ago
I get that this things purpose is for fun and not so much cracking a lot of networks, but I can't help but wonder how useful it would be to collate the ssid/gps/key data for public consumption. Even reward pwnagotchis for sumbmission
- latchkey 7y ago
  Wifi Chua is a human version of that. It is a public database of wifi passwords that even integrates with iOS such that it will log you directly into the network.
  - aphroz 7y ago
    It works very well in Vietnam, I didn't know it could work internationally.
sdan 7y ago
So it finds Wifi passwords? Sorry I didn't get what exactly what this project is getting to. A TLDR about what exactly it does would a bit helpful.
- mkagenius 7y ago
  Yes it can find passwords. First it kicks someone off the network by pretending to be the router, then when the person tries to reconnect it sees the handshake information and password.
  - the_pwner224 7y ago
    So WiFi authentication is trivially crackable? What should I do to protect my network?
    - russdill 7y ago
      It depends on your password: https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2
      - bilbo0s 7y ago
        Isn't that link telling people how to crack a password? What can we glean about how to secure a password?
        Avamander 7y ago
        WPA2 cracking is usually done with rainbow tables generated based on some dictionary and its mutations, basically don't have a dictionary password and you should be secure from /most/ attackers.
        edoo 7y ago
        Your passsword should be made up of dictionary words though. If you do the math an 8 word sentence from the 10k most common words (just lowercase) is equivalent to a 16 character password from a full set of 100 characters and far easier to remember. Use some exotic words and punctuation and have a few random special characters in there and it is far far superior. WPA2 has a minimum of 8 characters and would take the same time to check every character as it would to check all combos of 4 lowercase words from the 10k most common set.
        Avamander 7y ago
        WiFi passwords aren't typed in frequently and can trivially be written down on the home router itself, CorrectHorseBatteryStaple has lower entropy than a random one of a bit smaller length.
        hombre_fatal 7y ago
        Wifi passwords are typed all the time if you have any friends that come over. And typing randomly generated special characters on a mobile device is especially awful.
  - h4waii 7y ago
    It does NOT see plaintext password [0]. A sufficiently high entropy password will keep you secure against this attack. 0. https://security.stackexchange.com/questions/66008/how-exactly-does-4-way-handshake-cracking-work https://security.stackexchange.com/questions/66008/how-exact...
stefan_ 7y ago
Actively sending deauths is harmful and malicious interference, and given the intent, probably a felony. There is no circumstance for operating this device in public. I've flagged this post. This is the kind of irresponsible unethical behavior that causes all sorts of interesting radio hardware to be bonded to signed vendor blobs.
- that_lurker 7y ago
  There is an option to turn off the deauthing. But I don't believe it is off by default
  - bbwolfie 7y ago
    Maybe that is the point. Perhaps a more well thought out strategy for the long term security profile for router updates should, by default from firmware update, be made do deny deauth deny. However, this fact would also be lost on us if we weren't updated with a warning on the router admin page. Which by the way, anyone can get there. That is, if the router admin Page's IP is known. Otherwise, you'll need to pack a lunch. Because it'll be a while if you have to type in each private IP, or if a 11 digit phrase with some capitalized letters & special characters set for the password. You are arguing on the knowledge that the rest of us would like to know about. So, you should take your argument to the FCC, or the entity that owns the page you're at & let the class continue. You know, book burning went out with the digital age? I believe everyone should get their say. Within reason. Would you have struck down any legalization of your own rights? We'll, now you are, to ours. There are venues to continue this & maybe even have your points be heard. Thank you.
- TheCraiggers 7y ago
  From the article: "ESP based deauthers, to name one, always existed. Don’t yell at us “OMG they’re deauthing all over the city!!!”. Despite this stuff always existing, nobody bothered updating to technologies that work better and are more secure. That is the people you should be yelling at." I'm not saying you're wrong, or that they're right. However, it seems to me that there has to be a middle ground between draconian signed blobs (which I'm not convinced will solve much for long, either) and the silliness that is the current state of things. Deauths have been used in so many wifi cracking schemes over the years and the fact we still don't seem to care about them (or treat them as harmful interference and blame the device) is getting silly.
carapace 7y ago
> Each Pwnagotchi is also an end-to-end encrypted messaging device.
55555 7y ago
What does this thing actually achieve? (If nothing, that's fine too. It's cute, impressive, etc.) But if it can't actually get you onto wifi networks, it seems like a weird project to spend so much time on. How often does it snag a useable handshake?
- gdy 7y ago
  So what is it? Fine or weird?
  - TheAceOfHearts 7y ago
    Yes, it is.
cryptofits 7y ago
That's the first time I've seen your website. I didn't read the entire pwnagotchi article yet but it looks great! Keep up the good work, projects like these really motivate me to get into IT
88840-8855 7y ago
My approach to get into wifi networks is not as sexy or cute, but it works: 1) You need a device that can connect to wifi 2) Approach your neighbor/shop owner/coffee owner 3) Ask: "Can I connect to your wifi, please?" 4) It takes about 4-5 seconds to get the password to the ssid 5) Works on WPA2, WPA / TKIP/AES and WEP 6) Success rate: 70-80% Cheers
- bluegreyred 7y ago
  your sophisticated technique assumes social skills!
  - nothis 7y ago
    Ah, social engineering, the most elusive tech skill of all!
  - rinchik 7y ago
    Social engineering is also engineering. Can be very interesting to experiment, reverse-engineer, and develop. I do not believe that devs lack social skills, it’s just an area of engineering that we haven’t touched properly yet. Also when I see NLP, my first thought is Neuro-Linguistic Programming (https://en.m.wikipedia.org/wiki/Neuro-linguistic_programming https://en.m.wikipedia.org/wiki/Neuro-linguistic_programming) , not Natural Language Processing.
- TeMPOraL 7y ago
  During my university years, back when having a mobile Internet (or even a functioning smartphone) was somewhat uncommon, I've managed to set up quite a collection of such Wi-Fi access points :). I'd casually ask people I spent time with for Wi-Fi access when opportunity arised (I didn't have to invent a reason, there eventually always was a good one). Student life being what it is, I was often out and about at weird hours - so it sometimes happened that on the way from one place to another, I would detour to park my bike in front of some colleague's block of flats, and use their Wi-Fi to sync my e-mails and conversations.
- dmos62 7y ago
  Social engineering, huh? Reminds me of the xkcd cartoon with a $5 wrench https://xkcd.com/538/ https://xkcd.com/538/
rhn_mk1 7y ago
The fun part of this to me is all but the WiFi aspect. It has: - a mesh-based social network - a cute character - a builtin game - adjusts to the environment It sounds like an awesome social game, even if it doesn't have any purpose, and turning this into a mesh communication network would even give it an aspect of usefulness. I can see two ways this could blow up: - at big parties, think Burning Man or Chaos Communication Congress, where people get embedded devices (like the CardIO) which encourage meeting others - everyday, to find connections in unlikely places, with a similar app running on your phone (the Librem5 would be a good starting point)
djmips 7y ago
This is more like Pokepwn Go
yobananaboy 7y ago
I've had one of these running since the first week evilsocket put the source out. With $50 in parts from Amazon I was up and running with a battery powered unit within a few hours, that I ended up taking with me on vacation. The new build process is extremely simple though, and I'm excited to see where this project goes.

