4 ms·

Is that with a dictionary password and a "top 1000" ssid as a salt, using CoWPAtty rainbow tables? Or a full brute-force of the pre-AES WPA?

by khafra 18y ago

ErrantX 18y ago
In terms of coWPAtty: we are work on high level corporate networks that are usually immune to that kind of attack. We use full on brute force rainbow tables with some custom ideas / programs (obv can't share much of that). In it's simplest form we have 8 file servers, 1000 nodes and 2 head servers. 150+TB's of rainbow tables. Basically we combine the shortcut of rainbow tables with intelligent analysis of the packets and the brute force of the cluster. For WPA we use some of our own techniques to intelligently make use of the data that gets sent back. Usually we can start to work on the data after 1 day of collection and it can be possibly 2 more days before it is cracked (depending on the other work running on the cluster) Currently we have 2 specialists employed who are working with me to find ways to break the time down further (with great success) and I am also currently testing and cycling up another 9,000 nodes to add into the cluster. By early next year we hope to be able to turn up at a location and crack WPA networks in a days work :) In terms of economy it is not great (working on that) as your looking at about £5-8,000 outlay just to break in - but for speed I believe it is unmatched. Bear in mind ofc this is not representative of what a hacker could do. The rainbow tables (for all our decryption not just WPA) have taken 8yrs to make so far (on around 5000 nodes) and we still have about 2yrs more work to do on them. What this article talks about is a shortcut technique but ultimately I dont beleive it will lead to an inherent weakness which can bypass the need for our type of attack. But what it will be useful for is forcing the network to generate traffic :) Hopefully sometime next year we should be read to deploy our full AES attack - but that (based on current testing) is going to require a LOT of nodes (possibly pushing 25,0000).

Is that with a dictionary password and a "top 1000" ssid as a salt, using CoWPAtty rainbow tables? Or a full brute-force of the pre-AES WPA?

by khafra 18y ago

Is that with a dictionary password and a "top 1000" ssid as a salt, using CoWPAtty rainbow tables? Or a full brute-force of the pre-AES WPA?

ErrantX 18y ago

In terms of coWPAtty: we are work on high level corporate networks that are usually immune to that kind of attack. We use full on brute force rainbow tables with some custom ideas / programs (obv can't share much of that). In it's simplest form we have 8 file servers, 1000 nodes and 2 head servers. 150+TB's of rainbow tables. Basically we combine the shortcut of rainbow tables with intelligent analysis of the packets and the brute force of the cluster. For WPA we use some of our own techniques to intelligently make use of the data that gets sent back. Usually we can start to work on the data after 1 day of collection and it can be possibly 2 more days before it is cracked (depending on the other work running on the cluster) Currently we have 2 specialists employed who are working with me to find ways to break the time down further (with great success) and I am also currently testing and cycling up another 9,000 nodes to add into the cluster. By early next year we hope to be able to turn up at a location and crack WPA networks in a days work :) In terms of economy it is not great (working on that) as your looking at about £5-8,000 outlay just to break in - but for speed I believe it is unmatched. Bear in mind ofc this is not representative of what a hacker could do. The rainbow tables (for all our decryption not just WPA) have taken 8yrs to make so far (on around 5000 nodes) and we still have about 2yrs more work to do on them. What this article talks about is a shortcut technique but ultimately I dont beleive it will lead to an inherent weakness which can bypass the need for our type of attack. But what it will be useful for is forcing the network to generate traffic :) Hopefully sometime next year we should be read to deploy our full AES attack - but that (based on current testing) is going to require a LOT of nodes (possibly pushing 25,0000).