Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

I have a Dell N5110 15R Laptop that I'm planning to use for GPU based cracking of WPA/WPA2 passwords. The thing is, I'm not a really big fan of password dictionaries and rainbow tables, I'd rather like to go with a bruteforce method. I don't know the difference in time it takes but I'm trying to go for the least timing here.

Anyway, from what I understand my laptop is equipped with Optimus which alternates between the built in Intel Graphics Card and the Nvidia GT525M card. The problem is that there's no direct way of getting linux to see the Nvidia card, let alone alternate between them. I'm not planning on using the graphics, I just need the card for GPU cracking. Any ideas there?

That's one part, the other part is to build a certain setup that would let me crack WPA/WPA2 password by running a bruteforce attack on them (without using a wordlist). I don't know how much time it would take to complete a task like this, but if you have any idea please let me know. So far I understand that I need to tunnel JTR and airodump to accomplish that task. Any ideas there as well?

Any help would be appreciated! :)

share|improve this question
Optimus is kind of a pain when it comes to using CUDA. You will need to disable Optimus so that the hardware is running exclusively on the NVidia GPU before you can reliably use CUDA. CUDA is not supported by the Intel GPU. I would also suggest that this is really two questions rather than one. The first is a question about how to use GPU optimization on a hybrid graphics setup. The second is about performance characteristics of various attacks on WPA/WPA2. – AJ Henderson Jan 2 at 19:28
Oops, forgot to mention, it would also be best to ask hardware related questions on Server Fault or Power User since that part of the question is not actually IT Security related. – AJ Henderson Jan 2 at 19:35
CUDA is the old nVidia proprietary GPU processing standard, which has been translated into OpenCL now. All modern nVidia and AMD ATi cards support OpenCL, and some newer Intel GPUs support OpenCL too. – Polynomial Jan 2 at 20:41
@Polynomial - good to know, I'm a year or two out of the hardware game on the GPU side. I knew that they were working towards a common standard but didn't know they were there yet. I do however know that Optimus will shut down the NVidia GPU if not disabled as I have that problem with my Optimus enabled laptop. – AJ Henderson Jan 2 at 21:54

2 Answers

up vote 2 down vote

I guess you are looking for this tool

Pyrit allows to create massive databases, pre-computing part of the IEEE 802.11 WPA/WPA2-PSK authentication phase in a space-time-tradeoff. Exploiting the computational power of Many-Core- and other platforms through ATI-Stream, Nvidia CUDA and OpenCL, it is currently by far the most powerful attack against one of the world's most used security-protocols.

Honestly, I never used Pyrit, but it seems like a good piece of software. The Google Code Page holds some tutorial and setup instructions. As Pyrit takes traffic dumps in the pcap format, you can record Wifi-Traffic (the more, the better) and analyze it some other time or place.

You might also want to have a look at here: GPU-Based Cracking @ Tom's hardware. This site covers some staticstics on average cracking times. Even though Pyrit exploits the computational power of your graphics card, the cracking of a various 6 digit alphanumeric password will take at minimum 3 days.

  1. Pyrit on GoogleCode

BTW: The BackTrack Linux Distribution (A LiveCD for penetration testing) comes with Pyrit preinstalled.

share|improve this answer
+1. Without having access to a nVidia Optimus system, I can't tell whether Pyrit with a nVidia driver would see both of them as discrete cards or not, but in either case you still need a nVidia driver and an Optimus aware driver will put any CUDA calls (which Pyrit uses) to the dedicated card. See en.wikipedia.org/wiki/Nvidia_Optimus#Method_of_function – Jeff Ferland♦ Jan 2 at 22:25
Optimus shows them as discrete cards, atleast on Windows. They are distinct hardware and, as I understand it, only one is ever in control. It's similar to the way the Asus Transformer Prime did the switching to the low power core. If it doesn't think the big boy is necessary, it goes to the low power Intel chip and switches off the Geforce. – AJ Henderson Jan 3 at 13:53
up vote -1 down vote

WPA hashes with the SSID as a salt, so you are effectively talking about generating your own rainbow table for the given SSID. A rainbow table is a brute force approach that involves generating inputs until you find one that hashes to the necessary output. I'm not that familiar with WPA cracking however, so I'm not sure what the expected time frames would be. A lot of it would depend on the password complexity. Unless the pass-phrase is weak, I believe that WPA and WPA2 are both still pretty secure.

share|improve this answer
Whoever down-voted, could you comment as to why so I can fix it or address the concern? Was something unclear about my answer? – AJ Henderson Jan 2 at 20:28
1  
I'm not the downvoter, but I'd guess it's because you didn't answer the question - OP asked about GPU-based cracking. Even if he doesn't have a supporting graphics card, your answer should still cover how to do it when you do have hardware support. – Polynomial Jan 2 at 20:42
@Polynomial - ah, I saw it as really being two questions. One is how do you get CUDA (or OpenCL) to work reliably on Optimus setups. That is more of a hardware question than an IT Security one, so I addressed it in a comment. Optimus will shut off the NVidia GPU if it doesn't detect graphics operations, so it must be disabled. I then answered the remaining question of how to do the analysis and at a broad level, as I understand it, generating a rainbow table to match the key to the handshake is the way to brute force that. – AJ Henderson Jan 2 at 21:52
"So you are effectively talking about generating your own rainbow table for the given SSID," isn't quite right. the processof generating a rainbow table results in some holes in guessing and isn't suited to handling dictionary brute forces since it must cover anything within a keyspace. That's the -1. Sometimes I use my phone and type later. – Jeff Ferland♦ Jan 2 at 22:23
@JeffFerland - I agree that a dictionary is better but the question specifically said they did not want to use a dictionary attack, presumably because they wanted to do it "on their own". This leaves a self-generated rainbow table as the best option available, at least that I am aware of. – AJ Henderson Jan 3 at 13:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.