Hackers ship their exploits directly to their target’s mailroom

Re:Hackers ship their exploits directly to their target’s ma... by eswat on Wednesday August 07, 2019 @01:13PM (#20636718)

If the password is a predictable, low-length alphanumeric password it’s not going to take long for something like a multi-GPU machine with some dictionaries to break it.

[ Parent | on HN ]

Re:Hackers ship their exploits directly to their target’s ma... by edoo on Wednesday August 07, 2019 @02:35PM (#20637518)

Well for wpa2 the minimum is 8 characters and that is 2.6 days on the largest AWS instance at a peak cost of around $1560 if you got a PMK packet and about 50x longer if you don't.

[ Parent | on HN ]

Re:Hackers ship their exploits directly to their target’s ma... by mevile on Wednesday August 07, 2019 @03:02PM (#20637782)

Maybe with a separate cellular antenna the device could capture all of the wifi data, communicate it to a server with more processing power and possibly break it there and communicate it back to the device.

[ Parent | on HN ]

Re:Hackers ship their exploits directly to their target’s ma... by eswat on Wednesday August 07, 2019 @03:51PM (#20638208)

That’s actually what the device in the article does.

> The device, which cost about $100 to build, was equipped with a 3G-enabled modem, allowing it to be remote-controlled so long as it had cell service.

> The warship listens for a handshake — the process of authorizing a user to log onto the Wi-Fi network — then sends that scrambled data over the cellular network back to the attacker’s servers, which has far more processing power to crack the hash into a readable Wi-Fi password.

It’s not uncommon for red teams to do something similar: pull a bunch of ciphertext and hashes from the target network, ship them off to their GPU farm at the office, wait for results.

[ Parent | on HN ]