Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I don't know much about how WPA algorithms work internally. Is brute-forcing an AP the only way to crack WPA? (or to get associated with AP)

Another question is about Reaver-WPS, what if an access point doesn't support WPS, or is disabled? Will Reaver work on such AP

share|improve this question
1  
I don't have sources so I won't write an Answer, but no - you can go past WPA without brute-forcing it. It just that the math is complicated enough that running through the most common passwords first is probably faster for the intruder in many cases. –  medivh Jul 30 '13 at 7:03
2  
If WPS is disabled then the exploit against WPS won't work. If you have questions about WPA I suggest you do some research on the algorithm. –  Ramhound Jul 30 '13 at 11:42

1 Answer 1

up vote 5 down vote accepted

WPA can be used with different protocols. Using WPA-TKIP, there are alternative attacks than the common handshake-bruteforce, but those will not grant you access to the AP. These attacks focus on RC4 weaknesses (similar to WEP, but far less effective due to successful countermeasures).

I assume that you want to acces an AP. In this case, bruteforcing is the only possible way to crack WPA. You capture a handshake between client and accesspoint, and perform the challenge-response yourself with different passwords, until your result matches the one you captured.

This can be sped up by using rainbow-tables, although you will have to find a target using a popular SSID in order to have an existing rainbow table.

Thus, to protect against intruders, you should choose an uncommon SSID along with a fairly long and complex password.

And no, you can not attack WPS when WPS is disabled or not supported. There may be bugs preventing a user from disabling WPS, but i consider these APs WPS-enabled.

share|improve this answer
    
You might want to add a reference the "shoulder-surfing" (and similar) class of attacks to your answer: that usually the easiest way to grab a WAP/WEP password. –  Stephane Oct 30 '13 at 10:37
    
@Stephane a legitimate user will not type password everytime, however social engineering attacks always works –  Mark Evans Oct 31 '13 at 3:48
    
@MarkEvans That pretty much what I meant: brute-forcing the WAP key is usually not the easiest way in. –  Stephane Oct 31 '13 at 8:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.