WPA-PSK Cracking As a Service 175
An anonymous reader writes "Moxie Marlinspike, a security researcher well known for his SSL/TLS attacks, today launched a cloud-based WPA cracking service, where for $34 you can test the security of your WPA password. The WPA Cracker Web site states: 'WPA-PSK networks are vulnerable to dictionary attacks, but running a respectable-sized dictionary over a WPA network handshake can take days or weeks. WPA Cracker gives you access to a 400CPU cluster that will run your network capture against a 135 million word dictionary created specifically for WPA passwords. While this job would take over 5 days on a contemporary dual-core PC, on our cluster it takes an average of 20 minutes.'"
Build a dictionary! (Score:5, Insightful)
So for $34 you can make sure your password is part of their dictionary?
Re:Build a dictionary! (Score:5, Funny)
Re: (Score:2)
Re: (Score:2, Funny)
Holy shit. How did you get my password?
Re: (Score:2)
Oblig.:
http://bash.org/?quote=244321 [bash.org]
And Slashdot is promoting this (Score:2, Insightful)
because?
Re: (Score:2, Funny)
Because this is news for nerds, stuff that matters.
Dumbass.
Re: (Score:2)
And this matters because..
Re: (Score:3, Insightful)
And this matters because..
#1: It's IT-related
#2: It's Security IT-related
#3: Within IT, it has to do with one of the most prevalent technologies in use today.
#4: And finally, it's here, because it sure as hell ain't gonna show up on CNN or the nightly news "tech" corner. Well, at least not for another 6 months or so, when it's "breaking news" to them.
Re: (Score:2)
Ok, I originally assumed you were purposely being obtuse so my answer was short, and apparently comical to someone... I'll try to explain this clearly and concisely, so that it might sink into that brain of yours:
Because any self respecting nerd who isn't busy getting their panties all twisted over "OMG HAXX0RZ" could reasonably be expected to find this interesting.
Moxie Marlinspike is a rather high profile computer security researcher who has been featured on slashdot at least on
Re: (Score:2)
Yes, somebody already said that. But advertisements aren't news.
Re: (Score:2)
Sure, because nobody around here thought about security until this story was posted.
Re: (Score:2)
Re: (Score:2)
Because information wants to be free, dude!
"test your key", riiiiight (Score:3, Interesting)
While this job would take over 5 days on a contemporary dual-core PC, on our cluster it takes an average of 20 minutes
Anyone interested in testing their own key would not care about it taking 5 days. During a weekday, you're not around most of the time anyway. I doubt anyone cares enough to spend $40 for something that can be done for free.
Re: (Score:2)
Suppose your in the middle of a download and suddenly you ISP capps you. For $34 and 20minutes later you could be back online at full speed.
Well at least you can say Moxie has Moxie. (Score:5, Insightful)
Re:Well at least you can say Moxie has Moxie. (Score:5, Interesting)
I'll save 'em the full $34.
Go here: https://www.grc.com/passwords.htm [grc.com]
Re:Well at least you can say Moxie has Moxie. (Score:5, Informative)
https://www.fourmilab.ch/hotbits/secure_generate.html [fourmilab.ch]
https://www.random.org/passwords/ [random.org]
Re: (Score:2)
Re: (Score:2)
Even better, use a utility that gets random data without going through the Internet. Here, I use KeePass, tell it to make a 63 character random string, wiggle the mouse and type in some keys.
Then I paste the string into my router, put a copy of the string on a file in a TC protected container. That I copy to a USB flash drive and manually copy and paste that into the rest of my boxes' WPA2 config.
If I forget the WPA2 password, who cares. I log on the router via a hardwired connection, repeat the above pr
Re: (Score:2)
....God herself.
You said that just to piss people off, didn't you? :)
Re: (Score:2)
If an attacker can get at my machine's clipboard, then I have far bigger problems to worry about other than how sturdy my WPA2 key is. That's akin to worrying if someone is fretting about using Medeco M3, Abloy PROTEC, or Evva MKS on the front door when a robber just smashed into the living room with a pickup truck.
