Just so nobody freaks out, this is cracking weak passwords, not broken WPA.
I have myself cracked countless WiFi passwords when security testing. It's easy if the passwords are bad, which is maybe 90% of the time for home networks and 60% for businesses. The attack is completely passive if you don't want to be noticed, and with a cheap dish you can pickup both ends of the handshakes from up to around a quarter mile away (line of sight).
I beg to differ. The fact that WPA is subject to a passive attack at all is a defect. It should use a PAKE, which would entirely avoid this type of attack.
There are simple balanced PAKE protocols that would do the trick. DH-EKE, SPAKE2, J-PAKE, and even the venerable SRP would all work. I believe that several are old enough that no patents are possible, and, even when WPA was standardized, something should have been available.
Here's crazy idea: Why not run open network + IPSEC, or heck, even OpenVPN? Obviously, drop all non-VPN traffic right on the AP (or first router after it) to nip freeloaders in the bud.
I guess you might be able to just fail to reply to DNS requests for domains outside you captive portal, I have no idea if anyone has tried that or there might be other complications.
Edit: Actually not replying wouldn't work great either because then the user can't be redirected to the captive portal. This might be less of an issue today since most devices have standardized a way to detect captive portals using a small set of hostnames.
Step 1) For mobile device to make a request to a special URL that is known to respond with short 200/204, something like that:
Step 2) Mobile device reuse same cookies for the same portal second time around, so portal can recognize returning user and let them in without annoying with login prompt each time.
Assuming mobile device has a separate cookie jar for this, and captive portal is HTTPS with proper certificate, and doesn't try to break other people's SSL, that is pretty secure. Sure, this is not the most efficient protocol, but up-side is - it's open-ended. You can fit here anything from "press here if you agree to behave" to complete walled garden like hotspot on a train that shows you interactive map, schedule and transport connections available on the next stop along with small banner asking $1 for full internet access.
For IE, you can just refuse connections to the internal webserver for logged in users, as IE will then mark those IPs as bad and refresh the DNS: https://blogs.msdn.microsoft.com/ieinternals/2012/09/26/brai...
That being said - that's a bit over the top. The only reason I wouldn't want my AP to be open and unfiltered is - I don't want any junk being sent out which is attributable to me (by IP), and which I have no control over. Iodine, being a tunnel will only transport to "guest"'s server and go into the wider Internet with their server's IP.
If somebody is in enough of a squezze to jump over that sort of hoops, and there're no costs/risks for me - let them have it. I'm fine with that.
This major issue with WPA password cracking today is that it can be done "offline". You can pull the handshake out of the air and bang on it as long as you want. It's pretty much the same thing as trying to guess a password from some leaked hashes vs trying to guess a password using the gmail interface.
EDIT: After reading up on SPAKE2, it's basically just a Diffe-Hellman exchange. You can still totally do a brute force because you know what the first encrypted payload should look like and you can listen in for that encrypted message and use that as your "test that you got it right"
I think that at the end of the day, no matter what key stretching techniques you use. A bad starting key results in a bad end key.
You are right that the AP couldn't block you without blocking everyone, but since you need to check your answer with the AP for each guess your attack becomes extremely visible. I guess you could still DDOS the AP by sending auth requests faster than it allows but that doesn't hurt the channel any more than barrage jamming which is un-blockable.
Basically, your keys are used to handshake with the access point, and then exchange a new set of temporary keys for the duration of your connection. These temporary keys (which are exchanged during the handshake, and encrypted by something which involves your original keys) are then used to encrypt user data.
Because the data are encrypted with new keys for each connection, and those keys aren't based on the original keys in any way, knowing the plain text version of the data you're trying to decrypt doesn't help. You might be able to recover the temporary key, but you can't use this by itself to join the router, and the key is thrown away when that user makes a new connection. (These keys are also usually quite large, random, and very resistant to brute force methods anyway.)
HTTPS works similarly, and it needs to, because many (many!) websites start with the plain text "<html" which would make it trivial to brute force the keys offline otherwise.
With things like Lets Encrypt, having each access point own a short lived certificate becomes possible and you can then bootstrap a secure key exchange.
PS: I have no idea which direction WPA3 is going. They might be doing something without certs but a TOFU trust model instead. Either ways, it is possible to design something better than WPA/WPA2 but don't think it's trivial because the constraints aren't the same as existing secure protocols.
??? Isnt the MAC address an identity for the AP ?
I always had a doubt about HTTPS . Say Im connecting through a proxy server to a website. The exchange of keys for HTTPS connection happens through this proxy server, means it can capture those and decrypt the connection whenever it wants , right ?
Thanks for your reply.
No, just an address. To be an identity, there must be some way for the AP to demonstrate that it is the right owner of that MAC, otherwise any router can simply copy the MAC.
HTTPS sites do this by getting a CA to vouch for them (in the form of a digitally signed certificate). Tor sites do this by having their address being a representation of their public key, and proving they have the corresponding private key.
