161 Comments

• Digg
• Bury

One of them may have created WPA sonny boy.

Get off my lawn!

• Reply

• Digg
• Bury

Changing wireless from skynet to 8===D~~~(_*_) thank you good sir.

• Reply

• Digg
• Bury

Mine was B=====D~~~({}) before my girlfriend made me change it.

• Reply

• Digg
• Bury

i did the same thing. there are a bunch of girls in my complex in apt 8, so i would put up

8=====D~~~ apt8

• Reply

• Digg
• Bury

I named mine 'Virus Infection'.

• Reply

• Digg
• Bury

That actually does very little to protect yourself. Wifi sniifers can still figure it out given a little time.

• Reply

• Digg
• Bury

Well what's the fun in that?


Mine is ihaveAIDS

• Reply

• Digg
• Bury

While I didn't know that at the time of my post and learned it while reading the comments further down the page, I'm pretty sure 99.9999% of people in retirement homes fit the 'casual user' profile pretty well.

• Reply

• Digg
• Bury

Before I get slammed, I said EASY. Cracking the WPA key and then listening for an authentication and spoofing the address isn't super easy, though some might think so. In any event, it's an additional hurdle regardless of how low you think it is.

• Reply

• Digg
• Bury

This is what I do. Anyone with the know how to get past a hidden SSID, WPA key and spoof a mac address is gonna get in any home network.

• Reply

• Digg
• Bury

"In this paper, we demonstrate the weakness of current storage mechanisms by showing the following
attacks: first, we show how an attacker can remotely locate and break into a Wifi network
by crafting a malicious web page that targets its access point. Secondly, we demonstrate how an
attacker can inject a malicious library that is capable of compromising subsequent SSL sessions by
leveraging the fact that websites trust external javascript libraries, such as Google Analytics. We
then describe how to easily fool the user into accepting this malicious javascript library by exploiting
browser UI corner cases. Next, we introduce frame leak attacks that are capable of extracting
private information from the website (and not from the user) by leveraging the recent scrolling
technique of Stone. Our frame leak attacks defeat click-jacking defenses that have previously been
considered secure. In addition, we illustrate how a frame leak attack works by demonstrating how
to use it to extract Facebook profile information, bypassing Facebook’s framebusting defenses
in the process. Finally, we develop a new attack called tap-jacking that uses features of mobile
browsers to implement a strong clickjacking attack on phones. We show that tap-jacking on a
phone is more powerful than traditional clickjacking attacks on desktop browsers, and thus imply
smartphones should not be considered a secure form of data storage."

From BlackHat 2010

https://media.blackhat.com/bh-us-10/whitepapers/Bursztein_Gourdin_Rydstedt/BlackHat-USA-2010-Bursztein-Bad-Memories-wp.pdf

• Reply

• Digg
• Bury

It is not hard to generate a rainbow table for a given SSID. Creating a table from a wordlist of 1 million words takes < 3 hours on my 2.5 GHz core 2 duo.

• Reply

• Digg
• Bury

The purpose of a rainbow table is so you don't have to bruteforce generate a wordlist. If you are going to bruteforce generate anyway you may as well just brute force the key.

• Reply

• Digg
• Bury

The problem with turning off SSID broadcasting: It makes your network harder for YOU and the casual wireless leecher down the street to find, but not a hacker. Your router broadcasts your SSID five different ways. Turning off SSID broadcasting disables ONE of those, still leaving the other four. A dedicated hacker will still be able to easily locate it.

It's the same thing with turning down your router's signal strength. Any hacker will have a more powerful WiFi antenna than your computers will, so it's a waste of time.

• Reply

• Digg
• Bury

This I did not know: "broadcasts your SSID five different ways"

Thanks!

*scurries off to bone up on SSID broadcasting*

• Reply

• Digg
• Bury

Buried for lack of competence regarding SSID Broadcasting.

• Reply

• Digg
• Bury

Finding the name of a hidden SSID is as easy as deauthenticating a client ;)

• Reply

• Digg
• Bury

Thanks for pointing that out. I'm stuck using WEP because my DSlite only supports WEP. Why did Nintendo do that?

• Reply

• Digg
• Bury

When I worked back at Dell, I remember one memorable call from someone with an unsecured Wifi network. Someone was not only leeching, but they had actually gone into his router's settings, changed the admin password, then locked his MAC address out! Needless to say, the "hold Reset Button 15 seconds to nuke the router's settings" was a lifesaver.