The weakest point of the WPA2 implementation is that every machine on the SSID has to know that key. So if one laptop gets compromised and the attacker is able to extract the key, they have a t
Re: (Score:2)
That could be a decently secure system if done right. Have a program running on each of the boxes that takes the year, date, day of week, and hour (perhaps having a value for quarter hour, but you don't want to granular because machines may not be that tightly timesynced). Then add a secret key value. 128 bits would be minimum, best would be something 512 bits of cryptographically strong unpredictable data.
SHA-512 the date info + the random secret key, and convert the info to a WPA2 key format by getting
Re:Well at least you can say Moxie has Moxie. (Score:5, Funny)
Pfft, that's only pseudo random data, why settle when you can get true random data
No "random" data that you get from the net should be trusted. I throw old 16-sided gaming dice to generate a transparent X-Y grid, which is then set over the top of my cat's litter box. The positions of the cat turds are normalized against a reference litter box and fed into a fancy matrix algorithm, the output of which is SHA4 hashed and truncated to make the WPA2 key.
Re: (Score:3, Insightful)
But that's vulnerable to a statistical analysis of the preferred distribution of cat turds. Maybe you should randomise it by giving them catnip every time they take a dump?
Re: (Score:2)
Randomize the cat.
Or you could go even one more step and kill the cat after it takes a dump.
Re: (Score:2)
That's interesting. I feed the gaming dice to my cat, then feed it ipecac and let the cat throw the dice!
Re: (Score:3, Funny)
"I trained your cat to turd in predefined locations. I'm now 0wning your box."
That string is my WPA-PSK password! How did you get it!
Re: (Score:2)
Eh, it's all been predetermined from the beginning of time anyway.
Re: (Score:2)
Re: (Score:3, Informative)
Re: (Score:2)
Nokia aren't the only phones with crap wpa implementation. My LG Renoir allows you to type in a 63 digit wpa key with only moderate difficulty, but if you actually try to connect to the wifi network the phone reboots. How i laughed.
Re: (Score:2)
$20?? Pad me $10 offer a tool that generates an unlimited number of military-grade security passwords that even a young child can remember forever, and optionally also generates public/private keys to use in-between.
<fearmongering>Plus a guide on proper usage and a link list if you’re interested in learning more about how to prevent your young daughter being online-raped, your partner being raped in the ass in prison because of someone framing her, and you getting caught by Chinese/Russian/Ameri
Which is why... (Score:2)
... you dont use d!ct!0n@ryw0rd50r@tl3@st make them hard to be brute forced.
I cant really see how this is service is legal but I am willing to be educated how it could be.
Re: (Score:2)
Why should it be any more illegal than tools like aircrack-ng, nmap, or for that matter, telnet? Just because something can be used by hackers doesn't mean it's illegal*.
*Unless you live in Germany. "Hacker tools" are illegal there iirc.
Also, l33t-speaking dictionary words is generally considered a pretty poor way to create passwords.
Re: (Score:2)
Interleaving words makes it mmuocrhe htaord bfrourtcee.
(much more hard to brute force)
Re: (Score:2)
Re: (Score:2)
by L4t3r4lu5 --> Apologies for replying to myself, but I realise that you concatenated several words. That's great if you want a 20+ character password, but which user wants that? First name + year of birth: 1R9o8b3. EAsy to remember, shocking to crack.
You were born in the year 4345??? And your real name is Ltrlu?
From the Article... (Score:3, Interesting)
"Marlinspike declined to say who operates his compute cluster"
I guess he can't come out and say he's using botted boxes, right?
Re: (Score:2)
Or perhaps MM simply doesn't want to get the plug pulled by a conventional cloud compute provider, due to the questionable PR (and possibly other attention) that this service may
One could view this as an alternative to the old "publish the exploit as a goad to the provider" tactic. Previously, some cryptographic weaknesses required someone to have the resources to obtain a compute cluster large enough to deal with some specific cracking problem. With this approach, it isn't even necessary to be able to se
It's actually $17 for 40 min. (Score:2, Informative)
...$34 is the super-fast price.
who uses WPA anyways? (Score:2, Funny)
Who uses WPA or WEP anyways? Either you leech your neighbor's unprotected WiFi, you live far enough away from other homes so that your signal doesn't leave your property, or you maintain a separate DMZ of wireless IPs that can't get into the good stuff, but can access the Internet.
Next people will say that MAC address security is actually meaningful.
