The Ethical Hacker Network - WPA WPA2 Cracking no longer a problem

millwalll

Guest

« on: March 28, 2011, 08:13:51 AM »

Hi All,

Many of us know that cracking WPA and WPA2 keys was never 100% secure. However as long as the Key used was complex and long enought it was not a easy process to brutt force the key, as it would take days,week,monts even.

Introduing the cloud

Nowdays its very cheap to hire super computers that run a lot faster and can run a English dictionary of 284 million words in around 55 min for around $40 so how secure is WPA and WPA2 now?

http://www.wpacracker.com/index.html


	Logged

hayabusa

Hero Member

Offline

Posts: 1631

Re: WPA WPA2 Cracking no longer a problem

« Reply #1 on: March 28, 2011, 09:04:21 AM »

Nice! Sure saves time, if they truly have the setup to handle it, as they claim. (Wouldn't surprise me, and was bound to show up, sooner or later.)

Then again, there's no guarantee, still, that it'll be in a dictionary (the smart ones WON'T use dictionary words, or even easy permutations...)


	Logged

~ hayabusa ~

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'

OSCE, OSCP , GPEN, C|EH

hayabusa

Hero Member

Offline

Posts: 1631

Re: WPA WPA2 Cracking no longer a problem

« Reply #2 on: March 28, 2011, 09:12:04 AM »

Quote from: Jamie.R on March 28, 2011, 08:13:51 AM

...so how secure is WPA and WPA2 now?

So I'd say, still VERY secure, if on WPA2, assuming the person BEHIND the password / passphrase puts their thought into it. Advances will come, over time, but the reality is, if the person / people implementing do it right, it's still pretty solid.


	Logged

~ hayabusa ~

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'

OSCE, OSCP , GPEN, C|EH

millwalll

Guest

Re: WPA WPA2 Cracking no longer a problem

« Reply #3 on: March 28, 2011, 09:17:42 AM »

That is ture hayabusa.


	Logged

hayabusa

Hero Member

Offline

Posts: 1631

Re: WPA WPA2 Cracking no longer a problem

« Reply #4 on: March 28, 2011, 09:24:26 AM »

Actually, I'll go one step further on this, just to clarify my thoughts...

Certainly, for the low value, it's worth using in a pentest, to TRY to crack the protection, and get in. I think, even more, that the value of this lies more for security auditors, to ensure that a company DID do the smart thing, and took proper care / precaution in selecting their passphrases / keys, etc.

So not saying there's no value in this service. Just that, if you're a pentester, you've got to know that IF you're going against a network where the admins had half a clue, you're liable to hit a dead end (albeit much more quickly Tongue

)


	Logged

~ hayabusa ~

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'

OSCE, OSCP , GPEN, C|EH

WCNA

Full Member

Offline

Posts: 187

Re: WPA WPA2 Cracking no longer a problem

« Reply #5 on: March 28, 2011, 11:53:22 AM »

That brings up one the ironic things about pentesting. Failing to break in is a good thing. Unfortunately, companies don't know whether the failure to break in was due to good security or a poor pentest. Luckily, standards are being adopted.


	Logged

ISC2 Associate, WCNA, CWNA, OSCP, Network+

jsm725

Newbie

Offline

Posts: 36

Re: WPA WPA2 Cracking no longer a problem

« Reply #6 on: March 28, 2011, 12:15:17 PM »

So this brings up an interesting question. Yes we could do this to speed up the process of cracking WPA/WPA2, but should we do this?

What are the implications of giving client information to a third party that doesn't have a contractual obligation to the client? What type of agreement are you making with WPACrack before you hand over a .pcap of client data?


	Logged

CISSP, PCI-QSA, OSWP

hayabusa

Hero Member

Offline

Posts: 1631

Re: WPA WPA2 Cracking no longer a problem

« Reply #7 on: March 28, 2011, 12:27:00 PM »

@jsm725 - Personally, I'd strip the pcap down to only the auth packets needed to crack the WPA. Additionally, one would HOPE, anyway, that any IP's in the pcap are internal, and that there's nothing publicly indentifiable in there. This is all assuming I use their service, to begin with.

That's my take, anyway...

@WCNA - agreed, and good that folks are working towards some standards. Either way, though, if I were to hire someone to pentest me, I'd want a detail of their methods and attacks they attempted, so I could decide, for myself, about the 'quality' of the services they performed. A GOOD pentest report WILL include the technical details and steps, for the technical folks to review, afterwards.


	Logged

~ hayabusa ~

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'

OSCE, OSCP , GPEN, C|EH

hell_razor

Jr. Member

Offline

Posts: 90

Re: WPA WPA2 Cracking no longer a problem

« Reply #8 on: March 28, 2011, 12:36:52 PM »

Quote from: WCNA on March 28, 2011, 11:53:22 AM

This is why setting up a honeynet with some "open" doors might be a good thing. If they find it, and get in and identify it as such, then they may know their stuff. If they either do not find it or cannot get in and effectively identify it, then I would question their ability.


	Logged

A+, Network+, Server+, CISSP, GSEC, GCIH, GPEN, GCIA, GISP, GCFW

millwalll

Guest

Re: WPA WPA2 Cracking no longer a problem

« Reply #9 on: March 28, 2011, 12:55:33 PM »

I agree with all comments so far. and yes as long you have a good team in place your wifi should be fine.

So should companies invest in or configuare better security for there wifi ? or should they still think WPA/WPA2 is fine to keep them safe.

I know a lot of companies that have there wifi setup with WPA2 and that is about as far as it goes.


	Logged

hayabusa

Hero Member

Offline

Posts: 1631

Re: WPA WPA2 Cracking no longer a problem

« Reply #10 on: March 28, 2011, 02:56:42 PM »

To me, it all depends on the purpose of the wifi, etc. If it's mission critical stuff, many customers I deal with STILL require a forced VPN login, after authenticating to the wifi, to reach internal systems. This is sensible, and adds just one more layer to break through, should an attacker get past the original wireless authentication.

IMHO, you can NEVER be TOO safe, however, you also have to weigh usability / support costs against 'security', and come up with the best mix for your organization.


	Logged

~ hayabusa ~

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'

OSCE, OSCP , GPEN, C|EH

n4zty

Newbie

Offline

Posts: 1

Re: WPA WPA2 Cracking no longer a problem

« Reply #11 on: April 03, 2011, 07:40:49 PM »

Hey guys this topic truly interest me since im from the howardforums.com and we are discussing ways of bypassing the wpa2 key for wifi tethering on the samsung galaxy indulge and seems no one has been able to get around it i dont suppose any of ya might know a way to get around this if not then i suppose we will have to keep looking around.


	Logged

Pages: [1] Go Up

« previous next »