9

My previous home wifi router's WPA2 password was permanently fixed to FZ4HBCKHGC8.

How long would it take to crack via brute force?

Or more pragmatically:

How long would it take to exhaust all possible iterations of this 36 character set {A..Z}+{0..9}?

Improve this question
9
  • 26
    Yes, cause if your WPA2 has been permanently fixed to FZ4HBCKHGC8, it now takes no time to crack it.
    – M'vy
    Apr 24, 2018 at 14:43
  • 9
    @M'vy has succinctly captured a deep truth of password cracking here. If you don't understand why, ponder it until you do.
    – Royce Williams
    Apr 24, 2018 at 14:59
  • 1
    Ponder further. :)
    – Royce Williams
    Apr 24, 2018 at 18:49
  • 1
    I don't get the pondering meme, can someone explain?
    – user1306322
    Apr 24, 2018 at 19:39
  • 1
    @user1306322 They are commenting on the fact that the password that the OP posted now requires only 1 attempt to crack because the fact that they posted it on this site means that it is now public, operating under the assumption that the password shown here is not a placeholder password and that someone can correctly locate the user's router somewhere in the world, given their user information here. There is no meme, just a joke.
    – kloddant
    Apr 24, 2018 at 20:04

2 Answers 2

Reset to default
21

The speed of WPA2, and the speed of modern GPUs, are essential to this answer.

A reasonable prosumer-sized (~US$5K) GPU cracking rig with 6 GTX 1080s can try around 2 million hashes per second - but there are 36^11 candidates to try!

For demo purposes, this is an actual attack, using the example WPA2 hash from the hashcat website:

$ hashcat -a 3 -m 2500 -2 ?u?d hashcat-wpa2.hccapx ?2?2?2?2?2?2?2?2?2?2?2
hashcat (v4.1.0) starting...

OpenCL Platform #1: NVIDIA Corporation
======================================
* Device #1: GeForce GTX 1080, 2029/8119 MB allocatable, 20MCU
* Device #2: GeForce GTX 1080, 2029/8119 MB allocatable, 20MCU
* Device #3: GeForce GTX 1080, 2029/8119 MB allocatable, 20MCU
* Device #4: GeForce GTX 1080, 2029/8119 MB allocatable, 20MCU
* Device #5: GeForce GTX 1080, 2029/8119 MB allocatable, 20MCU
* Device #6: GeForce GTX 1080, 2029/8119 MB allocatable, 20MCU

[...]

Session..........: hashcat
Status...........: Running
Hash.Type........: WPA/WPA2
Hash.Target......: 8381533406003807685881523 (AP:ae:f5:0f:22:80:1c STA:98:7b:dc:f9:f9:50)
Time.Started.....: Tue Apr 24 06:51:26 2018 (54 secs)
Time.Estimated...: Sun Oct 11 02:45:49 4105 (2087 years, 168 days)
Guess.Mask.......: ?2?2?2?2?2?2?2?2?2?2?2 [11]
Guess.Charset....: -1 Undefined, -2 ?u?d, -3 Undefined, -4 Undefined
Guess.Queue......: 1/1 (100.00%)
Speed.Dev.#1.....:   336.2 kH/s (6.89ms)
Speed.Dev.#2.....:   330.8 kH/s (7.03ms)
Speed.Dev.#3.....:   332.0 kH/s (6.96ms)
Speed.Dev.#4.....:   331.1 kH/s (6.97ms)
Speed.Dev.#5.....:   334.2 kH/s (6.90ms)
Speed.Dev.#6.....:   333.8 kH/s (6.90ms)
Speed.Dev.#*.....:  1998.0 kH/s
Recovered........: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.........: 108544000/131621703842267136 (0.00%)
Rejected.........: 0/108544000 (0.00%)
Restore.Point....: 2539520/3656158440062976 (0.00%)
Candidates.#1....: 82TCFESS123 -> 8MXVZONANDA
Candidates.#2....: 9JGXQW12345 -> 9O3QWESS123
Candidates.#3....: 9BBZPANANDA -> 93M1YONANDA
Candidates.#4....: 96RCZONANDA -> 9WMXQW12345
Candidates.#5....: 5S3O3123456 -> 59QC6678999
Candidates.#6....: 40QC6678999 -> 4CUZPANANDA

But don't feel too reassured by the "2087 years" estimate. Fixed passwords often do not require brute force to be cracked. Many permanently fixed WPA2 passphrases are algorithmically generated, and many of those algorithms are either known, or discoverable by reverse-engineering the device's firmware.

Improve this answer
10
  • 1
    How is your rig going to "try around 2 million hashes per second"? Where does it get a test function to tell it whether a guess is correct or not?
    – R.. GitHub STOP HELPING ICE
    Apr 24, 2018 at 23:18
  • 2
    @R.. Normally an attack like this captures some information for offline brute forcing.
    – John V.
    Apr 25, 2018 at 3:26
  • @JohnV.: I'd really like to see how you think that happens.
    – R.. GitHub STOP HELPING ICE
    Apr 25, 2018 at 14:02
  • @R.. ... Are you asking how people capture WPA2 handshakes in order to crack them? Tools to do this have been around for a loooong time. The algorithm for WPA2 is public, and tools like hashcat generate candidates, hash them, and compare them to the original hash - at speed. This isn't a new thing. Maybe we're not understanding your point?
    – Royce Williams
    Apr 25, 2018 at 14:05
  • 1
    @R.. There's no hashed password in the handshake, nor device present, cracking WPA2 basically consists on creating keys and testing against the MIC in the 2nd or 3rd packet of the four way handshake. So... once captured the handshake you don't need the AP, nor the Supplicant ("Victim"/Station). The test function part it's not that hard, just input X quantity of "passphrases" pass them through the PBKDF2 function (4096 times hashed each pass) and mean the time by X.
    – Azteca
    Apr 25, 2018 at 17:33
5

Your password is 11 characters long and has 542,950,367,897,600 combinations. It takes 10,534.62 hours or 438.94 days to crack your password on computer that tries 25,769,803,776 passwords per hour. This is based on a typical PC processor in 2007 and that the processor is under 10% load.

source: https://tmedweb.tulane.edu/content_open/bfcalc.php

enter image description here source: https://www.grc.com/haystack.htm

enter image description here

source:https://asecuritysite.com/encryption/passes

Improve this answer
9
  • 20
    You assume the router will be used to authenticate the password. It won't. The attacker will capture the handshake used for authentication and brute force it offline.
    – ThoriumBR
    Apr 24, 2018 at 13:10
  • 19
    "This is based on a typical PC processor in 2007" Given the processing speed increases in the past decade I don't find this data particularly useful for current cracking estimates.
    – PwdRsch
    Apr 24, 2018 at 16:02
  • 2
    … especially since this is exactly the kind of operation that hugely benefits from the embarrassing parallelism of GPGPU, let alone FPGAs and ASICs.
    – Jörg W Mittag
    Apr 24, 2018 at 20:50
  • 4
    Stuffing three answers that disagree into one "answer" is not helpful. Which one is right? Possibly none of them are computer using the same assumptions as the question?
    – Ben Voigt
    Apr 24, 2018 at 21:17
  • 1
    For asecuritysite, you have [a-zA-Z] checked, not [a-z0-9]
    – Qwerty01
    Apr 25, 2018 at 4:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .