HOWTO : Cracking WPA2 Passpharse Made Easy

Many people out there still think that cracking WPA2 passpharse requires dictionaries. However, it is not true.

You can brute force the WPA2 passpharse with the help of GPUs. Here is my discoveries on April 16, 2010 and May 22, 2011.



If the wifi router is equipped with WPS (Wifi Protected Setup) and it is enabled, to crack it is very easy with the tool namely reaver.



In additional, it is risky to use public wifi or public free wifi too. No matter they have passpharse or not. (Please refer to "See Also" for details) You are also be informed that there are some high power and long range wifi adaptors in the market.

Alfa Network produces some high power and long range wifi adaptors, such as Alfa AWUS036H and Alfa AWUS036NHR. They can connect to the vicitm's wifi router in the distance of 1KM+ away.

That's all! See you.

See Also :

HOWTO : Sniffing SSL with ettercap on Back|Track 5

HOWTO : Protect you from being ARP spoofing

Wifi is not 100% safe

There are several protections for wifi, they are WEP, WPA and WP2. WEP can be cracked easily. WPA and WP2 are also not safe recently no matter you are using AES or TKIP encryptions for your PSK. However, at least one client is connecting to the wifi router and your WPA/WPA2 key is in the dictionary (password list) of the cracker so as the cracker can crack WPA/WPA2-PSK.

Recommendation

(1) at least use WPA2-Personal with AES encryption for the key (most likely for home users) or use Captive Portal if any;
(2) keep your WPA/WPA2 key as long (the longest is 63 characters) and complicated as possible, it should includes capital and small letters, symbols and numbers (however, some devices may not recognize such length of the key);
(3) enable MAC address filter (if possible; but not quiet useful for higher security);
(4) do not use factory's WPS feature (or similar, e.g. QSS) as it is quiet danger for users but convenience for crackers;
(5) change your WPA/WPA2 key often; and
(6) use WPA2-Enterprise if possible (it is the highest security so far).

Be keep in mind that this settings may not be worked tomorrow. The world is changing very fast.

By the way, hidden BSSID and MAC address filter are useless as crackers can obtain such information very easy.

That's all! See you.