Introduction

This is not a step-by-step tutorial. Many basic concepts are intentionally omitted here. If you are interested in them, you can study those topics separately.

Hardware Environment

• Raspberry Pi
• FAST FW300U USB Wi-Fi adapter (rtl8192cu)

Software Environment

• Debian Jessie
• Aircrack-ng 1.2 rc2
• Reaver v1.4

Notes

On the hardware side, not every wireless adapter will work. First of all, the adapter must support Monitor Mode. An adapter with an external antenna is preferable.

On the software side, I recommend the version of Aircrack-ng listed above or a newer version. If your distribution’s package repository does not provide it, you can compile it yourself.

The compilation and installation process will not be covered here.

Aircrack-ng is a suite of tools for attacking and analyzing IEEE 802.11 WEP and WPA-PSK security.

Reaver is a tool for attacking WPS PINs and, from a successfully recovered PIN, obtaining the WPA passphrase.

When attacking a Wi-Fi network, the approach mainly depends on its security configuration:

• WEP: Can usually be cracked very quickly.
• WPA/WPA2: Requires capturing a handshake and then attempting to recover the password using a dictionary.
• WPS: If the router supports PIN-based WPS authentication, the PIN may be brute-forced using Reaver.

There are also quite a few driver issues with the Raspberry Pi and rtl8192cu combination. If you happen to be using the same setup, I may write another article later describing the rather painful process of fixing those problems.

Preparation

First, the wireless adapter needs to be switched into Monitor Mode.

Assuming your wireless interface is wlan0:

airmon-ng start wlan0

Pay attention to the messages printed by airmon-ng. It may warn you about processes that could interfere with monitoring or packet injection.

If a new interface such as mon0 or wlan0mon appears, Monitor Mode has been successfully enabled.

Next, run:

airodump-ng --wps wlan0mon

This lists the Wi-Fi access points currently visible to the adapter.

Now choose a target. There are several things worth paying attention to:

1. Choose an AP whose Beacons counter is increasing. At least you know the access point is alive.
2. A stronger signal is always preferable. In airodump-ng, this generally means a smaller absolute PWR value.
3. For WEP or WPA/WPA2 attacks that depend on capturing traffic, there normally needs to be an active client communicating with the AP.
4. If the network uses WEP and has active traffic, it is usually the easiest target because cracking WEP requires very little time.
5. An AP with WPS enabled and a strong signal can be suitable for PIN brute-forcing. For weak signals, it generally isn’t worth trying. The wash command is useful for identifying WPS-enabled APs; see the WPS PIN section below.

Got a target?

Let’s get started.

This article focuses on three methods:

1. WEP cracking
2. WPA/WPA2 cracking
3. WPS PIN cracking

For the examples below, assume our target has the following properties:

ESSID:   MyTarget
BSSID:   01:02:03:04:05:06
Channel: 6

Also assume there is a client communicating with it:

99:98:97:96:95:94

WEP Cracking

WEP (Wired Equivalent Privacy) was included as part of the IEEE 802.11 standard adopted in September 1999.

Its encryption mechanism uses the RC4 stream cipher as a pseudorandom generator. An initialization vector (IV) is combined with the WEP key to produce a seed, which is fed into RC4 to generate the WEP keystream. The keystream is then XORed with the payload of a WEP frame to produce the ciphertext.

RC4 generates the WEP keystream by performing a series of permutations and transformations on the seed key.

Because the first byte of the data payload in a WEP frame belongs to the LLC header, and this information is predictable across WEP frames, an attacker can XOR a guessed plaintext byte with the corresponding ciphertext byte to recover information about the first byte of the PRNG-generated keystream.

Furthermore, the 24-bit initialization vector is transmitted in plaintext and can therefore be captured by an attacker.

Because the IV space is limited, IV values will eventually repeat. In practical implementations, IV reuse can occur much sooner than would be desirable. Based on the birthday paradox, collisions become increasingly likely after a relatively small fraction of the entire IV space has been observed.

