Re[2]: WPA-PSK audit

["Matthew Leeds" <mleeds () theleeds net>]

While one can Goole on 'crack WPA-PSK' and get lots of hits, and find many who assert that WPA-PSK can be cracked, it 
appears that the only real risk is a dictionary attack on the passphrase. While it's clear that a passphrase such as - 
password - would not be wise, and equally many suggest using something like - awgtp'wegu]-wep
bvpoqwt-qejgqapatjqqw-82wg][#$%UHW#&^#226w62@$T -, there is most likely a middle ground that would allow the use of a 
human memorizable phrase that is unlikely to be found in a dictionary list. I'd be interested in hearing from the list 
on the use of passphrases such as - Myfriendwants2havedinnerat42nighT - as it seems unlikely that a dictionary file 
would have arbitary combinations of words and numbers; but as I have little experience with either building or using 
such dictionary files I would like to hear from those who do.

I'd also like more information on where operating systems store a WPA-PSK passphrase and in what form they do so. While 
I'd normally take the position that once someone has gained access to the filesystem of a computer it's game over, in 
the case of a wireless network where one is trusting others (guests on a home network for example) there is a level of 
risk that they don't secure their system to the level one would hope for. A regular schedule of changing the passphrase 
would help to lower the risk in this case (fairly low anyway), but I'm always interested in more info.

----------
---Matthew
*********** REPLY SEPARATOR  ***********

On 1/4/2008 at 12:38 PM kevin horvath wrote:

> various tools can be used to attack wpa-psk such as aircrack-ng,
> cowpatty, and Cain & Abel.  All of these tools use a dictionary attack
> as Josh mentioned using the SSID as sort of a salt.  The ability to
> crack it depends upon your dictionary list and the strength of
> passphrase itself.  The time it takes to crack the psk (if you do have
> it in dictionary) depends on your computing resources and where it is
> in your dictionary file.  To help speed this up you can use cowpatty
> and the pre hashed files from the church of wifi or generate your own
> off your own dictionary file.  You will have to do the latter if the
> SSID you are auditing is not in the top 1000 ssids from wiggle anyways
> (as that is what was used to precompute the churche of wifis prehashed
> files).  One alternative to this is using Cain&Abel to do a brute
> force attack but this can take anywhere from a few hours to a few
> years (your mileage may vary).
>
> As Josh mentioned if an enterprise uses wpa-psk then that is a finding
> in itself since it is a shared key.  On assessments I like to watch
> for probing clients to see if they are looking for default ssids and
> then turn my ubiquiti card (or real ap) into ap mode with the default
> ssid they are probing for and wait for them to connect to me (which
> the wireless zero in windows does automatically).  I then have a peer
> to peer connection to then and then try to hack the laptop itself.
> Once I can do that I can pull any wpa-keys or wep keys for any aps
> they have in there preferred list.  With that said I dont even need to
> crack wpa itself just find an alternative way of getting the PMK.
> This is also a good way of attacking wpa(2) enterprise as you can
> steal client certificates and such this way.
>
> Kevin
>
> On Dec 28, 2007 9:05 PM, Joshua Wright <jwright () hasborg com> wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > > I'd like to know of any existing tools designed to test the WPA-PSK
> > > security mode. I know it's more secure than wep with TKIP and so on but
> > > I wonder if there are any tools that are able to crack the WPA key
> > > within a reasonable time limit - 2-3 hours? Any ideas and suggestions
> on
> > > WPA security will be appreciated.
> >
> > I think it is unlikely that dictionary attacks will be effective against
> > WPA/WPA2-PSK networks, as long as the passphrase is reasonable and not a
> > dictionary word.  That said, WPA/WPA2-PSK is not a suitable
> > authentication mechanism for enterprise networks.  Since the PSK is
> > shared among all stations on the wireless network, every user with a
> > workstation that has the PSK could conceivably know the PSK and share it
> > with anyone else.  Further, a stolen device could disclose the PSK for
> > the network, compromising all later data exchanges.
> >
> > - -Josh
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.4.7 (Darwin)
> >
> > iQIVAwUBR3WrfTWX3FIa1TkuAQIvbw//dCJMf/8GZTwUVmxN2uTSgyCM+vMCw8n4
> > VedAtIw5bOGWNcMkL/jNrPd50S99HlWJfd6+7KDB94WQZ8r8Z51XCeS5X7aVOYED
> > BVQ/SWTlgrJalUlgqCmsc1/k6dMzf+MSP5FKk4hE/nxLKxwSe4/AIxP7BZ4hgq3x
> > mBDOMo2YC62LA21jM1ozmKXCKnfjzxufpTlUjrTnWc2V/boc83eWnGuxkTfMqmCw
> > c+UhalVs/bCIQ1IvnxzW6GVzAPf/OLJO1FFXhXqGOW31Kpya4ce5nmoyCY7ngUm4
> > YtdRD67fbU6wgdfsoDjQFZyQ7nPzPS1XQoDYJdbsunmVZwTR2BCdpzY42VE7tK0H
> > ERQA7jSgfwKv15P1BPbkpOgNDMOjxrUYaZj8vdca6/5505XI0cmmqnG1U0g/SXHs
> > 0SQ97I7ZyW+T74vDt1nxlerwThKCztGXpcfVJTZsVnXcs1+jlhsVvT0nIM6F+8Rn
> > Aw8EaIQT4DLIWQXWcKerUv0Pq6E4hCTzlgI2MOXE+9/cBYVhqKF6AHNQDklN0ITc
> > QB+u7+lwup0KjgJGWpWQo0gvpuA5i0LjavanmVPQca9iCq3Mt9Z1ZddYrAxVYQPx
> > moBpbty6h62tPFws0MOvjjesy1cA1QviEymN/qKnUb3gTOVpK/EIDW8v0zS680Sz
> > 4cMyUdCfe1I=
> > =Zaw0
> > -----END PGP SIGNATURE-----
> >
> >
> > ------------------------------------------------------------------------
> > This list is sponsored by: Cenzic
> >
> > Need to secure your web apps NOW?
> > Cenzic finds more, "real" vulnerabilities fast.
> > Click to try it, buy it or download a solution FREE today!
> >
> > http://www.cenzic.com/downloads
> > ------------------------------------------------------------------------
>
> ------------------------------------------------------------------------
> This list is sponsored by: Cenzic
>
> Need to secure your web apps NOW?
> Cenzic finds more, "real" vulnerabilities fast.
> Click to try it, buy it or download a solution FREE today!
>
> http://www.cenzic.com/downloads
> ------------------------------------------------------------------------




------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------