Wireless Hacks A Valpo Hacks Presentation May 2016 Prereq Kali 2. Download the ISO at http://kali.org and you can run in Virtualbox http://virtualbox.org (Free) Prereq Alfa AWUS036H $20 Agenda Discuss several Wireless Attack Methods and the practicality of each
Demonstrate WEP cracking with Wifite Demonstrate WPA2 handshake capture with Wifite Demonstrate GPU wordlist bruteforce of WPA2 capture with oclHashcat (for AMD GPUs) AKA cudaHashcat (for Nvidia GPUs) Security suggestions throughout
Q/A Note: For the remainder of this presentation I will use WPA and WPA2 interchangeably. Wireless Attack Methods Wireless Attack Methods Overview #1 WEP Hacking any WEP network can be cracked in minutes today, key length and password strength do not matter. It is cryptographically broken Wireless Attack Methods #1 WEP Hacking (2/2)
Tools used for cracking WEP: Kali Linux + Wifite Wifite automates the process of WEP cracking with the aircrack tools, and it works most of the time. But for a higher success rate, you should learn to use the aircrack tools themselves. See http://aircrack-ng.org for more info Security Recommendation: Never use WEP for Wireless encryption Wireless Attack Methods Overview #2 WPS Bruteforce Only 11,000 possible combinations due to major flaws in protocol, bruteforcing can take 2-10 hours, but most new routers mitigate bruteforce by implementing lockouts between attempts, however even lockouts have their problems. Also note - even disabling WPS will sometimes not protect you. It is best to use a firmware like DDWRT which does not support WPS, or a router without WPS support
Wireless Attack Methods #2 WPS Bruteforce (2/3) Attack discovered in December 2011 by Stefan Viehbock For detailed info, checkout the white paper here (its a short and interesting read): https://sviehb.files.wordpress.com/2011/12/viehboeck_wps.pdf Heres the short summary: WPS is an 8 digit pin, which would make the possible combinations 10^8 (100m different possibilities). If you are bruteforcing 100m possibilities and it takes 1 second per attempt, it would take over 3 years to try all the combinations, so that would be very, very impractical, and so, WPS was assumed to be reasonably secure. But Stefan found out that there is a way to split the 8 digits up into 2 groups of 4 and bruteforce them separately because of flaws in the WPS protocol that acknowledged whether half a pin was correct or not. With 2 groups of 4, that would equal only 20,000 possibilities, but to make matters even worse, he also discovered that on the second half of the pin it can be separated into another 2 groups because the last digit is a checksum and can be ignored. So it ended up being 10^4 + 10^3 (11,000 possible combinations) So that is my short explanation for how WPS was reduced from 100 million possibilities to just 11
thousand. Wireless Attack Methods #2 WPS Bruteforce (3/3) In 2011, many routers did not have any lockouts in place if WPS bruteforcing was attempted (with 100 million possibilities, bruteforcing probably wasnt that much of a concern, especially for consumer routers). And so, most routers at the time could be bruteforced in 2-4 hours. Today however, most routers have lockout protection that makes bruteforcing much more difficult/impractical, but still possible sometimes if the locking is implemented badly enough. But there is still a percentage of routers out there, made from 2007-2011, without upgraded firmware, that do not have any WPS lockouts and can be bruteforced in 2-4 hours. Security suggestion: Upgrade your router firmware to DD-WRT which does not support WPS, or use a router without WPS support. Simply disabling WPS in your router settings may not be enough it sometimes does not truly disable it and you may still be bruteforceable. If your router does have WPS locking, I still wouldnt depend on it. There are ways for a hacker to get around locking by adding time delays (setting built into Reaver), and forcing reboots using DoS attacks. Tools to crack WPS:
Kali + Reaver or Bully Wireless Attack Methods Overview #3 WPS Pixie Dust Attack New attack (2014) able to reveal WPA password in minutes/seconds due to firmware design flaw when the WPS pin is not-so-randomly generated, extremely effective, but only works on some router models (although they are some of the most common). Wireless Attack Methods #3 WPS Pixie Dust Attack New attack in 2014, IMO the greatest (worst) wireless attack since WEP was cracked because
of the speed of the attack it reveals any WPA2 password, no matter the length or complexity, in seconds. Bad pseudo random generation lead to the predictability of WPS pins Only works on some router models, but they are some of the most common Check this google spreadsheet to see if your router is vulnerable, but keep in mind this is not an exhaustive list. Try the -K switch on Reaver to test your router
Vulnerable Router list: https:// docs.google.com/spreadsheets/d/1tSlbqVQ59kGn8hgmwcPTHUECQ3o9YhXR91A_p7Nnj5Y/edit?pr ef=2&pli=1 https://forums.kali.org/showthread.php?24286-WPS-Pixie-Dust-Attack-(Offline-WPS-Attack) See Resources in the forum post above for more info. Recommended Tool for WPS Pixie Dust Hack: Kail 2 + Reaver + -K 1 option. Use wash tool for finding WPS APs. Wireless Attack Methods Overview #4 WPA2 handshake capture + GPU wordlist bruteforce Probably the most practical wireless attack today, all routers are vulnerable, GPU can break any simple WPA password in 2 10