Re: (Score:2)
Or, you run wired.
One of the first projects I did when I moved into our new house was run ethernet to all rooms
Re:who uses WPA anyways? (Score:5, Interesting)
Believe it or not, there are some embedded devices which don't have the CPU juice for WPA2, so they were given a BIOS update so they can run something better than WEP as some form of security. WPA has its issues, but it sure beats WEP.
The best wireless setup is to have two wireless SSIDs. Your internal one that runs off of WPA2-Enterprise, RADIUS server, and smart cards. Then an external one that has a stern packet filter and throttling mechanism. This way, people can log on your open wireless to check E-mail, but Limewire and other P2P apps will be stopped. Of course, someone can jump that, but if they do that, its not your problem anymore.
I do see one use for MAC address security, and its more of a legal thing than computer protection. If a security breach criminal case winds up in court, and you can prove a potential intruder was bypassing your MAC security, it might land a conviction. Otherwise, someone can make up a story of you allowing people to have your WPA2 passwords, etc.
Re: (Score:2)
It is a cool excercise in geekdom to have that though. Plus, another advantage of having the WPA2 password change every so often is that you can give your LAB party guests the WPA password for that interval of time and know that as soon as the cronjob fires to change the router's key, their access automatically gets pulled. Without the cryptographic nonce, they have no way of figuring out what the n+1 phrase is.
Re: (Score:2)
All forms of security are flawed, if that's what you're getting at. The goal is not to make it impossible to break into your space (be it computer network, home, whatever), but to make it difficult enough that it's not worth the attacker's trouble. I fail to see why you're bashing things like wireless encryption or MAC filtering for not being perfect, when you ought to realize this simple truth.
I mean, let's look at your example of "your signal doesn't leave your property". If your attacker cares enough to
Re: (Score:2)
I live in a country where most of the major ISP's provide DSL and cable modems (I would say around 40% of the country has one these) boxes with wireless and only WEP encryption ( they claim much of the country still only uses WEP when asked ). They do not provide most of the time a way to modify this, and most users would not know how anyway.
Even worse, most use a predictable well known formula for generating the password, that is based on publicly available information. Essentially you need to know two pie
If it can be brute forced you're doing it wrong (Score:2)
Nobody is going to brute force my randomly generated 63 character alphanumeric key. Not before a vulnerability in the encryption appears or the hardware gets replaced with a new standard
Re: (Score:3, Funny)
I thought this [xkcd.com] was how you brute forced a password in less than 30 minutes.
$34? I can undercut that. (Score:4, Funny)
For $30 I'll run the command-line random number generator I found on the web and send you a 60 digit number.
If you act today, that's only 50 cents a number!
Passwords that are found in dictionaries = FAIL! (Score:2)
I’m sorry, but if your password is found in a dictionary, you fail, and deserve to be cracked. I don’t care if you’re 50 year old steel worker with no higher education. You are still a human. The most intelligent being on the planet! Behave like one, would ya?
Protip: Adding just ONE special character to your password is going to wreck even faster brute force attacks. Let alone dictionary ones.
If you want your password being “penis”, and it complains that it’s too short, n
Re: (Score:2)
It's a horrible myth that L337SP33K is very secure. Special characters just aren't that great.
Try something like "the quick brown fox shat all over the lazy dog".
Or "twinkle twinkle like a rolling stone".
Or any other phrase that makes sense to your twisted and uniquely messed-up gray matter.
Plaintext is easier for a human to remember than quasi-random characters, and it will be just as secure.
Re: (Score:2)
3. If you can, use public key authentication. Let’s see them brute-force a 2048 bit key!
Remember that you can't compare symmetric and asymmetric schemes like that. Usually, in symmetric schemes the bits refer to the length of the password, where in asymmetric schemes it refers to the size of the prime numbers involved. For instance it took a good amount of time to break 64-bit DES at distributed.net, but a 663 bit prime number has been factorized using a general purpose algorithm (http://en.wikipedia.org/wiki/RSA#Integer_factorization_and_RSA_problem).
Re: (Score:2)
Remember that you can't compare symmetric and asymmetric schemes like that. Usually, in symmetric schemes the bits refer to the length of the password, where in asymmetric schemes it refers to the size of the prime numbers involved. For instance it took a good amount of time to break 64-bit DES at distributed.net, but a 663 bit prime number has been factorized using a general purpose algorithm (http://en.wikipedia.org/wiki/RSA#Integer_factorization_and_RSA_problem).