336 points by dyslexit 7y ago

elif 7y ago

I get that this things purpose is for fun and not so much cracking a lot of networks, but I can't help but wonder how useful it would be to collate the ssid/gps/key data for public consumption. Even reward pwnagotchis for sumbmission

latchkey 7y ago
Wifi Chua is a human version of that. It is a public database of wifi passwords that even integrates with iOS such that it will log you directly into the network.
- aphroz 7y ago
  It works very well in Vietnam, I didn't know it could work internationally.

sdan 7y ago

So it finds Wifi passwords? Sorry I didn't get what exactly what this project is getting to. A TLDR about what exactly it does would a bit helpful.

mkagenius 7y ago
Yes it can find passwords. First it kicks someone off the network by pretending to be the router, then when the person tries to reconnect it sees the handshake information and password.
- the_pwner224 7y ago
  So WiFi authentication is trivially crackable? What should I do to protect my network?
  - russdill 7y ago
    It depends on your password: https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2
    - bilbo0s 7y ago
      Isn't that link telling people how to crack a password? What can we glean about how to secure a password?
      - Avamander 7y ago
        WPA2 cracking is usually done with rainbow tables generated based on some dictionary and its mutations, basically don't have a dictionary password and you should be secure from /most/ attackers.
        edoo 7y ago
        Your passsword should be made up of dictionary words though. If you do the math an 8 word sentence from the 10k most common words (just lowercase) is equivalent to a 16 character password from a full set of 100 characters and far easier to remember. Use some exotic words and punctuation and have a few random special characters in there and it is far far superior. WPA2 has a minimum of 8 characters and would take the same time to check every character as it would to check all combos of 4 lowercase words from the 10k most common set.
        Avamander 7y ago
        WiFi passwords aren't typed in frequently and can trivially be written down on the home router itself, CorrectHorseBatteryStaple has lower entropy than a random one of a bit smaller length.
        hombre_fatal 7y ago
        Wifi passwords are typed all the time if you have any friends that come over. And typing randomly generated special characters on a mobile device is especially awful.
- h4waii 7y ago
  It does NOT see plaintext password [0]. A sufficiently high entropy password will keep you secure against this attack. 0. https://security.stackexchange.com/questions/66008/how-exactly-does-4-way-handshake-cracking-work https://security.stackexchange.com/questions/66008/how-exact...