minutes, even with a laptop GPU. What passwords are considered simple is sometimes surprising, and I will cover what a good password is and isnt. Hint: using @ instead of an a adds zero complexity to your password. Wireless Attack Methods #4 WPA2 handshake capture + GPU wordlist bruteforce My laptop can try 9 million passwords against a WPA2 hash in 12minutes, my desktop GPU can do it in 1 minute If your password is in a common wordlist like rockyou.txt, it will be broken quickly and easily
Some info about wireless passwords: [email protected]$$W0RD is not good even though many websites would say it is secure or strong Length of your password provides security against bruteforcing, but even a 29 character password is not necessarily secure, and can be broken if it is in a wordlist, consider the password: in the beginning was the word
This password was cracked as described in the arstechnica article below. New attacks are breaking longer and longer passwords by scraping Wikipedia and other websites to create lists of English phrases. Long English phrase passwords being cracked: http://arstechnica.com/security/2013/10/howthe-bible-and-youtube-are-fueling-the-next-frontier-of-password-cracking/ Wireless Attack Methods Overview #5 Not-so-Randomly Generated Default WPA Password Attack Some routers do a poor job of randomly generating default WPA passwords, and they can sometimes be reversed just by looking at the SSID or MAC and performing some calculations on it (different for each model/vendor). Dont rely on default WPA passwords, even if they appear to be adequately random and strong
Wireless Attack Methods #5 Default WPA2 Password Correlation Attack Example: http://www.jakoblell.com/blog/2012/11/19/cve-2012-4366-insecure-default-wpa2-passphrase-in-multi ple-belkin-wireless-routers / Tool: http://www.routerpwn.com/belkinwpa/ Although your routers default password may look safe, secure, and random like ce946626, dont trust it, use your own strong random password instead! In this attack, the method Belkin used to generate the random default WPA passwords was not so random at all. Once discovered, it can now be used by anyone to find the default password based on the MAC and SSID. Belkin simply did some addition to and rearranging of the MAC address. Side note: I once received a wireless router from ATT with a default password of 10 digits. Knowing that ATT defaults their passwords to 10 digits, I could then begin bruteforcing other routers with the same ATT SSID, and the combination of possible passwords would be 10 billion, but it is still possible if I wanted to badly enough, my $400 GPU could do it in about a week. I actually tried to run this
bruteforce on my own handshake capture but realized that I dont have adequate cooling on my system to run the GPU that hard. It kept overheating and triggering the kill switch. So not as practical as the attack above, but another example of a bad default password implementation. There are many attacks for different vendors and router models that expose the poorly generated, not-so-random algorithms for creating default WPA passwords. Security suggestion: Dont use default WPA passwords, even if they appear to be adequately random and strong. Wireless Attack Methods Overview #6 WPA TKIP Attacks TKIP is partly based on WEP and has some flaws. Overall it is not completely broken, but dont use it, just use AES instead. This an advanced topic that would be used as a last resort wireless attack. Wireless Attack Methods #6 WPA TKIP Attacks TKIP is based on WEP and was created as a transitionary protocol between the
jump from WEP to AES in order to have some backward compatibility for routers that couldnt handle AES yet. The tools, and documentation are limited, but an expert MIGHT be able to perform a man-in-the-middle attack based on what Ive read. From my research, the TKIP flaws would not allow a hacker to reveal the WPA2 password, but would allow him to possibly decrypt small packets and inject small packets into the network. Initial Discovery of Attack Possiblities: http ://arstechnica.com/security/2008/11/wpa-cracked/2/ Advanced TKIP Attacks: http:// download.aircrack-ng.org/wiki-files/doc/tkip_master.pdf Security suggestion: Just use AES, be aware that TKIP has some flaws, research more about it if you are interested in the details of these attacks. The white paper on advanced attacks is 156 pages long. Wireless Attack Methods Overview
#7 Denial of Service attack Wireless devices can be DoSd Wireless hacking isnt just about cracking passwords, hackers might also just want to be annoying or cause business downtime and a denial of service attack on a wireless network is easy and effective way of causing trouble. Im not planning on covering a demonstration of this topic, but you can read more about how to kick users off wireless by pretending to be the Access Point and send deauthentication packets to the clients using the aireplay tool. There are more advanced methods of crashing APs by flooding also. Be careful testing some tools because you may inadvertently cause problems for all wireless users near you if you dont know what youre doing.
