Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Router 1 is setup with WPA and a 32-character PSK. A Linux desktop is connected to it via Ethernet.

Router 2 has an 8-character PSK and is connected to Router 1 by Ethernet cable. Router 2 is used only by Android phones which connect to it by WiFi.

  1. If an attacker compromises the weaker PSK on Router 2, is Router 1 at risk, or would the 32-character PSK stop them?

  2. Do attackers have to crack the router's administrative User Name/Password before they can attempt to crack the PSK, or can they hack the router's PSK directly?

  3. I asked the ISP manager why router 1 was set up as WPA, not WPA2 (he did the initial setup). He told me it was "difficult" to set up WPA2. Should I believe him? Why is it "difficult"?

  4. How long does it take a skilled attacker to capture the entire network trace including the initial authentication handshake between the device and the router?

share|improve this question
    
I think you mixed up your bits and bytes. Also, brute forcing the correct password might not be the only way to get access. –  domen Jul 19 '13 at 8:54
    
OK. 32 digit key. What other ways are there to gain access? –  Edwardo Jul 19 '13 at 9:41
1  
Is there WPS enabled? There are attacks against it. If the attacker takes control of the router 2, then it probably doesn't need to bother with WPA PSK, it's already basically joined the network (LAN and WLAN are usually bridged). Getting access to router 1 administration interface depends on its configuration - often that is accessible from connected clients (but they'd need the user/password). And all this is assuming things work as they should (No vulnerabilities like securityfocus.com/archive/1/527275 for example). –  domen Jul 19 '13 at 10:12
2  
This sounds like a setup for a new viral video. –  Adnan Jul 19 '13 at 11:27
2  
... walk into a bar –  Lucas Kauffman Jul 19 '13 at 11:37

3 Answers 3

Unless they can access the management network of the router through router 2's connection, they can't normally get to your admin panel. make sure your administrative interfaces are on a different network than the network used for internet access.

Taking just into account how long it would take to bruteforce a 63 bit WPA-PSK key:

WPA-PSK passphrases get hashed 4096 times with a salt (which is the SSID of the AP). Now by 63 bits you probably mean a passphrase with 63 characters of length as WPA-PSK has a 256-bit key (you can't change this). WPA supports ASCII so that's 128 possible characters. 63^128 = this number. Now let's say you take top notch GPUs to bruteforce the key you could maybe get around 2.5 billion hashes every second. You would get the following calculation: ( Very Large Number/(2.5 billion / 4096 ) ) / 86400 = another insanely large number days before you would be able to crack it (well half if you take probability into account). By then you'd probably be dead.

To your third remark, WPA2 is as difficult to setup as WPA. It's exactly the same principle (from a confguration point of view) just different algorithms. My guess is that his equipment does not support it.

EDIT

Miscalculation: it's 128^63 not the other way around. Regardless it's still a huge number.

share|improve this answer
    
I want to understand this correctly. Are you saying router 2 must have possession of router 1's key before it can communicate on the WPA2 network? –  Edwardo Jul 19 '13 at 10:04
    
If you are connecting them wired then no. But then you also need to make sure your administrative interfaces are on a different network than the network used for internet access. –  Lucas Kauffman Jul 19 '13 at 10:07
    
That's 128^63, not 63^128. Still quite large :-) –  domen Jul 19 '13 at 10:14
    
ah you are right –  Lucas Kauffman Jul 19 '13 at 10:14
    
The two routers are on the same network and connected by ethernet wire. Router 1 is safe, I think, with its enormous passphrase. The question is can router 2 compromise router 1 in any way by an attack? –  Edwardo Jul 19 '13 at 10:27

If router 2 is wired to router 1, there is no need for a device on router 2 to have to break the PSK on router 1. The pre-shared key is only used for wireless connections. Once on the internal network, there is no key needed for access. This is why you don't have to enter the key on your wired desktop, you just plug it in. The key only applies to the radio link.

If they have access to router 2, they will not be able to administer router 1, but they will likely be able to see some of the traffic passing through the network on router 1. They will also be able to connect with any computers on router 1.