That would be a 663 bit NUMBER. Even I can factorize prime numbers :P
Use a passhprase (Score:2)
e.g. a sentence. With capitalization and punctuation. You won't really have to worry about dictionary attacks that way.
Nice name (Score:2)
Moxie Marlinspike. That's a Gnome name if ever I heard one.
We have a situation here (Score:2)
5 days? (Score:2)
Assuming 5 days for a dual core, and thus 2.5-3 days for a quad core, that's not really a huge amount of time on a machine that's easily available. I certainly wouldn't want to spend $34 when i can just leave a spare quad core box running this in the background for a few days.
Brilliant business plan (Score:2)
Capitalism-wise, it's genius. Nearly as smart as prostitution.
"Let me perform a service, charging you by the hour, but the longer I go the happier you are."
Re:One problem (Score:4, Insightful)
Re:One problem (Score:5, Funny)
I think the tool is not being sold to people wanting to crack into a WiFi network, rather selling to people so that they can test their WiFi network.
[x] Check this box if you are above the age of 18 and promise not to use this tool for malicious intends.
[BUY NOW!!!]
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Because I really find value in testing my OWN network.
Re: (Score:3, Insightful)
Because I really find value in testing my OWN network.
If you don't, then you don't really understand security.
The point is, these dictionaries are already available to the people with their evil bit set.
If you're going "nobody's going to figure out this password," especially if you're running a business, you really should be _making sure_ that nobody's going to figure it out, rather than going on faith.
Unless you have a multi-tens-of-millions word dictionary yourself, so you can make sure that your WPA passphrase isn't in it, you're not properly protecting you
Re: (Score:2)
You sound like a salesman, "for only $34 you can be sure that your network is secure".
Re: (Score:2)
Really. If you need to spend money to test if your password is secure. Its not. Get a better P@$sW0rD!. Otherwise Looks like I am finally getting FIOS!! lol.
Right, because it's so simple as just a password. We're not talking about your shitty residential ISP going to your moms basement hooked in to your DD-WRT router. We're talking about businesses who do their own internal audit on their network security. If $34 is all it would cost to make a point to your manager to approve infrastructure upgrade or serious changes, then that's well worth it.
You'd be very surprised how even a very complex password can be cracked with a dictionary attack, including "P@$sW0rD!"
Re: (Score:2)
You'd be very surprised how even a very complex password can be cracked with a dictionary attack, including "P@$sW0rD!".
What about: C5&}+6@.lf2^?5Im^j~~+:VBYWe>EPohr@j)R\cwVeb/tqrm,CQDGNk)4p2X=7{;12$?Kvppgx?OWd5*eR,APZxgX^g[/\Xi_t>mwL;tCu_wvIVV{F;V'h:QGOA.o__WU6K7-v'`&&"BbbdkpFs*0I0u$eB$L$m9^vM_P>1nALd%>rbNW`uCnCF'f{][uANt`a6N`n>fKS~c;Y6-!rKS4Mzom0GFOP_-{,&@X52lym:ttAFaR"Kc"oMRQ*^-(fKA;UT/[XXdV+aHO!&Lmk?9h'"D%zp]l\g1G{k$$9tw@w!gFTXoi>cwiW-c'KfG
Re: (Score:2)
Have fun remembering that off the top of your head.
Also, WPA2 passwords are limited to 256 bits, so the maximum length would be 64. Want a quick pseudo-random password? Type this into any bash prompt:
cat /dev/random | tr -dc [:alnum:][:punct:] | head -c64
Not reccomended for commercial application, but it'll keep that stupid kid next door from getting in.
Re: (Score:2)
Riiight. It does a dictionary attack on the password. Want to know if your wifi is secure against this? Does it have a dictionary word in it? Then no. Is it a random string? Then yes.
You can pay me now.
Re: (Score:2)
Re: (Score:2, Funny)
If their password appears in a dictionary, even one of 135 million words, then you could probably impress that client with shadow puppets, or blowing bubbles.