I always had a doubt about HTTPS . Say Im connecting through a proxy server to a website. The exchange of keys for HTTPS connection happens through this proxy server, means it can capture those and decrypt the connection whenever it wants , right ? Thanks for your reply.
No, thanks to Diffie-Hellman, you can exchange keys with a remote server over a non-secure channel in a way that anyone listening can't figure out the key.
Of course, this happens after the server has proven it is who it says it is, by using one of the methods above. Otherwise, the proxy could pretend to be the server, and exchange keys itself with you.
Asymmetric encryption algorithms are, in general, orders of magnitude slower at encryption than AES. With these protocols the initial secure connection is done using asymmetric cryptography. It makes sense to use the established secure channel to exchange another set of keys and switch over to AES or another symmetric algorithm immediately.
Nowadays the two ends negotiate a key exchange to allow things like perfect forward secrecy as well, so this is becoming a historical footnote to an extent.
Like all PAKE protocols, an eavesdropper or man in the middle cannot obtain enough information to be able to brute force guess a password without further interactions with the parties for each guess.
In layman's terms, given two parties who both know a password, SRP (or any other PAKE protocol) is a way for one party (the "client" or "user") to demonstrate to another party (the "server") that they know the password, without sending the password itself, nor any other information from which the password can be broken. Further, it is not possible to conduct an offline brute force search for the password.
I feel like the initial key exchange should be done with something most resource intensive than elliptic curves.
I need to be in the baseline standard to get qualified or nobody will implement it.
PAKE is used by Thread (IOT protocol built on top of IEEE 802.15.4: https://threadgroup.org/ and it's precisely its use of PAKE that makes it one of the most secure wireless protocols IMHO. Disclosure: I helped security-review it during its design.) Various PAKE schemes exist but a simple one based on Diffie-Hellman works like this (called DH-EKE):
1. Client selects random priv, pub key pair: a, g^a
2. Server selects random priv, pub key pair: b, g^b
3. Client sends its pub key encrypted with client's password: E(g^a, passwd)
4. Server sends its pub key encrypted with client's password: E(g^b, passwd)
5. Client and server each decrypts the packets (with the password that they both know) and get each other's pub keys: g^a, g^b
6. Client and server proceed with standard Diffie-Hellman: they compute g^ab use this value as an encryption key
7. Client and server do a message exchange encrypted with g^ab, to verify they both derived the same key.
Note: I demonstrate the scheme DH-EKE because it's simple. But please know this scheme is flawed when naively implemented. In theory it should be safe when used with an elliptic curve variant using Elligator https://elligator.cr.yp.to/ but I haven't seen much research and peer reviews of Elligator... Other PAKE schemes are considered perfectly secure (but their complexity makes them unsuitable to be explained in an HN comment, eg: J-PAKE.)
What can an "offline" attacker do? He can passively sniff the packets and get E(g^a, passwd) and E(g^b, passwd) but there is no way for him to bruteforce the password. He can try to decrypt the packet with candidate passwords, but he does not know when he guesses the right one, because a successful decryption will reveal g^a or g^b however these value are indistinguishable from random data (when using Elligator because that's exactly what it guarantees: that a pub key is indistinguishable from random data.) And even if he guessed right, he would obtain g^a and g^b, but would not be able to decrypt any further communications as the use of Diffie-Hellman makes it imposible to calculate the encryption key g^ab.
What can an "online" attacker do? If he actively MiTM the connection and pretends to be the legitimate server, he can send his own E(g^b, passwd) to the client using one guessed candidate password. If he guessed wrong, then the client will decrypt to an incorrect g^b, will not calculate the right g^ab, and step 7 will fail. Good. At least the client can detect a (failed) password guess attempt. And that's all the attacker can do. Each authentication attempt gives him only 1 chance to test 1 password. If, out of frustration, the client tries to retype the password and re-auth 3 times, then the attacker can at most try to guess 3 candidate passwords. He can't bruteforce many passwords.
An effort is ongoing to standardize one of the PAKE schemes, called J-PAKE, in TLS: https://www.ietf.org/archive/id/draft-cragie-tls-ecjpake-01.... TLS with J-PAKE is what Thread uses.
The problem with ECDH here is that group elements aren't just numbers.
It's been the case with Comcast + Verizon for a while now. Not sure about AT&T.
Still might work 10% of the time though.
Most of Asia (so most of the world) use digits only for their wifi password.
Lack of fluency with Latin characters was not a big concern in the original implementation. That should be fixed with WPA3
It's all about the length really.
Is 10 characters considered weak for mixed case letters, numbers, plus punctuation now?
HOWEVER, that calculation only works if all 10 characters were generated uniformly and randomly. Humans are terrible at this. Now, maybe your trick for turning words into safe passwords is great, but there is no way to be sure. Sadly, remembering 10 random characters is hard.
Luckily, easy to remember and strong passwords are possible. The system I would recommend is diceware: www.diceware.com
Is a password which is very easy/comfortable to type out physically any more/less strong than another of the same length?