If an AP is transmitting large numbers of packets every second, IV collisions can therefore occur surprisingly quickly. Even implementations that simply increment IV values will eventually reuse them.

The reuse of an IV is known as an initialization-vector collision, and it seriously weakens confidentiality.

Suppose we know two ciphertexts produced using the same IV:

Ciphertext1
Ciphertext2

Because plaintext often contains statistically predictable structures, dictionary and statistical attacks can be used to infer possible values of:

Plaintext1
Plaintext2

CRC values can then help determine whether a guess is correct.

Numerous practical attacks have demonstrated that knowledge of IVs, portions of the keystream, and weaknesses in how RC4 was used by WEP can ultimately be exploited to recover the WEP key.

WEP’s CRC-based integrity mechanism also has weaknesses.

A CRC checksum is a linear function with respect to XOR operations:

C(x + y) = C(x) + C(y)

An attacker can take advantage of this property to modify plaintext.

If the attacker knows the plaintext being transmitted—a known-plaintext attack—the RC4-generated keystream can be derived:

RC4PRGA(Seed) = Plaintext + (Plaintext + RC4PRGA(Seed))

The attacker can then construct modified encrypted data:

Ciphertext' = (Plaintext', CRC32(Plaintext')) + RC4PRGA(Seed)

and transmit it using the original IV, since 802.11 WEP permits IV reuse.

Aircrack-ng uses the PTW method—named after Pyshkin, Tews, and Weinmann—by default. Dictionary-based methods are also available.

Here we will only discuss the default approach, which is generally the most effective one.

Assume MyTarget uses WEP encryption.

First, begin capturing packets:

airodump-ng --ivs -w MyTarget.ivs -c 6 wlan0mon

The options mean:

• --ivs — Instead of saving all wireless traffic, save only IV-containing data useful for WEP cracking. This can significantly reduce the size of the capture file.
• -c 6 — Set the channel of the target AP. From our previous observation, the target wireless router is operating on channel 6.
• -w MyTarget.ivs — Specify the output filename.

Packet capture now begins.

If a wireless client connected to the router/AP is generating a large amount of traffic—for example, downloading large files—it may be possible to recover the WEP password simply by passively collecting enough packets.

However, waiting for sufficient traffic can take too long.

One technique traditionally used to accelerate the process is an ARP Request injection attack. The attacker captures ARP request packets and retransmits forged or replayed packets to stimulate the AP into generating additional traffic.

For example:

aireplay-ng -3 -b 01:02:03:04:05:06 -h 99:98:97:96:95:94 wlan0mon

Where:

• -3 — Use ARP Request replay/injection mode.
• -b — Specify the AP’s MAC address.
• -h — Specify the client’s MAC address.

After collecting enough IVs, open another shell and run Aircrack-ng:

aircrack-ng -b 01:02:03:04:05:06 MyTarget-0xx.ivs

If cracking fails, continue capturing packets with airodump-ng for a while and then run aircrack-ng again.

Repeat until Aircrack-ng reports:

KEY FOUND

At that point, the WEP key has been recovered.

So how insecure is WEP?

In 2005, a team from the FBI publicly demonstrated that a WEP-protected wireless network could be cracked using publicly available tools in approximately three minutes.

In other words, WEP is little more than something that might scare away someone who doesn’t know how it works.

WPA/WPA2 Cracking

WPA originated as an interim implementation based on the developing IEEE 802.11i standard.

Chip manufacturers clearly needed a more secure replacement for WEP while still maintaining compatibility with existing hardware. Through relatively simple firmware upgrades, WPA could be deployed on many products originally designed for WEP.

WPA uses TKIP, which is also based on RC4 but improves upon WEP and addresses weaknesses such as weak-IV attacks.

It also uses MIC for message integrity.

