2

I was browsing YouTube and I came across this video In the video they show how to crack the password of a wifi using CommView, Aircrack and Wordlist.

According to the video it takes about two minutes to crack the password, but I guess it can take a longer time, depending on the difficulty of the password. But what is the downside of this method? I mean, if it is so easy to crack a wifi password, why do wifi which requires payment exist, for example on an airport?

Is the likehood of getting caught 100 percent? Or was the person in the video cracking an "easy" wifi?

And to the main question, how does one protect oneself from an attack like this?

Improve this question
4
  • 3
    It depends on which encryption is used on the network. WEP can indeed be cracked in minutes given the right conditions regardless of the strength of the key. WPA and WPA2 are pretty secure however and the only option is brute force which isn't practical of the key is strong.
    – André Borie
    Sep 4, 2016 at 23:01
  • Usually when you get a new router the password is something like "e43FkO21fda", I would guess this is a though one using bruteforce? @AndréBorie
    – Olba12
    Sep 4, 2016 at 23:04
  • There is several reasons why brute force is not what one should think about when thinking about getting network access
    – happy
    Sep 5, 2016 at 1:11
  • Also, if the password is on a list of known passwords then the best encryption offers no protection, and is easily cracked using such lists. This happens more often than you'd hope, because of human nature.
    – ig-dev
    Nov 2, 2019 at 2:04

1 Answer 1

Reset to default
5

Essentially, yes, the person in the video was cracking an "easy" WiFi. The password chosen to secure the network ("plausible") was simple enough to be contained in a short wordlist. They simply tested all of the entries in the wordlist until they found the correct password. In practice, this method is unlikely to work as effectively as it did in the video because most actual networks are, at least in theory, secured with longer and more complex passwords that would not be found in most wordlists. Brute-forcing takes exponentially longer as password length grows, so once a certain password length and complexity is reached this method becomes impractical.

Paid public WiFi networks generally don't use any encryption at all, so that is a separate discussion entirely.

Improve this answer
3
  • 1
    Doesn't many routers also have some kind of rate limiting to stop brute force attacks? (I don't know if they do, I am just hoping...)
    – Anders
    Sep 5, 2016 at 8:18
  • 1
    At least for WPA-PSK2, there is no brute force protection, as one can easily do the cracking offline. This way, an attacker can easily rent a cloud (Amazon EC for example) and let them crack the key. There are even some (shady) services who do this if you pay them...
    – Lukas
    Sep 5, 2016 at 8:24
  • 4
    @Anders Brute-forcing a WPA encryption key need not not involve actual attempts to connect to the network. It only requires capturing a "handshake" that occurs between the AP and an authorized client, after which the brute-force procedure is essentially an attempt to figure out what key would generate the captured handshake. All of this can be done passively, and away from the AP once the handshake has been captured. Thus there is no way to implement brute-force protection, aside from setting a key that is too long to brute-force in the first place.
    – tlng05
    Sep 5, 2016 at 15:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .