Bruce Schneier posted an article on his blog about wpacracker.com, a service for cracking WPA and other passwords. Basically, you send them a dump of network traffic from a WiFi network and they will use a brute force algorithm to guess the password. With a massive dictionary and brute force computing. they claim to be able to crack most WPA passwords in 20 minutes. Once they have the WPA password, your home network wide open to the outside world.
Some say that with enough monkeys typing at random on a keyboard, eventually you would get the complete works of Shakespeare. Actually you wouldn’t (the universe would come to the end first), but that is the general idea of a brute force password attack. First you use a large dictionary of words, then after exhausting that list you go for a random series of letters and number combinations. With this company, they are using a 400 CPU cluster and a database of 135 million words. They are claiming about 20 minutes to crack a password. That works out to about 7 words a minute per CPU, using from their dictionary.
Processing 7 words a minutes per CPU to test a world from a dictionary doesn’t sound very fast at all. It does take a lot of computer horsepower to crack WPA passwords. WPA passwords are case sensitive, which means each letter in a password could be either upper or lower case. An 8 letter word would have 28 possible combinations. It can take a while to work through the iterations, but with enough CPU power, you’ll work though most common words.
The way it works is that someone can park in front of your house and use commonly available software to capture the wireless data being broadcast through your house. If you are using WPA encryption, then all of the data will be encrypted. They can then send a copy of that data to the wonderful people at wpacracker and pay them $35. They will get back your WPA password, if the wpacracker people were able to crack it.
You can make it much,much harder for the password to be cracked. Just use long passwords and use numbers with the letters. WPA passwords are case sensitive, so if you limit the characters to just the upper and lower case letters, plus the numbers, you have 62 possible choices for each character in the password. If you pick an eight character password, you would 628 possible passwords. That’s a pretty big number. With 16 characters, you get 6216, which is 4.something , followed by 28 zeros. That’s a number beyond big. A brute force attack with today’s hardware would take centuries to process.
I use a 32 character password, brute force attempts will fail on that one. But I cheat a little. I’m not going to remember a 32 character sequence, and it would just take forever when someone visited my home and we had to type in a random 32 character sequence. What I did was to make up a random 8 character sequence using a 4 letter family name and 4 digits and then repeat that sequence 4 times. It’s easy to remember and easy to type. Something like “Doug2112”. It wont show up in the dictionary and it’s not going to get cracked. When I’m letting someone on our network, I just have them open up notepad and type in the 8 characters and then copy and paste it 4 times into WPA password dialog.
Update:
If you want to quickly test your password to see how long it would take for a desktop PC to crack it, try http://howsecureismypassword.net/. On that site, they estimate that a desktop PC would crack the “Doug2112” password in 252 days. For that phrase repeated 4 times, they came up with 32 octillion years. Take that with a grain of salt, but it shows how much harder it is to crack longer passwords.
Sorry to be a little negative, but I have a few bones to pick with this article.
ReplyDeleteBe careful not to assume that the word "Dictionary" in this context means the same as in a regular context. A dictionary is just a list of strings of characters and they usually make these lists by adding real, known passwords to them. For instance, I'm sure all of these 34,000 are in there: http://www.schneier.com/blog/archives/2006/12/realworld_passw.html
There's a good chance "Doug2112" is in that list because that's exactly the sort of thing someone *would* choose as a password and that means it's exactly the sort of string they want in the list. The list will definitely contain "qwerty", even though it's not a real word in any language. Normal words like "string" and "list" won't be in the list because nobody would ever choose them as a password.
They talk of English and German dictionaries on the site. This is because in the English version, they would have the string "password123" and in the German version they would have "kennwort123".
You have also confused a brute-force attack and a dictionary attack. These are quite different and usually differ in time taken by several orders of magnitude. The brute-force attack, however, is guaranteed to succeed if given enough time whereas the dictionary attack will only succeed if the required password is already in the dictionary. That's why they also have a 284 million word extended dictionary and a complete 8-digit number list. You don't get a refund if they don't find the password but you do get the confidence that they don't know your password.
I'm not sure how you got to 7 words per-minute-per-CPU, but working backwards from your answer: 7 x 400 x 20 = 56,000 which is a long way from 135,000,000. If we make that per-second-per-CPU then it comes out to 3.3 million, which is better but still seems very wrong. A single CPU should be able to handle thousands per second, not seven. I suspect that either there's something else that takes the time. Possibly you're queued behind others or there are others running simultaneously.
With both of these methods, saying "It will crack it in 252 days" is misleading. It's quite possible that "Doug2112" is the very first value in the dictionary or the first generated password in a brute-force attack, in which case it will be cracked before you have lifted your finger back off the mouse button. Or it could be the last value. Normally, we express times of this sort as a confidence value: There is a 50% chance that we will have found the correct password after 252 days. This means that after 252 days, we have covered 50% of the keyspace or that, based on past experience, we have found 50% of them after 252 days.
In the case of WPA Crack, they say 20 minutes will exhaust the entire dictionary. They give no indication of whether more likely passwords are moved to the front of the list but they'd be silly not to.
To end on a more positive note, you were right to mention that the results from howsecureismypassword.net should be taken with a grain of salt. Try this 12-character password for example: "' ></`|\][}{". The important thing to remember, as you rightly mentioned, is that length trumps character set size almost every time. A ten character lower-case password has roughly the same keyspace as an eight character password with upper, lower, numbers and easily-typed symbols and is probably easier to remember.
It still boils down to a basic point. If someone has been capturing your encrypted wireless traffic, the shorter the password, the shorter amount of time it will take to get the password.
ReplyDeleteWith the WPA password being entered in rarely, it makes sense to use 16 characters of upper, lower, numbers, and symbols. Then the dictionary attack fails and only the brute force attack could win.