0

"I hack your Wifi in 5 Minutes" still seems to be a hot topic on youtube in 2023, atleast on beginner channels like David Bombal. However, is there still any real world application? Even before the advent of WPA3?

Handshake-Capture + Password Cracking: What company hires an expensive pentester for their Wifi network and uses crackable passwords? Not even my Non-IT-Friends use crackable passwords...

WPS-Attacks and a multitude AP DoS Exploits: Works on hardware from the stone age...

KRACK & FRAG: No public exploits available and even if they were.. they dont seem very dangerous.

Rogue APs / Evil Twins: For a long time this was supposed to be the only practical way to attack Wifi networks. But this seems to be completely useless nowadays aswell. Not even Deauth attacks work on halfway modern hardware. Even cheap consumer grade Routers/APs you get for "free" from your ISP are resistant to deauth attacks. And that is WITHOUT PMF.. Sometimes i can deauth some old/cheap devices but my Samsung S22 Ultra or my updated Windows 10 Machine never gets disconnected. Airepleay Broadcast, Airepleay Targeted, MDK3, MDK4, Scapy etc. nothing works here. And yes, i triple checked interface channel, mode, airmon kill etc. I also tried 4 different modern Adapters which all support 5 GHz 802.11ac. I even ran them in parallel and deauthed 2.4Ghz channels and 5Ghz at the same time. I also used airgeddons DoS Pursuit Mode, even tho the APs didnt channel hop to evade the attack. On my Routers/APs from 2010 i can deauth all devices all day long, but not on any modern hardware. And even if i can reliably disconnect clients, none of them are are still dumb enough to immediately switch to an open Access Point with the same SSID... so you could try some Mana Attack variant and hope to find an open Wifi in the clients PNL and let him connect.. and then phish them while they are connected to "Starbucks Free Wifi" while sitting at work :-D.

Am i missing something here? I would rather sell my clients the 10th Network Pentest/Phishing Training Campaign/Physical Assessment than a Wifi Pentest.

4
  • 4
    What company ... uses crackable passwords All passwords are crackable, its just a matter of how long it takes to crack.
    – wireghoul
    Feb 7, 2023 at 22:40
  • Well i meant crackable in the sense that it is even remotely feasible to crack the password in less than a year. Which is not the case in any wifi password i have seen in the last few years.
    – breachr
    Feb 8, 2023 at 0:02
  • Good for you, I know plenty of testers that still break trivial passwords and lateral into orgs. Especially when orgs have several WiFis such as BYOD and guest and may not have as good firewall rules as they thought they did.
    – wireghoul
    Feb 8, 2023 at 0:19
  • You just did a crap ton of wifi penetration testing, and you're not dead. What do you mean exactly? I think maybe you are asking whether there is a market for wifi penetration testing...?
    – John Wu
    Feb 9, 2023 at 8:38

4 Answers 4

2

Yes and No.

What makes Wi-Fi testing "dead" is the fact that a lot of mitigations were included in consumer-grade access points. The default setting in most access points is a random SSID (to prevent pre-computation), WPA2-AES, WPS disabled or requiring physical interaction and a reasonably secure default password. And on the enterprise side, we have WPA2 Enterprise using client certificates for access, which are currently uncrackable.

This is a good thing! I know, as testers we get frustrated when our attacks are fruitless, but I remember a time in which there were three APs named "linksys" in my street, all of which unprotected. And the rest used WEP, which was almost as bad. Again, let me emphasize that the fact that the average access point can't be pwn'd in 5 minutes anymore is good.


That said, not every access point is up-to-date. Access points are the kind of infrastructure, which no one really cares about, as long as they work. Like, when was the last time you consciously thought about the plumbing in your home? As long as it works, it just keeps working and no one pays attention to it.

This is especially true in large companies, and doubly especially if these companies need to provide access to legacy devices, some of which are old enough to not even support WPA.

In this case, your task as a pentester is to identify these legacy devices, attack them if possible, demonstrate the vulnerabilities and see what access this would give to an attacker.

For example, a WEP access point, which gives access to 5 legacy devices used for scanning parcels in a warehouse, and one server used to receive the scans, is not as valuable as that same access point giving access to the entire network.

In other words: Your job as penetration tester is not to wow the customer and demonstrate how broken everything is, but to accurately assess risks and suggest mitigation measures for them.

1
  • The fact that many companies are forced to support legacy devices/software is the reason why some "ancient" vulnerabilities refuse to die. This is true for many more things, not just Wi-Fi.
    – Frittata
    Feb 8, 2023 at 2:32
0

It's not dead, just a waste of energy to care about for most. Enterprise wi-fi and a hack inbound is a big risk, but unless your network team is incompetent, a very high bar. Still worth at least auditing though.

For consumer wi-fi, just being used as a way out to the internet, this is no big deal. Nearly everything uses TLS now, and the internet itself is a cesspool. Russian or N Korean hackers aren't gonna war drive your house.

0

I would like to focus on this point:

What company hires an expensive pentester for their Wifi network and uses crackable passwords?

Theoretically, a company would only hire an expensive pentester after they have configured everything correctly. In which case, why would they need a pentester? Pentesters of big, reputable companies, don't only find extremely subtle weaknesses that are unlikely to prevent.

It's hard to find (publicly) what kind of vulnerabilities pentesters are finding on their clients. But you can sometimes learn about vulnerabilities that were not found¹ and resulted in a big incident.

These include trivial things like hardcoded passwords, privileged endpoints that don't require authentication, outdated software with well-known critical vulnerabilities…

In the realm of passwords, you could find secure passwords created randomly that are not vulnerable to cracking, but also default passwords, initial ones that were never changed, passwords chosen by the users that are very weak, credential reuse…

So I wouldn't be surprised that such pentester could crack a number of passwords. In fact, a big part of the move to MFA lies on not trusting the users to choose and keep safe proper, unique, passwords. Why should those used for Wifi any different?

And that's basically the point of penetration testing: letting someone else to discover that what you built wasn't really as secure as you thought.

¹ Probably because there was no pentesting

0

It's not dead, it just moved to a different layer (Wifi RCE, Baseband Attacks):

Linux Kernel Wifi RCE:

https://lwn.net/ml/oss-security/[email protected]/

"CVE-2022-41674: fix u8 overflow in cfg80211_update_notlisted_nontrans (max 256 byte overwrite) (RCE) ..."

Wifi attack against Android or iOS devices with Broadcom chipset aka Broadpwn (CVE-2017-9417):

https://blog.exodusintel.com/2017/07/26/broadpwn/

Wifi RCE against iOS devices (cve-2021-30800):

https://blog.zecops.com/research/meet-wifidemon-ios-wifi-rce-0-day-vulnerability-and-a-zero-click-vulnerability-that-was-silently-patched/

These attacks don't require any authentication/password cracking and give a high level of privilege.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .