Posts Tagged ‘WPA’

Elcomsoft Wireless Security Auditor Gets Wi-Fi Sniffer

Thursday, December 1st, 2016

We released a major update to Elcomsoft Wireless Security Auditor, a tool for corporate customers to probe wireless network security. Major addition in this release is the new Wi-Fi sniffer, which now supports the majority of general-use Wi-Fi adapters (as opposed to only allowing the use of a dedicated AirPCap adapter). The built-in Wi-Fi sniffer is a component allowing the tool to automatically intercept wireless traffic, save Wi-Fi handshake packet and perform an accelerated attack on the original WPA/WPA2-PSK password.

So what exactly has changed in the new release? Let’s have a look at the following block diagram:

image1

As you can see, previous versions of Elcomsoft Wireless Security Auditor (EWSA) required the use of a dedicated AirPCap adapter, a dedicated device that costs around $300.

image002

Source: http://www.riverbed.com/products/steelcentral/steelcentral-riverbed-airpcap.html

While using dedicated hardware built specifically for sniffing Wi-Fi traffic is “the right thing to do” (if you’re serious about auditing multiple networks, we still recommend buying one), many of our customers found the whole setup overly complicated. The need to purchase an additional piece of hardware, install and configure drivers was enough of a roadblock for many.

We worked hard to remove this complication. That’s why the new version of Elcomsoft Wireless Security Auditor now includes a brand new Wi-Fi sniffer. While we are keeping AirPCap support, we built a new sniffing module that works with just about any Wi-Fi adapter thanks to the use of our own custom NDIS and AirPCap drivers.

image3

As you can see, we added a custom AirPCap driver stack as well as a custom NDIS driver. We built those for all 32-bit and 64-bit Windows systems from Windows 7 to Windows 10 (sorry folks, no XP support. Use on your own risk on Vista PCs).

With this new Wi-Fi sniffer, Elcomsoft Wireless Security Auditor becomes a true all-in-one tool for probing security of wireless networks that requires no extra hardware. Just set it up on a laptop (preferably, one equipped with NVIDIA graphics), bring it to a proximity of a Wi-Fi network and run the tool.

Why NDIS?

The Network Driver Interface Specification (NDIS) is an open-source API for network interface cards. The NDIS driver abstracts the network hardware from network drivers, acting as the interface between the MAC sublayer and the network layer.

Your network adapter already comes with a NDIS driver. Standard NDIS drivers do not support intercepting Wi-Fi packets, and, in general, do not allow for W-Fi sniffing. For this reason, we built a custom NDIS driver conforming to NDIS 6.0 specification to implement the ability to intercept individual Wi-Fi packets.

ewsa_networks

Our driver can intercept wireless traffic from all Wi-Fi networks operating on a certain Wi-Fi channel. Once you select a certain Wi-Fi network, EWSA will start monitoring its traffic waiting for a new device to connect. Once a new device connects to that wireless network, the device sends a handshake packet to the access point. The handshake packet contains hashed password. We intercept the handshake packet, extract the password hash, and run an attack on that hash in order to recover the original password.

2

Compatibility

If adding a custom NDIS driver and writing a custom AirPCap library does the trick, why is not everyone doing it? Why the extra hassle and expense of buying a ‘proper’ AirPCap adapter? The thing is AirPCap devices are designed to do one thing: Wi-Fi sniffing. On the other hand, your existing Wi-Fi adapter may or may not work depending on many things such as the make, model and age of the adapter and its driver version. In other words, not every Wi-Fi adapter will work as a sniffer, while every AirPCap adapter most certainly will. Having said that, we tested Elcomsoft Wireless Security Auditor 7.0 with a wide range of modern and reasonably recent Wi-Fi adapters and were delighted to find that the majority of recently made adapters work with no issues. After all, our goal is not full-time Wi-Fi sniffing; all we need is a handshake.

NVIDIA Pascal Support

We have also updated Elcomsoft Wireless Security Auditor with new GPU acceleration libraries supporting NVIDIA’s newest architecture, the NVIDIA Pascal. Cards based on this architecture (GTX 1070, GTS 1080 and other 1000-series boards) can break Wi-Fi passwords at least twice as fast as 900-series boards of previous generation.

New sweeping WPA Cracker & its alternatives

Tuesday, December 8th, 2009

It’s a well-know fact that WPA-PSK networks are vulnerable to dictionary attacks, though one cannot but admit that running a respectable-sized dictionary over a WPA network handshake can take days or weeks.

A low-cost service for penetration testers that checks the security of wireless networks by running passwords against a 135-million-word dictionary has been recently unveiled. The so-called WPA Cracker is a cloud-based service that accesses a 400-CPU cluster. For $34, it can run a password against all 135 million entries in about 20 minutes. Want to pay less, do it for $17 and wait 40 minutes to see the results.

Another notable feature is the use of the dictionary that has been set up specifically for cracking Wi-Fi Protected Access passwords. While Windows, UNIX and other systems allow short passwords, WPA pass codes must contain a minimum of eight characters. Its entries use a variety of words, common phrases and "elite speak" that have been compiled with WPA networks in mind.

WPA Cracker is used by capturing a wireless network's handshake locally and then uploading it, along with the network name. The service then compares the PBKDF2, or Password-Based Key Derivation Function, against the dictionary. The approach makes sense, considering each handshake is salted using the network's ESSID, a technique that makes rainbow tables only so useful.

Everything seems to be perfect, but for the fact that there exists another alternative to crack WPA passwords which allows to reach the same speed. Just instead of installing a 400-CPU cluster, it’s possible to set 4 top Radeons or about two Teslas and try Elcomsoft Wireless Security Auditor.

Elcomsoft Wireless Security Auditor: WPA-PSK Password Audit

Wireless Security Survey

Wednesday, April 22nd, 2009

The key findings of the survey of the 35860 wireless networks (in 12 Indian cities) are:

  • 37% appeared to be unprotected.
  • 49% were using WEP encryption.
  • Balance 14% were using the more secure WPA/WPA2.

The authors say that this makes around 86% of the observed wireless networks vulnerable, but we’d add that remaining 14% are not totally secure. Why? Check our Wireless Security Auditor 🙂

Fastest video card

Tuesday, April 14th, 2009

As you may guess, it is ATI Radeon HD 4890 X2. It is not available yet, but coming soon. We’re very impatient to try our WPA password recovery software there.

An article Best Graphics Cards For The Money: April ’09 : March Review/April Updates also worth reading.

ATI, NVIDIA and WPA/WPA2 passwords

Friday, April 10th, 2009

In case if you missed it: new ATI Catalyst drivers (9.4) now available (you can read the release notes for details). For some reason, some driver files have been renamed (well, not in 9.4, but in 9.3 released a bit earlier, though that version was really buggy and we cannot recommend to use it anyway), and our WPA password recovery (audit) software was not able to recognize Radeon cards anymore.

Well, to make the long story short: simply download the latest ATI Catalyst drivers and updated Elcomsoft Wireless Security Auditor :). Just note that this (new) version of EWSA will not work with drivers version 9.1 or older.

In the meantime, NVIDIA CUDA 2.2 (beta) released. Does that actually matter? Yes, because NVIDIA Tesla C1060 and S1070 are now officially supported on Windows. Besides, we need to have a look at Zero-copy support for direct access to system memory, because it may speed-up the GPU-enabled password cracking on some particular algorithms.

WPA Benchmark

Monday, April 6th, 2009

Here are the benchmarks for WPA recovery; we’ve run tests on one of the most powerful modern CPUs and a bunch of GPUs. Even GTX 280 outperformed Core 2 Quad Q6600:

wpa_benchmark2