Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

It's been shown that a brute-force attack on WPA2-Personal is possible in a reasonable amount of time. These successful attacks appear to be limited, however, to researchers who have the budget to afford the hardware, or the few experts who know how to debug and run their own WPA2 program in the cloud.

Assuming the resources available to the average hacker, are these brute-force attacks now feasible? what would be the estimated hardware cost to make a successful brute-force attack on WPA2-Personal?

400,000 PMK/s as said in the URL doesn't seem fast enough; what assumptions must these attacks be making?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

The attacks assume a password that appears on the password list they are using (or at least in the space of passwords being considered, e.g. 8-9 alphanumeric chars).

The WPA 4 way handshake is vulnerable to offline password checking, but the key involved is 128 bits long - if the network password has sufficient entropy then it can't be brute forced in a reasonable time frame.

So there is no one size fits all answer to the question - it very much depends on the quality of the password on the target network and how much the attacker knows about that password (length, format, name of pets, ...).

Note that its a different story if the access point supports WPS - many implementations are vulnerable to brute force attacks, but with a consistently small keyspace. A normal consumer PC can crack a vulnerable WPS implementation in <12 hours.

share|improve this answer

There are services for cracking, or brute forcing hashes and handshakes that use cloud computing without the client needing to be a programmer. The one that immediately comes to mind is.

https://www.cloudcracker.com/

They advertise "Big. Fast. Cheap. Run your network handshake against 300,000,000 words in 20 minutes for $17" and that The TechRepublic says the following, "Welcome to the future: cloud-based WPA cracking is here!"

They can brute force the following

  • WPA/WPA2
  • NTLM
  • SHA-512
  • MD5
  • MS-CHAPV2 (PPTP/WPA2-E)

Though in the instance of MS-CHAPV2 (PPTP/WPA2-E) they can enumerate the whole space in 1 day.

An article and a link (https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/) to this service last summer is how I became aware of these services. I would definitely recommend reading it.

share|improve this answer
    
I know about cloudcracker.com but haven't yet spent the $17 just to try it. I mean, what if you spend the $17 and it doesn't succeed. Do you know of any free services? –  T.Webster May 25 '13 at 23:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.