I'm not saying one incident is emblematic of everyone, but it DOES happen...

• Reply

• Digg
• Bury

I can't say I haven't been tempted to do the same, but I think most of us refrain, particularly if we are using their internet connection.

• Reply

• Digg
• Bury

@ RaiderDuck. I did that a few times just because I was bored.

• Reply

• Digg
• Bury

@RaiderDuck
I had a similar situation. A while ago I had a belkin router that would occasionally reset all settings on me. I booted up and it didn't connect automatically. I saw a belkin router unsecured so I connected and set up encryption and MAC address filtering. It wasn't until later that day I noticed two belkin APs. As it turns out mine had been working fine and I had accidentally encrypted my neighbor's wi-fi. I changed all the settings back to the way they were but it is a good example of why people should use encryption.

• Reply

• Digg
• Bury

One of our employees had that happen to him as well, took me a little time to figure it out, but when I did at least it was an easy fix and I spent some time explaining basic network security, which was basically just "Set a password with WPA2 encryption".

I've changed people's network names while at school, but never messed with them beyond that.

• Reply

• Digg
• Bury

Here we go again.

No one said don't protect yourself with whatever means you have available.

And don't give me that pathetic kidding porn/torrent s**t. You're not succeeding at sounding like you know what the hell you're talking about.

The point is you guys blow it out of proportion. The idea that the average person is so incredibly susceptible to having their wireless connection broken into is preposterous. Protect yourself of course. But the fact is, the odds are so immensely low and unlikely that these ridiculous points about how you should spend hundreds of dollars on pointless equipment are asinine.

Do you want to protect yourself? Use the protection that every wireless router provides and odds are that you will be absolutely fine. Cut the stupid "design your home network like an enterprise network" nonsense.

• Reply

• Digg
• Bury

Good grief.

I'm not saying, "design your home network like an enterprise network." People do say that and yes, I agree that it's ridiculous. Corporate-level hackers are going to be much more interested in a bank network or something with thousands of bank account numbers than your own little checking account.

HOWEVER: there is no reason not to use common sense. WPA2 takes no more work than WEP, yet it's much more secure.

I'm not talking about spending $$$ on equipment. I'm sitting here with a Linksys WRT54GL router that cost approx. 50 bucks, with Tomato firmware flashed on it, and I feel my network is fairly secure. I still do regular checks to make sure it's not broken into.

The problem is, I see people get TOO secure. Someone could read this article and come away thinking that WEP and MAC address filtering will secure their network. Wrong.

Finally, I have seen situations where people got into serious trouble (or at least were on the cusp of it) because of things that were happening on their unsecured network. So please do not pretend that it doesn't happen, because it does. You could probably leave your brand-new car parked on the street every night for a year and never have it ripped off. Does that mean you're going to? No.

• Reply

• Digg
• Bury

I said use whatever means you have available. That means if your router supports WPA2. Use it. That is obviously what I meant. All wireless routers these days come with more than WEP. The average user does not know the difference and won't even touch, nor have a clue how to access the settings.

You may not have been talking about spending hundreds of dollars on equipment, but plenty here have used it as their primary point.

WEP and MAC filtering may not be the BEST, but it is SUFFICIENT. Only WEP would be more than sufficient for most people. It is an incredible deterrent. Especially if you live in a small rural area. The situation changes depending on where you live, but even if you live next to the Empire State Building, WEP wouldn't be a disaster. It may not make incredible sense, but by using it, you're protecting yourself with up to 98% certainty.

I doubt you've "seen" people get into serious trouble. You've read it on the Internet or heard it on the news. This isn't 1975. If someone gets stabbed, you're probably going to be able to read about it. It doesn't mean the odds of it happening have increased incredibly.

• Reply

• Digg
• Bury

i agree with chrismgtis, i am in no way telling the truth by saying i can hack any wireless network. but what i do know is this. The amount of people out there that can break into a wep network is small, the amount that can break into a wpa2-psk network is smaller. The point is is that you need to do something to make them say to them selves, "i am gonna look for an open network," and if he sees one that has wep on it. there is an even greater chance that nothing will happen to it. its like if you go to the store and you look at the sensor tags on products, you will be a fool if you think that stops theft, It asks like a deterrent and the thief MIGHT not steal it.

