2

For quite a while I've been experimentally hacking wireless routers by capturing handshakes and Decrypting them using oclHashcat on my computer. even the most complicated passwords won't take longer than 10 days with powerful GPUs available these days and also Wireless networks based on Radius server are so vulnerable to such attacks.

Is there any way to prevent an attacker from even capturing my WI-FI WPA-2 AES handshake and secure my wireless network against this attack?

  • You need to use an EAP (extensible authentication protocol). PEAP is a common one that uses SSL. Make sure clients are configured to verify the AP's certificate. – paj28 Feb 6 '15 at 23:16
  • @paj28, that's not AES and even if i use EAP, does it prevent others from capturing handshake? – Conspiria Feb 7 '15 at 8:07
  • @Saeed - people can capture the handshake, but it protected by SSL, so they can't brute force the password. Makes it safe to use low-entropy passwords. After authentication is complete, PEAP uses WPA2-AES just the same as if you'd used PSK. – paj28 Feb 7 '15 at 12:39
  • that seems really great, thanks. is there any requirements for devices to be able to connect using PEAP like firmware upgrade or an app or any ordinary Wifi supported device can connect? – Conspiria Feb 8 '15 at 20:10
4

No, it's not possible to prevent someone from capturing the handshake.

A properly implemented password with enough entropy can withstand even a very well funded attacker. The example hash rates given for the highest end machine are still only about 1 million hashes a second on a machine with 8 GPUs. In a year you could do 1,000,000*60*60*24*365=3*10^13 passwords, or about 44 bits. If you really want to be secure, generate a random 128 bit password, and print it on your router. This will be secure from any brute force attempt, though it won't save you from rubber hose cryptanalysis.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.