Re: (Score:2)
Maybe somebody might want to crack their neighbor's wifi now so you so can connect if they have an outage.
Re:One problem (Score:5, Insightful)
Alternatively you could actually not be an asshat, get on with your neighbour and negotiate with them (over a 6 pack of beer) to allow legal access in the event of an outage.
Re:One problem (Score:4, Interesting)
Living in fear must suck, huh? I have 4 open WiFi networks available to me at the moment (in a subdivision with 1/2-acre lots, not in a dense apartment complex). I've hopped onto a neighbor's network when my phone was out, and I have DHCP logs showing when they've been on mine. If I got hit with a subpoena, it'd be a piece of cake to show how many other people are using my router. That's a lot better approach for me and my neighbors than shutting each other out in a moral panic.
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2)
Contract? Lease? WTF are you talking about?
Re: (Score:2)
Re: (Score:2)
Having a way out of trouble doesn't negate the pain of getting in trouble in the first place. If someone does something naughty on your wifi, it's your computers who are getting confiscated, and you're paying for the lawyer to get it all back. Living in fear does suck, but that's the world we live in.
Re: (Score:2, Funny)
Any clued neighbor wouldn't be allowing others onto their wi-fi.
Considering my neighbour is hot, blonde and single, if she wants to use my connection to download pr0n I'm sure we can come to some sort of arrangement...
Re: (Score:2)
Considering my neighbour is hot, blonde and single, if she wants to use my connection to download pr0n I'm sure we can come to some sort of arrangement...
I told most of my friends to avoid using someone's connection because there's a lot of creeps out there who will probably intercept their information. Parent is a perfect example.
Re: (Score:2)
Nothing a trip to the coffe shop around the corner won't fix.
A friend of mine has a modified ThinkPad fitted with threee WiFi adapters (one IWL, one Atheroes with AP/bridge functionality, another Atheros for quick scanning and data dumps on multiple channels) with external high-gain antennas and basically the only thing that keeps him from having net access virtually everywhere is the CPU power to crack keys. Luckily for him, the biggest telecom around here gives out wireless routers with preset (permanentl
Re: (Score:3, Insightful)
Isn't it cheaper, easier, and less douchebaggy to just get an aircard?
Re: (Score:2)
Re: (Score:2)
Just wait for the iPhone app, so you can use your mobile connection to break into the faster wifi broadband.
Re: (Score:2)
SETI@HOME?
Just wonderin.....
Yo Grark
Re: (Score:2)
Re:400 CPU cluster or 400 node botnet? (Score:5, Informative)
Actually, in this case, it's very straightforward. He's using Amazon EC2. EC2 charges by the hour, and all you have to do is spin up the number of servers you want. In fact, I happened to run the numbers on what the costs are for running 50 "8-core" servers, and it happens to be...$34/hour. So, what he did was say, "If I run two jobs an hour, I make a small amount of money. If I run 4-5 jobs per hour, I make more money"
This is, of course, a textbook use case for EC2, and I'm surprised no one has done it sooner.
Re: (Score:2)
It [electricalchemy.net] has been, quite recently in fact.
Re: (Score:2)
Amazon EC2?
Re: (Score:2)
Re:Cloud? (not a) (Score:5, Interesting)
This kind of work (high computation, high parallelization, infrequent request) might be the most brilliant and non-obvious use of cloud computing. Low overhead due to using someone else's hardware (rather than having 400 CPUs laying around). If this is truely what they are doing, I am very impressed.
Re:Cloud? (not a) (Score:5, Interesting)
A medium 'high-cpu' linux instance at Amazon is $0.17/hr [amazon.com].
($0.17/hr) x (20min) x (400 instances) = $22.66666... +50% = exactly $34
Re: (Score:2)
That's far too short. "yourmomdrinksassmilk" would take longer brute force.
Question! (Score:2)
Will it help me break into my neighbours WiFi?
Re: (Score:2)
In that case ill change my computer name to something other than "Dan-PC"
Re: (Score:2)
Hah! Now that you've said that he knows that if the intruding computer's name is something other than Dan-PC it must be you! Unless that is what you want him to think! Hmm.
Re: (Score:2)
FTA: 20 minutes instead of 5 days.
If 360 people were using this system simultaneously,
There aren't that many idiots here. They're all at the mall.