I ask this because I often use a visual pattern on the keyboard for a password and I don't recall which characters they may be, but I recall the pattern in need to type out on a qwerty kb
Most password crackong dictionary already include common keyboard patterns sich as "qwerfdsazxcv" or variations of it.
Making a phrase is okay, but you have to start with actually-random words.
curl -s https://raw.githubusercontent.com/first20hours/google-10000-english/master/google-10000-english-no-swears.txt | shuf | head -n 4 | tr '\n' ' '; echo
mine wear vacation mostly
You could also use `cat /usr/share/dict/words` instead of the `curl`, which is a much larger word list, but you get impractical passwords like "globular cellulose's malnutrition's dangling".
WPA enterprise using certificates is usually much harder to crack since you need to interrogate server, you can't just brute force hash. This method only really applies to PSK mode (home networks and small businesses usually)
Edit: As another comment said, just make sure it's not easy to guess based on rainbow tables and whatnot
(And could / should we include somehow that "hashes/second" increases by factor of ~2(?) each year?)
However definitely DONT use a quote or lyrics. Needs to be something unique.
Would you please simply type "whatever", instead of this "W/E" nonsense? Considering the amount of 8+ character adjectives you used, you clearly aren't trying to be less verbose.
Spelling words correctly is not "arbitrary", it's conventional.
Understanding for me required a Google search. It's quite a nuisance for me to have to google an uncommon abbreviation for one of the most common words in my native language.
Any advice for what constitutes a strong or weak password in this context?
You'd probably have to set up a separate network for those devices (again, technically a good thing) which can be a source of some friction.
It used to be only good routers had a guest network option, but now even $20 TP-Links can use Radius for the main network and WPA2 for the guest network; though I'm not sure you can do something like whitelist by MAC on only the guest network.
It can be a pain in the ass when the consumer device requires a valid SSL certificate. On active directory networks this isn't much of a problem because a CA is pushed out to devices, but automating this at home can be a bigger issue.
Just look for a wordlist in the respective language or also try to create your own via tools like CeWL?
Personally, as long as I stick to supported chipsets, I've almost never had an issue.
although some of the reviews seem to indicate there may have been a change in chipset/drivers. I wish you luck!
It was a pain the get working on my Raspberry Pi, I had to try several different drivers and edit a Makefile to get it to compile. But I did eventually get it working as an AP, there's a script called create_ap which is very nice to painlessly run an AP on Linux.
All of these cards are "known to just work" on linux at least.
To note, the extent of my technical abilities at that time wasn't much beyond being able to install a mainstream linux distribution or write a simple program in C.
On a pretty standard laptop (intel chipset/CPU/GPU/Wireless) it booted right up with no effort.
Felt like a real security expert then ;) I'm out of that loop now but security sure did seem a lot easier to get a grip on at that time.
It was almost easier to automate a brute force, sit back and wait.
The interesting part is that you can't configure the minimum or maximum length anymore, the restrictions are hard coded for every hash type. This is because for fast hashes the branch introduced by the check would be slower than just hashing away.
 It was possible with the old CPU-based hashcat (--pw-min and --pw-max)
The keyspace for WPA is huge and the hash speed is still relatively slow, even with an extremely high end system like you linked to the quality of the initial dictionary is really important.
Not trying to say that easier is better, in this case. Just wanted to show this tool for those who don't know it.
 - https://github.com/derv82/wifite2
edit: added wifite initially, replaced it with wifite2
It's not illegal to receive signals on an unlicensed band with stock equipment
But my neighbors would still be pretty miffed, and would likely have legal recourse, if I passively captured their EM emissions in the 390-700nm band through their bedroom windows at night on a regular basis.
Technical distinctions don't always map onto legal distinctions. Even if you're eventually acquitted, how much do you want to pay yourself per hours to explain this to a judge?
There's some discussion on Wikipedia here of unauthorized piggybacking (which does not even require hacking the network), with a few examples of actual instances.
In St. Petersburg, 2005, Benjamin Smith III was arrested and charged with "unauthorized access to a computer network", a third-degree felony in the state of Florida, after using a resident's wireless network from a car parked outside.
A third-degree felony in Florida seems to be up to 5 years. In some states it is up to 10 years. Another person got "a fine of $250 and one year of court supervision".
If it's unauthorized access to the computer of a government or financial institution (or "which is used in or affecting interstate or foreign commerce or communication", which can be interpreted very broadly), then the Computer Fraud and Abuse Act would apply. From reading about the sections regarding "trespassing", punishment can be a fine and 1-5 years imprisonment (first offense), or up to 10 years (repeated offense).
I did a study using an Atom netbook - a 64 bit key (10 digits long) took 8 mins to find, 128 (26 digits) took 30 mins
Also to reduce the size of the pcap file, you may want filter it for EAPOL packets only:
tshark -r input.pacp -R "eapol || wlan.fc.type_subtype == 0x08" -w small.pcap