Time to change that default WiFi password

[Fogdude]

Yes, the Evil Twin is a tough one. I wouldn't fall for the password phish, but if the Evil Twin gets in...

That's why I use hard wired access at home. I even have guests who bring their computers use a hard wire, rather than wireless. Phones & tablets are the only exceptions, which do leave the opening.

[Pip]

Hard wired with wireless turned off is the obvious safest route Foggy but, in the real world there's more and more wireless devices that people are using. Mobile phones, apps on mobile phone to connect to devices in home while you are away etc.

Wireless connectivity is what people expect now most aren't aware of how vulnerable that "ease of use" can leave them - until something happens. Then they blame anyone but themselves. Hey-Ho that's the world today, it's always someone else's fault. "Where there's blame there's a claim". So sad a reflection on society.

Anyhow, I couldn't get back to this thread earlier as promised as the old congestion issues kicked in over the weekend and when I could I was limited due to other commitments I have.

I've to nip out for about 4 hrs then I have a little project to do for our Little Owlet and then I will finally post what I promised. Althogh with you it's like teaching your grandmother to suck eggs!

[Fogdude]

Hey, I'm always up for a refresher course.!

[Pip]

Being busy with other things ATT I never got around to finishing this thread but here we go.

First I'll show you this standard crack time with default passwords from a site that offers to do it for you (at a small cost) as long as you supply the handshake .cap file. For obvious reasons thae screenshot doesn't show which site.

Crack Time.png (17.93 KiB) Viewed 12068 times

As you can see the list is not exhaustive but should certainly open your eyes. The reason it is so quick not is not just new generation CPU's and GPU's but Hashcat (I mentioned earlier in the thread) has now been unified. At one time you either used Hashcat and your CPU or OCLHashcat and your GPU, with the new Hashcat you now can use use both at the same time and syncronised!

I won't go into any further detail on that as it's unnecessary, you already get the idea. So now how to secure your WiFi password.

Let's look at the standard for router passwords. By default most (not all) router producer ships with their standard format of either 8 lower case/uppercase/numeric or a combination of them. This is merely for ease of production.

The router though can have it's password changed with anything from 8-64 of the above plus special characters (punctuation,space,@ etc).

So, how do we make it harder for the cracker to get the password? Simple we just increase the time it would take. So, how do we do that?

First what you have to understand is that a hacker won't spend as much time trying to hack a residential connection as they would a business one, it's just not worth it. They would spend more time on the business/corporate one for different reasons.

A lot of so called "experts" say use a passphrase. I agree to an extent but even that can be cracked quicky using a mask dictionary attack in Hashcat (I'm not going into detail on that) but the cure is on the same lines. What you have to do is fool the dictionary attack which uses spaces as well as words.

Consider this passphrase, I love strawberries that's a password of 15 including spaces. Won't take long with a dictionary attack with a mask . So how can we change it to make it harder. How about 1 l0v3 5tr@wB3rr135 all of a sudden the dictionary attack won't work without rules to be applied to substitute numbers and special case for letters.

Now imagine a passphrase of 30+ using the above format (or any you choose which you can remember). Unless you succumb to social engineering they won't have the time nor inclination to target you any more. It's as simple as that.

[chouette]

That's a frigging long password to remember with all these combinations, lol

[Pip]

You don't need to use all those combinations. Just use a phrase and change whichever characters you wish as long as it is at least 2.

[Pip]

UPDATE

As I said earlier I'm involved on the ethical side of things in a small way.

We are are presently testing a platform that currently (not at full speed) can make 1.700.000 guesses at any password per second!

That would mean that a standard 8 letter (same case) ISP router password would only take a maximum of 36 hrs to find.

Just saying.

A ray of hope for you though, a passwrord made up of 10 letters including 1 capital letter and 1 number would at a rate of 10.000.000 guesses per second take 256 days to crack. Who's going to bother with poor old you at that rate?

[chouette]

I'm thinking not many would bother, lol

[Pip]

Further to my last post, still not at full speed but with a few tweaks here's where we are so far.

This is taken after 5mins runtime.

CCAgent.png (5.72 KiB) Viewed 11996 times

That's just over 13 hours for an 8 letter same case password.

EDIT As it happens we got lucky with this one as it turned out to be within 25% of the total keyspace and was cracked in 3hrs 45mins.

[Fogdude]

Just rename your WiFi router to "FBI Surveillance". Nobody will be trying to get into it again.

[Pip]

Just rename your WiFi router to "FBI Surveillance". Nobody will be trying to get into it again.

Funnily enough I was working in an area of Norwich (UK) where there was an SSID of "Survailance Van". It didn't bother me though I was just working there.