For WPA networks using TKIP and MIC, practical password recovery generally depends on brute-force or dictionary attacks against the authentication credentials rather than directly breaking the underlying cryptographic algorithm.

Exhaustive brute-force attacks against strong passwords are computationally impractical on ordinary PCs.

Dictionary attacks, on the other hand, typically use collections containing:

• English words
• Numbers
• Common passwords
• Usernames
• Forum IDs
• Previously leaked credentials

Unlike WEP, WPA cannot normally be “instantly cracked” simply by collecting enough packets.

The major exception is when the attacker has a good password dictionary and the victim has chosen a weak or predictable password.

Adding uncommon characters and using sufficiently long, randomly generated passwords can therefore significantly improve security.

WPA2

WPA2 is the successor to WPA and is supported by modern wireless adapters and access points.

WPA2 introduced stronger cryptography:

• CCMP replaced WPA’s older integrity mechanisms.
• AES replaced TKIP/RC4 as the primary encryption algorithm.

Because the underlying cryptographic algorithms are considerably stronger, attacking WPA2-PSK generally means attempting to recover the password itself.

Exhaustive brute-force attacks against sufficiently strong passwords are effectively impractical, while dictionary attacks depend heavily on whether the password appears in—or resembles something contained in—the attacker’s dictionary.

In that sense, guessing a strong WPA2 password with a dictionary can feel a lot like buying a lottery ticket.

Wireless networks have therefore become significantly more secure over time while simultaneously achieving greater range and higher speeds.

There are various password-strength testing websites available online if you want to get an intuitive idea of how password complexity affects resistance to guessing attacks.

Assume MyTarget uses WPA.

Before capturing traffic, it can be useful to update airodump-ng’s OUI database so that wireless hardware manufacturers can be identified more accurately.

Enter the Aircrack-ng installation directory and run:

airodump-ng-oui-update

Now begin capturing packets:

airodump-ng -w MyTarget -c 6 wlan0mon

Notice that, compared with the WEP example, there is no --ivs option.

In other words, we capture complete packets.

For WPA cracking, however, what we really need is a complete authentication handshake.

The problem is that the handshake is transmitted when a client connects to the network. Simply waiting for a new connection can require quite a bit of luck.

This is where a deauthentication attack can be used.

A specially crafted Deauth frame is transmitted to force an already-connected wireless client to disconnect from the access point. The client will normally attempt to reconnect automatically, creating another opportunity to capture the WPA-PSK authentication handshake.

For example:

aireplay-ng -0 1 -a 01:02:03:04:05:06 -c 99:98:97:96:95:94 wlan0mon

One important requirement is that a client must currently be connected to the target access point. If nobody is connected, this technique doesn’t help.

Also, if you fail to capture a handshake, don’t continuously flood the AP with deauthentication attacks. Some routers implement protection mechanisms against this behavior.

If the handshake is captured successfully, airodump-ng will display a message similar to:

WPA handshake

This indicates that the required handshake packets have been captured.

Once the WPA-PSK authentication traffic has been successfully captured, password recovery can begin:

aircrack-ng -w dictionary.txt -l key.txt MyTarget-01.cap

Where:

• -w dictionary.txt — Specify the dictionary file. A good dictionary is critical to the success of this approach.
• -l key.txt — If the password is recovered successfully, write it to key.txt.

Whether the attack succeeds depends mainly on two things:

1. The computational performance of the machine.
2. The quality and relevance of the password dictionary.

It may therefore be useful to copy the .cap file to a faster computer for offline processing.

If packet capture runs for too long, the .cap file can become very large.

In reality, most of the captured traffic is unnecessary because only the handshake and related information are needed.

Wireshark can be used to filter the capture using:

eapol.type == 3 or wlan.fc.type_subtype == 0x08

The first expression preserves frames containing key information, while the second preserves beacon frames.

WPS PIN Cracking

WPS (Wi-Fi Protected Setup) is a certification program introduced by the Wi-Fi Alliance.