stefan_ 7y ago

Actively sending deauths is harmful and malicious interference, and given the intent, probably a felony. There is no circumstance for operating this device in public. I've flagged this post. This is the kind of irresponsible unethical behavior that causes all sorts of interesting radio hardware to be bonded to signed vendor blobs.

that_lurker 7y ago
There is an option to turn off the deauthing. But I don't believe it is off by default
- bbwolfie 7y ago
  Maybe that is the point. Perhaps a more well thought out strategy for the long term security profile for router updates should, by default from firmware update, be made do deny deauth deny. However, this fact would also be lost on us if we weren't updated with a warning on the router admin page. Which by the way, anyone can get there. That is, if the router admin Page's IP is known. Otherwise, you'll need to pack a lunch. Because it'll be a while if you have to type in each private IP, or if a 11 digit phrase with some capitalized letters & special characters set for the password. You are arguing on the knowledge that the rest of us would like to know about. So, you should take your argument to the FCC, or the entity that owns the page you're at & let the class continue. You know, book burning went out with the digital age? I believe everyone should get their say. Within reason. Would you have struck down any legalization of your own rights? We'll, now you are, to ours. There are venues to continue this & maybe even have your points be heard. Thank you.
TheCraiggers 7y ago
From the article: "ESP based deauthers, to name one, always existed. Don’t yell at us “OMG they’re deauthing all over the city!!!”. Despite this stuff always existing, nobody bothered updating to technologies that work better and are more secure. That is the people you should be yelling at." I'm not saying you're wrong, or that they're right. However, it seems to me that there has to be a middle ground between draconian signed blobs (which I'm not convinced will solve much for long, either) and the silliness that is the current state of things. Deauths have been used in so many wifi cracking schemes over the years and the fact we still don't seem to care about them (or treat them as harmful interference and blame the device) is getting silly.

carapace 7y ago

> Each Pwnagotchi is also an end-to-end encrypted messaging device.

55555 7y ago

What does this thing actually achieve? (If nothing, that's fine too. It's cute, impressive, etc.) But if it can't actually get you onto wifi networks, it seems like a weird project to spend so much time on. How often does it snag a useable handshake?

gdy 7y ago
So what is it? Fine or weird?
- TheAceOfHearts 7y ago
  Yes, it is.

cryptofits 7y ago

That's the first time I've seen your website. I didn't read the entire pwnagotchi article yet but it looks great! Keep up the good work, projects like these really motivate me to get into IT

88840-8855 7y ago

My approach to get into wifi networks is not as sexy or cute, but it works: 1) You need a device that can connect to wifi 2) Approach your neighbor/shop owner/coffee owner 3) Ask: "Can I connect to your wifi, please?" 4) It takes about 4-5 seconds to get the password to the ssid 5) Works on WPA2, WPA / TKIP/AES and WEP 6) Success rate: 70-80% Cheers

bluegreyred 7y ago
your sophisticated technique assumes social skills!
- nothis 7y ago
  Ah, social engineering, the most elusive tech skill of all!
- rinchik 7y ago
  Social engineering is also engineering. Can be very interesting to experiment, reverse-engineer, and develop. I do not believe that devs lack social skills, it’s just an area of engineering that we haven’t touched properly yet. Also when I see NLP, my first thought is Neuro-Linguistic Programming (https://en.m.wikipedia.org/wiki/Neuro-linguistic_programming https://en.m.wikipedia.org/wiki/Neuro-linguistic_programming) , not Natural Language Processing.
TeMPOraL 7y ago
During my university years, back when having a mobile Internet (or even a functioning smartphone) was somewhat uncommon, I've managed to set up quite a collection of such Wi-Fi access points :). I'd casually ask people I spent time with for Wi-Fi access when opportunity arised (I didn't have to invent a reason, there eventually always was a good one). Student life being what it is, I was often out and about at weird hours - so it sometimes happened that on the way from one place to another, I would detour to park my bike in front of some colleague's block of flats, and use their Wi-Fi to sync my e-mails and conversations.
dmos62 7y ago
Social engineering, huh? Reminds me of the xkcd cartoon with a $5 wrench https://xkcd.com/538/ https://xkcd.com/538/

rhn_mk1 7y ago

The fun part of this to me is all but the WiFi aspect. It has: - a mesh-based social network - a cute character - a builtin game - adjusts to the environment It sounds like an awesome social game, even if it doesn't have any purpose, and turning this into a mesh communication network would even give it an aspect of usefulness. I can see two ways this could blow up: - at big parties, think Burning Man or Chaos Communication Congress, where people get embedded devices (like the CardIO) which encourage meeting others - everyday, to find connections in unlikely places, with a similar app running on your phone (the Librem5 would be a good starting point)

djmips 7y ago

This is more like Pokepwn Go

yobananaboy 7y ago

I've had one of these running since the first week evilsocket put the source out. With $50 in parts from Amazon I was up and running with a battery powered unit within a few hours, that I ended up taking with me on vacation. The new build process is extremely simple though, and I'm excited to see where this project goes.