Authentication Cracking: Overview

Summary

Excerpt From WI-FI VULNERABILITIES PART 2 webinar
CTO Dr. Brett Walkenhorst Elaborates on Authentication Cracking.
Despite being an early encryption standard, WEP encryption is susceptible to hacking. CTO, Dr. Brett Walkenhost explains why authentication cracking techniques in Wi-Fi networks start with a warning against using it. He indicates WPS vulnerabilities, the four-way handshake and PMKID capture methods for cracking credentials.

Video Transcript

So authentication cracking. Let's dive into that. The first one that comes up is a very simple one that I I hope we never see anymore, but does occasionally pop up. It's rare. But WEP encryption is the earliest form of encryption that Wi Fi used from its inception and was hacked as early as two thousand one.

So don't use WEP. I'm not gonna say anymore about that because it's really easy to do. There's tools out there that can crack it and and listening to packets for, like, minutes, just a few minutes, and and you're done. Maybe five or six minutes. We'll talk about the others a little bit more detail.

WPS is a mode that tries to make it easier for clients to authenticate to networks, but opens up certain vulnerabilities. We'll dig into the handshake in a bit the four way handshake in a bit more detail because I wanna talk about how people go about cracking credentials using just the handshake.

And then sort of a variant on that handshake, a cracking is something called the PMKID capture and crack. So we'll we'll talk about those. And finally, we're gonna talk about a RADIUS server attack. There there are various ways that you can attack a WPA enterprise Wi Fi network.

We're gonna focus on one attack called the EAP relay attack, which I think is really quite cool. And as a part of that, there's the potential for the hash to be sniffed and cracked if it's using a certain protocol. So we'll talk about that as well. One that I won't talk about is password spraying, but it's a common method that can be used to to try to crack the credentials of a specific user.

It's kind of like an online version of a dictionary attack, which can take a little time, but it's it it it can be done, and and then you've got credentials if the password is relative.