• Reply

• Digg
• Bury

wow, you guys all don't know what you're talking about. if someone is trying to break into your computer seeing wep isn't going to stop them at all. the MOST wep is going to do is keep people off your network who just want to leech your internet connection. People can just drive by your house, crack wep in 5 seconds, run a portscan in less than a minute then exploit some new vulnerability in some software listening on your network and install some software to monitor your web traffic and report it back to some site or botnet and obtain your personal data (cc, bank account, etc). It really does happen more often than you'd expect and its much easier to do than trying to break into some "corporate network." Routers are good because they provide a firewall for users but at the same time they make people feel more secure forgetting about it being so much easier for people to get on your local network if you have wireless.

• Reply

• Digg
• Bury

Awesome site. A little overkill if you use the entire 64-character string, but cool nonetheless.

• Reply

• Digg
• Bury

Unless you get the Nintendo WiFi Adaptor, and good luck finding one.

I think the DSi finally has WPA2 support, no?

• Reply

• Digg
• Bury

I'm not sure why you were buried. Here's a quote straight from Nintendo:

"The Nintendo DS is not compatible with the WPA method or any other methods of security other than WEP."

http://www.nintendo.com/consumer/wfc/en_na/customersupport/glossary.jsp

• Reply

• Digg
• Bury

@RaiderDuck:

Yes, the DSi supports WPA and WPA2. See the last page of this PDF:

http://www.nintendo.com/consumer/downloads/DSi_English.pdf

• Reply

• Digg
• Bury

I saw the WiFi adapter in a store just the other day....actually I see it quite often, I didn't think it was that hard to find.

• Reply

• Digg
• Bury

Thankfully my DLink allows you to create a "guest" network. So I have my main network secured with WPA2 encryption, then my guest one with WEP. They're treated as separate networks that can't talk to each other. Then in addition I blocked all internet access to all non-whitelisted MAC addresses. It's not perfect. Someone could spoof a mac and break into the WEP from free wifi, but the odds of that are slim, and then at least he doesn't have access to the rest of my network. Plus if I think of it (I usually don't) I can just turn off the guest network when not using my DS, and turn it back on as needed and never have to worry about it interfering with my main wireless network.

• Reply

• Digg
• Bury

The aircrack suite has the ability to force an AP to rapidly generate vulnerable packets even if there are no clients associated with it. I don't know if that works on ad-hoc networks, but I thought I'd mention it.

• Reply

• Digg
• Bury

@sparrowkc: I know that since I've used aircrack before, but our computers were not even on long enough for aircrack to generate a significant amount of packets. Even if someone were able to hack my local hotel-room network, they wouldn't have been able to do anything they couldn't otherwise do with the free hotel network. All my data was sent (encrypted) over openvpn through my home network, and cracking the WEP would've accomplished nothing since all the computers were properly firewalled and updated. Maybe a superhacker with a 0-day exploit could've done something, but how likely is that? He'd have to be very lucky to succeed in this attack and he'd be rewarded with nothing. Locking your door is sometimes useful, even though it's still possible to bash it open.

• Reply

• Digg
• Bury

I most certainly did read the article. The article discusses WEP first and does not, IMHO, emphasize its weaknesses nearly enough. A lot of computer users aren't even going to know what "hexadecimal," "algorithms" or even "encryption" even mean.

Down further in the article, the step-by-step instructions mildly state that WPA or WPA2 would be preferable to WEP. Again, WEP's unsuitability as anything more than a "Hands Off" sign should have been stated much more clearly.

Using WEP to secure your wireless network is like putting the cheapest padlock and cable you can find on your expensive 15-speed bicycle. Does it tell people that you don't want anyone touching it? Yes. Will it prevent anyone with the simplest of tools or knowledge from doing so? No.

• Reply

• Digg
• Bury

@ RaiderDuck, RE: ".. The article discusses WEP first and does not, IMHO, emphasize its weaknesses nearly enough. A lot of computer users aren't even going to know what "hexadecimal," "algorithms" or even "encryption" even mean."


Actually, the article covered WEP from the point of view of being historically the earlier versions of trying to protect wireless traffic.

And the article can't get any clearer in explaining how WEP is weaker as a form of protection.

FTA :
".. is no longer recommended for wireless encryption because of weak algorithms that can lead to the encryption scheme being easily broken. "

• Reply

• Digg
• Bury

Not all wireless software will accept non-alphanumeric characters. So, you're pretty much stick with letters and numbers.

At 62 possibilities per character, 8 characters gives you approx. 218,340,106,000,000 combinations. This would take one computer (spamming your router with 10 possible keys a second) approx. 692,000 years to run through all combinations.

