4 ms·

Rainbow tables can still make sense for a salted hash if the salt can be predicted. A current real-world example I just recently learned about: SSIDs (network

Rainbow tables can still make sense for a salted hash if the salt can be predicted. A current real-world example I just recently learned about: SSIDs (network names) are used to salt WPA-based WiFi network password hashes. If the SSID is a default name (examples: NETGEAR, LINKSYS, XFINITY, etc.), then you could use a rainbow table.

tialaramex 6y ago
The salt is defined to be random. To the extent you shove something that isn't random in as "salt" you don't get the desired consequences. And I think ISP hand out WiFi routers stopped having daft names like this a decade or more ago. The only AP SSIDs that aren't partly random nonsense I see around here are my own (named "Reformed Distributed Republic") and somebody's FON router, the main ones I've seen elsewhere in my city are "eduroam" and "govroam" which are federated systems and so do not have a PSK - in all four cases you aren't going to help yourself by calculating rainbow tables with those SSIDs.
- Wingman4l7 6y ago
  I've definitely still seen several in-use private WiFi networks using "NETGEAR" (although they usually have 2 numbers appended to the end, so that expands the keyspace by 10^2 = 100 different rainbow tables to crack those hashes). It looks like this generic, repeated-SSID-naming "vulnerability" might continue into the present day via the use of a default name on hotspot devices, or smartphones serving as hotspots -- notice that on the "top 25 pwned wifi network names in the @pwnagotchi project database"[1], the top 1st and 2nd place respectively go to "AndroidAP" and "iPhone". Looking at my Pixel 3, I notice that the default hotspot name doesn't appear to be randomized (it's "PixNet"). [1]: https://twitter.com/evilsocket/status/1305892201222807552 https://twitter.com/evilsocket/status/1305892201222807552

4 ms·

Rainbow tables can still make sense for a salted hash if the salt can be predicted. A current real-world example I just recently learned about: SSIDs (network

by Wingman4l7 6y ago

tialaramex 6y ago
The salt is defined to be random. To the extent you shove something that isn't random in as "salt" you don't get the desired consequences. And I think ISP hand out WiFi routers stopped having daft names like this a decade or more ago. The only AP SSIDs that aren't partly random nonsense I see around here are my own (named "Reformed Distributed Republic") and somebody's FON router, the main ones I've seen elsewhere in my city are "eduroam" and "govroam" which are federated systems and so do not have a PSK - in all four cases you aren't going to help yourself by calculating rainbow tables with those SSIDs.
- Wingman4l7 6y ago
  I've definitely still seen several in-use private WiFi networks using "NETGEAR" (although they usually have 2 numbers appended to the end, so that expands the keyspace by 10^2 = 100 different rainbow tables to crack those hashes). It looks like this generic, repeated-SSID-naming "vulnerability" might continue into the present day via the use of a default name on hotspot devices, or smartphones serving as hotspots -- notice that on the "top 25 pwned wifi network names in the @pwnagotchi project database"[1], the top 1st and 2nd place respectively go to "AndroidAP" and "iPhone". Looking at my Pixel 3, I notice that the default hotspot name doesn't appear to be randomized (it's "PixNet"). [1]: https://twitter.com/evilsocket/status/1305892201222807552 https://twitter.com/evilsocket/status/1305892201222807552