Jens “atom” Steube, the developer of the popular Hashcat password cracking tool recently developed a new technique to obtain user credentials over WPA/WPA2 security. Here, attackers can easily retrieve the Pairwise Master Key Identifier (PMKID) from a router.
WPA/WPA2, the Wi-Fi security protocols, enable a wireless and secure connection between devices using encryption via a PSK(Pre-shared Key). The WPA2 protocol was considered as highly secure against attacks. However, a method known as KRACK attack discovered in October 2017 was successful in decrypting the data exchange between the devices, theoretically.
Steube discovered the new method when looking for new ways to crack the WPA3 wireless security protocol. According to Steube, this method works against almost all routers utilizing 802.11i/p/q/r networks with roaming enabled.
We've developed a new attack on WPA/WPA2. There's no more complete 4-way handshake recording required. Here's all details and tools you need: https://t.co/3f5eDXJLAe pic.twitter.com/7bDuc4KH3v
— hashcat (@hashcat) August 4, 2018
How does this new WPA/WPA2 attack work?
The new attack method works by extracting the RSN IE (Robust Security Network Information Element) from a single EAPOL frame. RSN IE is an optional field containing the PMKID generated by a router when a user tries to authenticate.
Previously, for cracking user credentials, the attacker had to wait for a user to login to a wireless network. They could then capture the four-way handshake in order to crack the key.
However, with the new method, an attacker has to simply attempt to authenticate to the wireless network in order to retrieve a single frame to get access to the PMKID. This can be then used to retrieve the Pre-Shared Key (PSK) of the wireless network.
A boon for attackers?
The new method makes it easier to access the hash containing the pre-shared key, which needs to be cracked. However, this process takes a long time depending on the complexity of the password.
Most users don’t change their wireless password and simply use the PSK generated by their router.
Steube, in his post on Hashcat, said,”Cracking PSKs is made easier by some manufacturers creating PSKs that follow an obvious pattern that can be mapped directly to the make of the routers. In addition, the AP mac address and the pattern of the ESSID allows an attacker to know the AP manufacturer without having physical access to it.”
He also stated that attackers pre-collect the pattern used by the manufacturers and create generators for each of them, which can then be fed into Hashcat. Some manufacturers use patterns that are too large to search but others do not. The faster one’s hardware is, the faster one can search through such a keyspace. A typical manufacturer’s PSK of length 10 takes 8 days to crack (on a 4 GPU box).
How can users safeguard their router’s passwords?
- Creating one’s own key rather than using the one generated by the router.
- The key should be long and complex by consisting of numbers, lower case letters, upper case letters, and symbols (&%$!)
Steube personally uses a password manager and lets it generate truly random passwords of length 20 – 30. One can follow the researcher’s footsteps in safeguarding their routers or use the tips he mentioned above.
Read more about this new WiFi security attack on Hashcat forum.
Read Next
NetSpectre attack exploits data from CPU memory
Cisco and Huawei Routers hacked via backdoor attacks and botnets
Again proving the point that forcing a user to add letters, uppercase, lowercase and special characters to a password are POINTLESS! If anything, that makes a password LESS secure because the possible total combinations are fewer. As a hacker, I’m not going to bother scanning anything that only uses just letters. Thanks for making my job easier!
What you want is a very LONG passphrase. Not a password! It doesn’t matter what is in it. What matters is that it’s over 30 characters. I don’t care what it is, once you start exceeding 30 characters, my job of cracking your password just became next to impossible.
Do you get it? If you do, you already know more than most security “experts”.
I am glad you put forth this point to our readers. Thank you, Hawk, for this amazing insight.