2. Modern Approaches to Wi-Fi Attacks: Attacker View BY KONRAD JĘDRZEJCZYK

3. Whoami Certified Offensive Security Wireless Professional (OSWP) Information Security Incident Response Analyst Previously: Infrastructure Risk Analyst Security Incident Manager Information Security Forensic Expert WHOAMI 3

4. Agenda WPA/WPA2 – is the hashing algorithm so insecure as we are led to believe? WPS – Weakest Possible Security approach OpenWRT = Wormhole attack + MitM +3G We're in! What next? AGENDA 4

5. WPA/WPA2 Connection WPA/WPA2 – IS THE HASHING ALGORITHM SO INSECURE AS WE ARE LED TO BELIEVE? 5

6. WPA/WPA2 Connection WPA/WPA2 – IS THE HASHING ALGORITHM SO INSECURE AS WE ARE LED TO BELIEVE? 6

7. Basic Package WPA/WPA2 – IS THE HASHING ALGORITHM SO INSECURE AS WE ARE LED TO BELIEVE? 7

8. Airodump-ng OPENWRT WILL TURN CHEAP HARDWARE TO YOUR BEST WIFI CARD 8

9. Airgraph-ng 9

10. 10

11. X = C n Where: X - Number of combinations C - Number of characters in a charset n - Password range (>=8) Example: 8 char lowercase alpha [a-z or (not and) A-Z] = 26 8 = 208827064576 Example for Radeon HD6850 OC (49 kH/sek) WPA/WPA2 Password Entropy WPA/WPA2 – IS THE HASHING ALGORITHM SO INSECURE AS WE ARE LED TO BELIEVE? 11 nCharsetTime Single R290 (~140 kH/s) 8[0-9] = 1012 minutes 8[a-z] or [A-Z] = 2617 days 8[a-z + 0-9] or [A-Z + 0-9] = 36233 days 9[a-z] or [A-Z] = 261 year and 83 days 9[a-z + 0-9] or [A-Z + 0-9] = 3623 years 8a-z + A-Z + 0-9 = 6250 years 12 x R270 (12 x ~100 kH/s) 8[a-z] or [A-Z] = 262 days 8[a-z + 0-9] or [A-Z + 0-9] = 3627 days 9[a-z] or [A-Z] = 2652 days Single i5 CPU (~3,3 kH/s) depending on version 8[a-z] or [A-Z] = 262 years and 1 month

12. WPA/WPA2 Entropy in Practice WPA/WPA2 – IS THE HASHING ALGORITHM SO INSECURE AS WE ARE LED TO BELIEVE? 12

13. WPA/WPA2 Entropy in Practice WPA/WPA2 – IS THE HASHING ALGORITHM SO INSECURE AS WE ARE LED TO BELIEVE? 13 paulinaPaulinapaulina!Paulina!Paulina!@#,(15011, 'andziulka19994', PaulinA!@#,(15024, 'mariusz22', paulina0Paulina0paulina0!Paulina0!PaUliNa0!,(15003, 'demiano7' paulina1Paulina1paulina1!Paulina1!P@ulin@1!,(15004, 'Lampka', (...) Paulina2o15!,(15005, 'paradyne', paulina9Paulina9paulina9!Paulina9!paulinA1989!,(15006, 'darek1054', paulina!-!,(15007, 'bandzior2911' paulina10Paulina10paulina10!Paulina10!paulina19890101,(15008, 'Ruthless blade', paulina11Paulina11paulina11!Paulina11!89Paulina!,(15009, 'SzYbKi', (...) 1paulina1,(15023, 'aramil23', paulina99Paulina99paulina99!Paulina99!PaUlInA,(15012, 'kasiq10',.paulina,(15013, 'diabelskapam' paulina1970Paulina1970paulina1970!Paulina1970!paulinapaulina,(15014, 'Janosik_13', paulina1971Paulina1971paulina1971!Paulina1971!KonradPaulina,(15015, 'Sztukens', (...) !!!PAULINA!!!,(15016, 'superrolnik', paulina2016Paulina2016paulina2016!Paulina2016!PaulinaDefCamp,(15017, 'Henry102', Real passwords from stolen and publicly available sql file: www.pobieramy24.pl.sql

14. Any Help? WPA/WPA2 – IS THE HASHING ALGORITHM SO INSECURE AS WE ARE LED TO BELIEVE? 14

15. Don’t Underestimate the “Luck Factor” http://zaufanatrzeciastrona.pl/wp-content/uploads/2014/02/superbowl.jpg 15

16. Possible Safeguards Use non-standard passwords that are not present in password lists – force them to a brute-force Think before creating a password WPA/WPA2 – IS THE HASHING ALGORITHM SO INSECURE AS WE ARE LED TO BELIEVE? 16

17. First described by Stefan Viehbock. “When poor design meets poor implementation.” Still, there is only 11,000 possible combinations. reaver -i mon0 -b 0A:0B:0C:0D:0E:0F WPS – WiFi Protected Setup WPA/WPA2 – IS THE HASHING ALGORITHM SO INSECURE AS WE ARE LED TO BELIEVE? 17

18. Currently Implemented Safeguards Limiting the number of attempts that can be made in a given timeframe Using a different PIN for every pairing attempt Limiting the pairing time Disabling WPS …however, there is a good chance that it will be disabled only in web api… WPA/WPA2 – IS THE HASHING ALGORITHM SO INSECURE AS WE ARE LED TO BELIEVE? 18

19. OpenWrt – Tool for Attacker OPENWRT = WORMHOLE ATTACK + MITM +3G 19

20. OpenWrt – Tool for Attacker http://wiki.openwrt.org/toh/start OPENWRT = WORMHOLE ATTACK + MITM +3G 20

21. Call to Arms OPENWRT = WORMHOLE ATTACK + MITM +3G 21

22. Post-Analysis OPENWRT = WORMHOLE ATTACK + MITM +3G 22

23. Post-Analysis OPENWRT = WORMHOLE ATTACK + MITM +3G 23

24. airodump-ng airbase-ng airdecap-ng airmon-ng aireplay-ng airserv-ng tkiptun-ng sslstrip tcpdump ettercap … screen OpenWrt – Everything You Need OPENWRT = WORMHOLE ATTACK + MITM +3G 24

25. Classic MitM Attack OPENWRT = WORMHOLE ATTACK + MITM +3G 25

26. Social Engineering Toolkit WE'RE IN! WHAT NEXT? 26

27. When We Want More: Hydra WE'RE IN! WHAT NEXT? 27

28. http://3.bp.blogspot.com/ …or… WE'RE IN! WHAT NEXT? 28

29. ...and then: WE'RE IN! WHAT NEXT? 29

30. What Can We Do about This? WE'RE IN! WHAT NEXT? 30

31. What Can We Do about This? WE'RE IN! WHAT NEXT? 31 http://www.aliexpress.com/item-img/Wi-Fi-Rm-Pro-Smart-home-Automation-Intelligent-Controller-Wireless-Smart-Remote-Controller-For-iPhone-6/32270548754.html

32. WE'RE IN! WHAT NEXT? 32

33. Thank You Q&A 33