4

My Wi-Fi WPA-PSK password looked pretty weak: 8 uppercase letter. I have checked with another router from the same provider and the pattern is the same.

To see how weak this is I tried to hack it myself, under the assumption that I only knew the above.

I have never done anything like this but I am a decent Linux user, so I tried following an online tutorial using the Aircrack suite and captured the handshake. Then I set off to write my own dictionary (generating all combos of 8 uppercase letter). I soon realized that the file needed to store it would require 26^8 * 8 * 1 byte ~ 2 TB. A bit impractical for casual intruders without some dedicated hardware (e.g. me right now), and I'd figure that one could easily make the number unbearable rather quickly by allowing numbers, cases and symbols.

Does this make such a password quite secure from most amateurs? Or are there ways to circumvent this (smarter attacks, compression of the dictionary file, having a software that streams the dictionary rather than storing it on disk etc.)?

Vilican
  • 2,723
  • 8
  • 22
  • 35
Three Diag
  • 143
  • 5

2 Answers2

5

Personally, I don't think that 8 character (uppercase) is strong enough to withstand a determined attacker. Using only uppercase characters we have,

268 = 208827064576 possible permutations.

If we add lowercase to the mix we can increase this to

528 = 5.3459729e+13 permutations.

As you can see by increasing the character set we increase the amount of time required to bruteforce by a massive amount. I personally recomend using an alpha-numeric PSK that is 12 characters minimum.

Researchers show the practical implications of weak PSKs in the following entry with a budget of only 200(Euros),

https://www.exploit-db.com/exploits/34307/

The biggest bottleneck most people would have is the harddrive size however it's relatively cheap to buy harddrives large enough to make this feasible. Using modern hardware and a bigger budget it would be trivial to bruteforce an 8 character uppercase PSK assuming the attacker can capture a successful authentication.

So as people, and yourself, have mentioned this will stop ametures from brute forcing the PSK. Anyone willing to put in the time to do this attack over the span of a few days will very likely not be an amateur.

Leth0_
  • 211
  • 1
  • 5
  • This looks a lot like my internet provider...thanks for the reference! – Three Diag Nov 29 '15 at 21:19
  • Also, despite it is, in theory "easy" to crack, 30/15 days are a non negligible amount of time. – Three Diag Nov 29 '15 at 21:21
  • 2
    The question OP had was "Does this make such a password quite secure from most amateurs?". To that question I think your answer sounds like a yes? Most amateurs are certainly not researchers, nor do they have 15-30 days of time or severals rigs. – eis Nov 29 '15 at 23:21
  • @eis thanks for pointing that out for me. I've added a summary at the end to clear up my response. – Leth0_ Nov 30 '15 at 07:37
3

You don't need to create a dictionary for the attack. You can simply choose the brute force option to dynamically generate the code for you. The time it would take you to do this however makes it next to pointless, it's much better to do research on your target and compile a special dictionary

A casual intruder won't bother to use a brute force attack because it is very time consuming. It can take hours, days, years. You can read this thread to understand better.

Though 8 character uppercase is not strong enough. It would be better if you add lowercase and numbers. Adding lowercase and numbers increases the permutation and combinations.

You can try Reaver for automated attacks.

Community
  • 1
Sanidhay
  • 191
  • 12