Hello world, with one simple trick a security researcher was able to quite easily hack into
70% of the WiFi networks in his city. Now this isn’t a hacking tutorial, I’m not
going to be showing you step by step how to do the same thing. But it’s an interesting
story. The researcher was able to do all of this with just a $50 WiFi adapter and a basic
laptop for cracking. No specialist equipment required.
Let’s dig in. The researcher, one “Ido” at cyberark had a lightbulb moment after being
stuck without internet on a few occasions, and having to ask his neighbours if he could
use their WiFi. After having to do this several times, he realised people often use their
phone number as their WiFi password. His hypothesis being, if so many people really did just use
their phone number as their password, cracking into their networks en masse should be pretty
easy, as there aren’t that many possible phone numbers, for an 8 digit number excluding
the area code there’s only 100 million combinations, which isn’t much in the world of cracking.
To test this theory, his first step would be to collect thousands of WiFi password hashes
so he could attempt to crack them. To do this he employed an arguably ageing technique called
wardriving. Wardriving simply means to drive around armed with a laptop and a high gain
WiFi antenna, collecting information about WiFi networks around you. The best example
of wardriving in action is wigle.net. It’s a distributed wardriving platform, you can
download their app which uses your phone’s WiFi and GPS capabilities to gather information
about WiFi networks as you move, adding to their public map of almost 1 billion WiFi
networks. Wigle isn’t nefarious in any way, it isn’t collecting password hashes like
Ido did, but rather just basic statistics.
For his wardriving setup Ido “used an ubuntu machine with [an alfa WiFi adapter]” these
adapters cost in the region of $50. And as per hacker protocol he donned a classic black
hoodie, hid the laptop in a rucksack and stuck the adapter on his back. Not the most incognito
wardriving setup I’ve ever seen, but it is functional. Also, technically he’s warwalking
here rather than wardriving I suppose, but anyway.
Instead of collecting basic statistics on WiFi networks, Ido collected PMKID hashes.
PMKIDs are used for roaming capabilities between access points. Roaming is a useful feature
typically used in mesh networks, for example in universities when you need many WiFi routers
to cover a whole campus, roaming allows a device to move freely between access points
without having to manually stick in the password when you wasn to hop between routers. However,
whilst a typical router for home use obviously won’t be part of a mesh network, they often
come with this mesh feature enabled by default, which turns on the use of PMKIDs. It doesn’t
help that in 2018 a vulnerability was discovered which enables the cracking of PMKID hashes
to find the original WiFi password. For a router with PMKID enabled these hashes can
quite easily be collected by a nearby 3rd party at any time.
Ido used HCXdumptool to capture the hashes he was after, and proceeded to meander around
his neighbourhood, definitely not looking completely sus, hoovering up those hashes.
In total he “gathered 5,000 WiFi network hashes”.
After which he proceeded to test his theory by cracking them. Ido loaded the hashes into
hashcat - A tool which claims to be the “World's fastest password cracker”, and it is correct,
I’ve used hashcat before, nothing comes close. It uses the GPU power of your computer
and works with all kinds of hashes. Ido used a kind of brute force attack to crack the
hashes, it’s called a mask attack and allows you to specify the exact keyspace that the
brute force attack should use.
For example, every phone number in Israel - the country of the researcher - starts with
05, followed by 8 random numbers, so he programmed this into the hashcat command, 05 followed
by 8 ?d’s which each represent some random number. At first the researcher tried cracking
on a monster cracking rig, decked out with 8 QUADRO RTX 8000’s each costing almost
$7K. That behemoth cracks at almost 7 million hashes per second, which blitzed through the
100 million possible combinations in about 15 seconds.
However the same attack took 9 minutes on Ido’s laptop, which isn’t bad all things
considered. In total, using this method he managed to crack 2,200 passwords. 44% of people
had used their phone number as their WiFi password. He ran the remaining hashes against
the infamous rockyou.txt password dictionary, which worked on a further 900 hashes. And
after testing a few more super basic password combinations like 8 lowercase characters he
ended up with 70% of the hashes he collected, cracked - which would obviously give him complete
access to all of these supposedly private networks.
Let me know in the comments, is it common where you live to use your phone number as
your WiFi password, or is this just a thing in Ido’s hometown of Tel Aviv, Israel?
This video is sponsored by Linode, who are giving you $100 worth of free cloud computing.
Linode is a totally customisable cloud hosting platform - whether you’re looking to quickly
spin up a VPN, website or host a kubernetes cluster - Linode has you covered. If it runs
on linux it’ll run on linode.
Linode just announced availability of their NVME block storage, the first alternative
cloud provider to officially support this state of the art hardware. Linode’s philosophy
is to focus on providing all the tools a developer really needs at competitive prices. Use the
link in the description now to claim your free $100.
If you enjoy this kind of video make sure to help me out by caressing the like button
for the youtube AI as well as turning on those sub notifications.
If you want to see what goes on behind the scenes make sure to follow me on the instagrams,
I’m @jhonti I will of course link it in the description.
And if you’re looking for something to watch next go check out my previous video on how
fuel stations across Iran were completely disabled by a cyberattack.
As always sources will be linked in the video description, stay tuned for more hacking videos,
and have a good one.