15 characters gives you approx 768,909,705,000,000,000,000,000,000 combinations. This would take that same computer (still spamming those 10 keys a second) approx. 2,438,196,680,000,000,000 years to run through all combinations. Remember that this planet will cease to exist in approximately 5,000,000,000 years.

Assuming I'm not wildly underestimating the number of keys a router can be spammed with (and also assuming I entered the numbers into Google Calculator correctly), 8 might be sufficient. But it's not like the overkill is really hurting anything.

• Reply

• Digg
• Bury

Summer will be over soon.

• Reply

• Digg
• Bury

Maybe a true story, but not really a cool story.

• Reply

• Digg
• Bury

I think I'll buy routers and have them WEP encrypted with SSIDs of "CreditNumbers" and "GovNet" and use them an honeypots. Maybe even steal info from the people trying to get the supposed credit card numbers

• Reply

• Digg
• Bury

You can see the MAC address of hosts on the network if your card allows you to put it in Monitor mode, and have a handy list of them. MAC filtering only keeps out the casual user who's looking for free internet access.

I don't deny that a good passphrase is effective, it does depend on how motivated an attacker is though. Few attackers are going to spend a ton of time trying to get into a residential network. I will for fun when I'm bored in a hotel somewhere and can see other SSID's, but I'm probably one of the few exceptions.

• Reply

• Digg
• Bury

I could be wrong, but I don't think mac addresses are encrypted when the authentication process starts. So you could just sit back and monitor traffic and sniff out addresses to spoof.

But for home users, a VPN is a shot in the dark. OpenVPN is a good project, but most people will use XP's PPTP w/ MSCHAP v2 auth. Problem is, that's not secure. W/o better authentication you can MiM w/ arp spoofing and run asleap. Now try explaining authentication certs to a non-techie and see how far it gets. When working with home users or very small organizations, simplicity is better. There are less possible kinks in the armor.

• Reply

• Digg
• Bury

You can't see broadcast packets until after authentication. You can't see any part of the Ethernet network until authentication is complete, otherwise there wouldn't be any point. AFAIK, first you have to crack the WPA authentication, then you can easily sniff and decrypt packets until you find a packet with a whitelisted MAC (once you've broken the WPA, this won't take very long) then you spoof the MAC then you can get on the network. There are a vast number of tools to detect MAC spoofing BTW. Most network sniffers can do this. Most NAC tools can kick the dupe automatically. However these are pricey and complex corporate solutions.

To be blunt, I think very few home users will use PPTP nowadays. Home users aren't going to set up a home VPN of any kind. They'll use Remote Desktop, which is TLS encrypted.

• Reply

• Digg
• Bury

You don't need to guess, the MAC addresses are broadcast and anyone can see them whether they're connected to the network or not.

• Reply

• Digg
• Bury

"MAC filters can be bypassed by spoofing a MAC"

The way this is typically hacked is that FIRST the attacker compromises the WPA key and THEN he listens to the authentication traffic from a host with a "good MAC", he can decrypt this traffic since he has the key, then he can spoof his local MAC for the good MAC and then he can get in. It's not useless, it does add a step at least.

And as I said in other posts, AUTOMATED attacks by bots (which is most attacks) are unlikely to utilize MAC spoofing.

• Reply

• Digg
• Bury

That's a terrible story. But the guy you were talking with is a moron.

• Reply

• Digg
• Bury

buy one of those cool keybaord things that plugs into your xbox/ps3 controller.

• Reply

• Digg
• Bury

@rtechie

As I don't own a wireless USB adapter for the Xbox 360 nor do I own anything else that you listed, I can't really tell you from experience how to do this.

I have, however, set up a Wii and an iPod Touch on my network. and iPod Touch is pretty easy: just copy it in a note with iTunes, then copy and paste it into the box. The Wii will require manual insertion, which is a pain; I haven't even found much use with my internet-enabled Wii lately.

From what a quick Google search picked up, the PS3 has a copy and paste feature, too. I am not too sure on how to do this one.

An Xbox 360 will require manual insertion. However, you don't need to do this if you haven't already purchased the xbox 360 wireless accessory. I connected my Xbox to a old router, which I reconfigured as a wireless bridge.

• Reply

• Digg
• Bury

If PC users read before they clicked, they wouldn't have the malware problem that plagues their platform so. I'm sure there was a "Your computer has 248020 infected files! Download Anti-Virus Supreme 2010 now!" pop-up in the way of that paragraph and he just didn't see it.

• Reply