Its primary purpose is to simplify wireless LAN installation and security configuration.

WPS is not itself a new encryption technology. Instead, it makes existing Wi-Fi security mechanisms easier for ordinary users to configure.

For users, WPS provides a relatively simple way to connect devices securely.

Devices supporting WPS can quickly establish a connection with a WPS-enabled wireless router. One of the supported mechanisms uses an eight-digit numeric Personal Identification Number (PIN).

This avoids requiring users to manually enter the network name (SSID) and a potentially long wireless password when connecting a client.

Why Was the Original WPS PIN Design Vulnerable?

There are several important design weaknesses.

First, in PIN-based WPS authentication, possession of the correct PIN is sufficient for obtaining access. No additional authentication mechanism is required, making brute-force attacks possible.

Second, the eighth digit of the WPS PIN is a checksum.

Therefore, an attacker only needs to determine the first seven digits.

Instead of:

10^8

possible PIN combinations, the effective search space is reduced to:

10^7

or 10 million possibilities.

More importantly, during WPS PIN authentication, the access point validates the PIN in two separate portions:

• The first four digits.
• The remaining three non-checksum digits.

Research by Stefan Viehböck showed that when a PIN authentication attempt fails, the router’s EAP-NACK response can reveal whether the first or second portion of the PIN was incorrect.

In other words, instead of searching all seven digits simultaneously, an attacker can search for a four-digit value and then a three-digit value.

This reduces the effective number of possibilities from approximately 10 million to roughly:

10^4 + 10^3 = 11,000

possible attempts.

On average, approximately half that number of attempts may be required.

This weakness made recovering WPS PINs within a matter of hours feasible against vulnerable implementations.

Detecting WPS

Reaver 1.4 includes tools that can detect the WPS state of nearby access points.

Run:

wash -i wlan0mon -C -s

Note that if wash produces no output for a long time, you may have encountered a bug.

One workaround is to create an empty directory:

/etc/reaver

Assume MyTarget has WPS enabled.

We can then run:

reaver -i wlan0mon -b 01:02:03:04:05:06 -c 6 -o MyTarget.log -s MyTarget.session -a -D -S -d9 -t9 -l60 -r10:5 -v

Some commonly used options include:

• -c — Channel.
• -o — Log output file.
• -s — Session file, allowing an interrupted cracking session to be resumed later.
• -a — Automatically detect suitable options for the target AP. I still prefer selecting the parameters manually.
• -D — Run as a background daemon.
• -d — Delay between PIN attempts.
• -t — Timeout.
• -v — Logging verbosity. -vv provides more detailed output.
• -l — Waiting period when the AP becomes locked.
• -r — After every x attempts, wait y seconds.
• -S — Use smaller DH keys to improve attack performance.
• -n — Always send a NACK to the target AP.

These are some of the commonly used parameters. See Reaver’s built-in help for additional options.

After that, it’s mostly a matter of waiting.

There are a few things worth noting:

1. If Reaver reports can't associate, the signal may be too weak or there may be a problem with the wireless adapter or its driver.
2. If the AP becomes locked after a while, increasing the lock-delay setting may help. If it remains permanently locked, however, the router may have a security policy that requires administrator intervention before WPS can be used again.

If the attack succeeds, congratulations—or perhaps condolences to the router owner—the WPS PIN, SSID, and wireless password may all be recovered.

Conclusion

Know yourself and know your enemy, and you need not fear the result of a hundred battles.

Once you understand how these attacks work, the defensive measures become fairly obvious:

• Use WPA2 or a newer security standard.
• Use a long, strong, and unpredictable password.
• Disable QSS and WPS, especially PIN-based WPS.
• Keep the router’s firmware up to date.

Hiding the SSID can reduce casual visibility, although it should not be treated as a meaningful security mechanism on its own.

The real protection comes from using modern encryption, strong credentials, and disabling vulnerable legacy features.