News for hackers. Stuff that matters.

A comment on Hackers ship their exploits directly to their target’s mailroom.

Re:Hackers ship their exploits directly to their target’s ma... by jason0597 on Wednesday August 07, 2019 @01:03PM (#20636608)
>Once the warship locates a Wi-Fi network from the mail room or the recipient’s desk, it listens for wireless data packets it can use to break into the network. The warship listens for a handshake — the process of authorizing a user to log onto the Wi-Fi network — then sends that scrambled data over the cellular network back to the attacker’s servers, which has far more processing power to crack the hash into a readable Wi-Fi password.

Breaking a hash to obtain the Wi-Fi password? Surely this is impossible?

[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by Fabricio20 on Wednesday August 07, 2019 @01:11PM (#20636697)
Not really, this is a known "vulnerability" with WPA2 and has been demonstrated to work a lot of times.

https://www.aircrack-ng.org/doku.php?id=cracking_wpa#step_4_...

This is done completely offline once you have the handshake captured and can be easily scaled.

[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by austinheap on Wednesday August 07, 2019 @01:58PM (#20637167)
When I’ve been hired to do red teams we always use giant antennas and find a nice parking lot a few blocks away to capture the necessary handshakes. This works great even in downtown SF where the RF interference is absurd.
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by munk-a on Wednesday August 07, 2019 @02:26PM (#20637430)
Yea, this ^. This attack approach is interesting but any company that's serious about security needs to realize that anything opened up on wifi is a big hole - this used to be more amusingly exploited by war-driving, just driving around a neighborhood looking for someone with an open network that spills out into the street so you could download the latest episode of friends.

I don't work in this sort of security and it seems terrifying, the social engineering side is especially crazy.

[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by zeta0134 on Wednesday August 07, 2019 @02:49PM (#20637655)
I used to do this as a kid in rural Texas, when we could only afford dial-up at the house and my parents didn't let me on the network very often. Good times! I'm terrified of the prospect now, but back then I really appreciated all my neighbors who ran unsecured wireless networks named "linksys"
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by austinheap on Wednesday August 07, 2019 @03:14PM (#20637888)
The social engineering side is 100x the threat. Handshake brute forcing is a show pony trick.
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by gowld on Wednesday August 07, 2019 @02:11PM (#20637285)
Hacking obsolete protocols is shooting fish in a barrel.

Classy hackers hack modern protocols like WPA 3.

https://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#Dragonb...

[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by 867-5309 on Wednesday August 07, 2019 @02:23PM (#20637396)
which nobody uses yet. last time I checked around a month ago there was only one WPA3 on WiGLE.

there are next to nil WPA3 fish in the barrel yet.

[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by justsomeguy1 on Wednesday August 07, 2019 @01:13PM (#20636717)
My friend did this with his neighbor's wifi (with their permission of course) just to see if he could. He got trial access to some super computers in the Google cloud (sorry I'm not more specific, just recollecting what he told me) and was able to crack with that horsepower in a day or so.
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by dijit on Wednesday August 07, 2019 @01:54PM (#20637113)
Your friend probably used the GPU enabled instances, which are absurdly efficient at generating WPA2 hashes.
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by eswat on Wednesday August 07, 2019 @01:13PM (#20636718)
If the password is a predictable, low-length alphanumeric password it’s not going to take long for something like a multi-GPU machine with some dictionaries to break it.
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by edoo on Wednesday August 07, 2019 @02:35PM (#20637518)
Well for wpa2 the minimum is 8 characters and that is 2.6 days on the largest AWS instance at a peak cost of around $1560 if you got a PMK packet and about 50x longer if you don't.
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by mevile on Wednesday August 07, 2019 @03:02PM (#20637782)
Maybe with a separate cellular antenna the device could capture all of the wifi data, communicate it to a server with more processing power and possibly break it there and communicate it back to the device.
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by eswat on Wednesday August 07, 2019 @03:51PM (#20638208)
That’s actually what the device in the article does.

> The device, which cost about $100 to build, was equipped with a 3G-enabled modem, allowing it to be remote-controlled so long as it had cell service.

> The warship listens for a handshake — the process of authorizing a user to log onto the Wi-Fi network — then sends that scrambled data over the cellular network back to the attacker’s servers, which has far more processing power to crack the hash into a readable Wi-Fi password.

It’s not uncommon for red teams to do something similar: pull a bunch of ciphertext and hashes from the target network, ship them off to their GPU farm at the office, wait for results.

[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by scarejunba on Wednesday August 07, 2019 @01:11PM (#20636696)
Use Aircrack-ng. Doesn't require skill. The broken part is the handshake.
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by TheLastPass on Wednesday August 07, 2019 @01:10PM (#20636682)
If it's not a strong hash and the protocol doesn't include salting, it's not impossible. Rainbow tables exist. And they really only need to find a collision. Wi-Fi protocols, especially WEP, have had vulnerabilities similar to this before. Similar in the sense that if you sniffed enough traffic you could figure out the password (don't recall the specific mechanisms - but this could be one).
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by est31 on Wednesday August 07, 2019 @01:18PM (#20636767)
It's unfair to say that there is no salting. The PMK is derived from the WiFi network name (SSID) as well as the password [1]. The SSID acts as a salt here. Not perfect as SSIDs are often not unique, but it's certainly better than no salting at all.

[1]: https://www.ins1gn1a.com/understanding-wpa-psk-cracking/

[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by Scoundreller on Wednesday August 07, 2019 @01:45PM (#20637003)
So stupid they don’t use the MAC as the salt.
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by TheLastPass on Wednesday August 07, 2019 @01:57PM (#20637153)
I said "IF" there's no salting. In any case, I'd be less concerned about SSID's not being unique as I am about the fact that the SSID of a specific target is trivial to obtain and almost never changed.
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by est31 on Wednesday August 07, 2019 @02:12PM (#20637300)
> I'd be less concerned about SSID's not being unique as I am about the fact that the SSID of a specific target is trivial to obtain and almost never changed.

Salts don't need to be secret, only unique. In fact, in this case the unauthenticated client needs to be able to compute the PMK from the password alone, so you can't keep it on the AP.

[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by austinheap on Wednesday August 07, 2019 @02:00PM (#20637183)
This is why we have rainbow tables.
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by vntok on Wednesday August 07, 2019 @02:06PM (#20637238)
Rainbow tables don't work here because the password is salted.
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by hleach on Wednesday August 07, 2019 @02:50PM (#20637660)
A salt can't do it's job when it's reused.

There are WPA rainbow tables for common ssid's available online.

If your ssid is "Linksys" it takes only moments to look up a weak password.

[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by jki275 on Wednesday August 07, 2019 @01:08PM (#20636663)
There are numerous attacks to crack wifi hashes. In theory, a properly implemented hash should not be crackable -- but theory often does not match the real world.
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by Retr0spectrum on Wednesday August 07, 2019 @01:15PM (#20636748)
No, any hash will be crackable, it just depends on how fast.

A well designed authentication protocol shouldn't expose any hashes to be cracked in the first place.

[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by jki275 on Wednesday August 07, 2019 @01:54PM (#20637121)
Sure -- if you define the heat death of the universe as "how fast".
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by Retr0spectrum on Thursday August 08, 2019 @10:07AM (#20644695)
You can't guarantee that, and keep reasonable performance, if humans are generating the PSK
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by jki275 on Thursday August 08, 2019 @03:06PM (#20647528)
I agree, but you can certainly build a system where humans don't generate the key.
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by Retr0spectrum on Friday August 09, 2019 @03:37PM (#20657626)
Then how do humans share said key?

QR codes and NFC tags etc. are nice, but not supported everywhere.

[ Parent | on HN ]