News for hackers. Stuff that matters.

A comment on Hackers ship their exploits directly to their target’s mailroom. Parent comment

Re:Hackers ship their exploits directly to their target’s ma... by TheLastPass on Wednesday August 07, 2019 @01:10PM (#20636682)
If it's not a strong hash and the protocol doesn't include salting, it's not impossible. Rainbow tables exist. And they really only need to find a collision. Wi-Fi protocols, especially WEP, have had vulnerabilities similar to this before. Similar in the sense that if you sniffed enough traffic you could figure out the password (don't recall the specific mechanisms - but this could be one).
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by est31 on Wednesday August 07, 2019 @01:18PM (#20636767)
It's unfair to say that there is no salting. The PMK is derived from the WiFi network name (SSID) as well as the password [1]. The SSID acts as a salt here. Not perfect as SSIDs are often not unique, but it's certainly better than no salting at all.

[1]: https://www.ins1gn1a.com/understanding-wpa-psk-cracking/

[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by Scoundreller on Wednesday August 07, 2019 @01:45PM (#20637003)
So stupid they don’t use the MAC as the salt.
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by TheLastPass on Wednesday August 07, 2019 @01:57PM (#20637153)
I said "IF" there's no salting. In any case, I'd be less concerned about SSID's not being unique as I am about the fact that the SSID of a specific target is trivial to obtain and almost never changed.
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by est31 on Wednesday August 07, 2019 @02:12PM (#20637300)
> I'd be less concerned about SSID's not being unique as I am about the fact that the SSID of a specific target is trivial to obtain and almost never changed.

Salts don't need to be secret, only unique. In fact, in this case the unauthenticated client needs to be able to compute the PMK from the password alone, so you can't keep it on the AP.

[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by austinheap on Wednesday August 07, 2019 @02:00PM (#20637183)
This is why we have rainbow tables.
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by vntok on Wednesday August 07, 2019 @02:06PM (#20637238)
Rainbow tables don't work here because the password is salted.
[ Parent | on HN ]
Re:Hackers ship their exploits directly to their target’s ma... by hleach on Wednesday August 07, 2019 @02:50PM (#20637660)
A salt can't do it's job when it's reused.

There are WPA rainbow tables for common ssid's available online.

If your ssid is "Linksys" it takes only moments to look up a weak password.

[ Parent | on HN ]