For more info, checkout the tool mdk3 Wireless Hacks Demonstration WEP Hack Demonstration In Kali, open Terminal Type in wifite -wep
Wifite will perform a wireless scan, only looking for WEP networks Once target network is found, hit CTRL + C to stop scan Wifite will begin collecting Initialization Vectors (IVs) Once 10,000 IVs are recorded, Wifite will automatically begin trying to crack the key
Note: This demonstration requires at least 1 client connected to the WEP network, either on the LAN or WLAN. However, there are advanced attacks using the aireplay-ng tool that can generate IVs without any clients connected! WPA2 Handshake Capture + GPU crack In Kali, open Terminal Type in wifite -aircrack --wpa
Wifite will scan only for WPA networks, and use aircrack to verify that it has found a handshake (instead of the default which I think is tshark, I found that aircrack works much better) Hit CTRL + C when your target network shows up in the scan Once handshake is captured, it is stored in ~/hs Next we will need to convert that .cap handshake to a .hccap which we can use to crack with Hashcat
WPA2 Handshake Capture + GPU crack Converting CAP to HCCAP for cracking by Hashcat: In Kali, open terminal First we will clean with cap with WPA clean, then convert it to HCCAP with aircrack-ng and -J option Create a folder named WPAClean on Kali Desktop, then WPA Clean the cap file: wpaclean /root/Desktop/WPAClean/clean-hs.cap /root/hs/Valpo*.cap Convert CAP to HCCAP: aircrack-ng /root/Desktop/WPAClean/clean-hs.cap -J /root/Desktop/WPAClean/ hccap-hs WPA2 Handshake Capture + GPU crack
https://developer.nvidia.com/cuda-downloads http://support.amd.com/en-us/kb-articles/Pages/OpenCL2-Driver.aspx If you have a Nvidia or AMD GPU: The first link is the Cuda driver for Nvidia GPUs Second link is OpenCL driver for AMD GPUs
One of these is required to be installed in order for Hashcat to utilize your GPU for hash cracking GPU crack speeds Laptop GPU: NVIDIA GeForce GT 750M - 1GB
9million passwords in rockyou.txt takes 12minutes @ 13,800 h/s Desktop GPU: AMD R9 290X 4GB 9million passwords in rockyou.txt takes 1 minute! @ 163,000 h/s WPA2 CPU Cracking with aircrack-ng Only ~300-100 h/s, much slower than GPU even on the best CPU with lots of cores, But can still get the job done if dont have a GPU to run the attack with
aircrack-ng -w rockyou.txt /root/hs/hs/V*.cap WPA2 Handshake Capture + GPU crack To begin cracking: ./cudaHashcat64.exe -m 2500 hccap-hs.hccap G:\Wordlists\rockyou-wpa.txt Cracked password will be output to cudahashcat.pot
Note: GPU crack must be run on your Native OS (not in Virtualbox) so that Hashcat has full access to your GPU. Dont forget to have your GPU drivers installed (AMD or Nvidia) and you also need the CUDA (Nvidia) or (OpenCL) tools installed. WPS Pixie Dust Attack Open Terminal in Kali, then: airmon-ng check kill kills any process that could interfere
airmon-ng start wlan0 make sure your wireless card is wlan0, it may be wlan1, you can check with ifconfig wash i wlan0mon this looks for any WPS routers nearby reaver -i wlan0mon -b 00:13:33:EB:F2:08 -K 1 This starts the Pixie Dust attack, -b is the MAC address of the router which you found using the previous scan WPS Bruteforce
Run both of the airmon-ng commands in the previous slide, then Instead of using the -K 1option, remove it and use: reaver -i wlan0mon -b 00:13:33:EB:F2:08 WPS Bruteforcing will begin and can take 2-10 hours
Most new routers (post 2012) mitigate this attack by setting lockouts
Beagles are a breed of dog that loves to play and have fun! They are fast cute and playful. Beagles were used over 400 years ago to hunt rabbits and pheasant. What do beagles eat? ... PowerPoint Presentation Last modified...
Lossless vs Lossy files. Lossless compression is a class of data compression algorithms that allows the original data to be perfectly reconstructed from the compressed data. By contrast, lossy compression permits reconstruction only of an approximation of the original data,...
Mission and Vision. Mission: Dorchester School District Two leading the way, every student, every day, through relationships, rigor, and relevance.. Vision: Dorchester School District Two desires to be recognized as a "World Class" school district, expecting each student to achieve...
James L. Roark Michael P. JohnsonPatricia Cline Cohen Sarah StageSusan M. Hartmann. CHAPTER 23. From New Era to Great Depression, 1920-1932. The American Promise ... Secretary of the Treasury Andrew Mellon reduced the government's controls over the economy and cut...
What's in Google Scholar? These resources are gathered from "academic publishers, professional societies, online repositories, universities and other web sites."1. A 2009 study found Google Scholar, on average, 17.6 percent more scholarly than materials found only in library databases.2This is...
C'est dans cette loi qu'on retrouve les EPIC, les sociétés nationales, mais ces deux formes ne relèvent pas des partenariat public/privé parce qu'il n'y a pas de personnes privées. Au delà de ces deux formes, cette loi concerne aussi les...
Ready to download the document? Go ahead and hit continue!