2

For quite a while I've been experimentally hacking wireless routers by capturing handshakes and Decrypting them using oclHashcat on my computer. even the most complicated passwords won't take longer than 10 days with powerful GPUs available these days and also Wireless networks based on Radius server are so vulnerable to such attacks.

Is there any way to prevent an attacker from even capturing my WI-FI WPA-2 AES handshake and secure my wireless network against this attack?

Improve this question
4
  • You need to use an EAP (extensible authentication protocol). PEAP is a common one that uses SSL. Make sure clients are configured to verify the AP's certificate.
    – paj28
    Commented Feb 6, 2015 at 23:16
  • @paj28, that's not AES and even if i use EAP, does it prevent others from capturing handshake?
    – user60980
    Commented Feb 7, 2015 at 8:07
  • @Saeed - people can capture the handshake, but it protected by SSL, so they can't brute force the password. Makes it safe to use low-entropy passwords. After authentication is complete, PEAP uses WPA2-AES just the same as if you'd used PSK.
    – paj28
    Commented Feb 7, 2015 at 12:39
  • that seems really great, thanks. is there any requirements for devices to be able to connect using PEAP like firmware upgrade or an app or any ordinary Wifi supported device can connect?
    – user60980
    Commented Feb 8, 2015 at 20:10

1 Answer 1

Reset to default
4

No, it's not possible to prevent someone from capturing the handshake.

A properly implemented password with enough entropy can withstand even a very well funded attacker. The example hash rates given for the highest end machine are still only about 1 million hashes a second on a machine with 8 GPUs. In a year you could do 1,000,000*60*60*24*365=3*10^13 passwords, or about 44 bits. If you really want to be secure, generate a random 128 bit password, and print it on your router. This will be secure from any brute force attempt, though it won't save you from rubber hose cryptanalysis.

Improve this answer
0

You must log in to answer this question.