If they already have access to the network, they have no need to attack the PSK, but yes, they could attack the PSK directly regardless of if anything else exists at all. It could just be router 1 sitting in a room by itself and they could still attack the PSK directly.

For the third question, it isn't. The only reason would be that some devices don't support WPA2, so they may do WPA for compatibility purposes by default. I'd suggest switching it to WPA2. If you don't have access to do that, I would request that the ISP disable the wireless and use WPA2 from my own router so that I could actually manage my security. (I in fact do this at home where my cable modem supports Wi-fi, but the wi-fi is switched off.)

It varies based on key length and encryption used, but it takes anywhere from a few hours to weeks to break WEP or weak password derived WPA keys. Last I knew, strong WPA keys were still pretty secure. The information that is being transmitted can be recorded by an attacker in real time, they just have to obtain the encryption key before they can make sense of what is being sent.

Note that if you are accessing secure sites that use SSL, then even if the network link is compromised, you are still protected since SSL protects the information from your computer to the server and back. Also note that your information on non-SSL connections can be read and even potentially modified on the Internet if someone is able to get between you and the destination server, so you should never rely on wireless encryption to keep your data safe. It is mostly just a barrier to keeping unauthorized users from putting data on to your network.

share|improve this answer
  1. If an attacker compromises the weaker PSK on Router 2, is Router 1 at risk, or would the 32-character PSK stop them?

This largely depends on how exactly your network is set up. Unfortunately, there's not enough detail in your post to give a proper analysis for your specific case. However, for variants of "Router 2 ... is connected to Router 1 by Ethernet cable" there's only two really relevant possibilities.

Internet is connected to Router 2's WAN port. One of Router 2's LAN ports is connected to Router 1's WAN port.

This is the ideal variant of your setup. Here, Router 1 will essentially treat any device connected to Router 2 as if it is just another device on the Internet. Therefore, all firewall and NAT rules will apply. In default configurations, this means that (absent a critical vulnerability in the router software) an attacker with access to Router 2's WiFi network will not gain access to Router 1's network without having to break the stronger WiFi PSK.

Any other configuration.

This includes all setups where Router 1 is the device connected directly to the Internet, as well as where Router 2 is connected to the Internet while the routers are connected to each other via LAN ports on each end. The critical piece to note here is that, in any configurations that would fall into this category, Router 1 will treat all devices connected to Router 2 as if they are part of the local network. At this point, any device connected to Router 2 - either by WiFi or Ethernet - almost may as well be connected directly to Router 1. No cracking of Router 1's PSK is required.

2. Do attackers have to crack the router's administrative User Name/Password before they can attempt to crack the PSK, or can they hack the router's PSK directly?

The administrative username/password only protects the administration interface of the router. It does not prevent people from accessing the WiFi network. Otherwise, you would have to configure every client with both the admin username/password and the WiFi PSK.

3. I asked the ISP manager why router 1 was set up as WPA, not WPA2 (he did the initial setup). He told me it was "difficult" to set up WPA2. Should I believe him? Why is it "difficult"?

These days, there's no reason it should be "difficult" at all. Most modern WiFi access points and clients support WPA2 right out of the box. Configuring WPA2 for PSK mode is no more or less difficult than configuring WPA for the same. The only time it becomes a problem is if there is older hardware (the access point, or client devices) involved which do not support WPA2. However, those are becoming fewer and farther between.

I'd suggest getting the admin password for the ISP's router and taking a look at it yourself. It's really none of their business how your WiFi is set up - apply any level of security you feel fit.

4. How long does it take a skilled attacker to capture the entire network trace including the initial authentication handshake between the device and the router?

How long to capture the network trace? Exactly as long as it takes whatever network traffic they're capturing to occur. Now, how long does it take for them to be able to read that traffic as cleartext? That depends on how strong the encryption key and algorithm are (if any is used at all), and how much foreknowledge the attacker has. It also depends on what sort of hardware and software the attacker has at his disposal.

share|improve this answer
    
This answer deserves multiple up-votes. Many thanks to Iszi. –  Edwardo Jul 20 '13 at 6:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.