Crack WPA on the cloud

https://www.cloudcracker.com/

by SteveOS • 14 years ago

95 28 14 years ago

cloudcracker.com

bnewbold• 14 years ago

Formerly known as moxie's wpacracker, now with stripe.com payment processing and an API.

icebraining2• 14 years ago

Previous discussion: http://news.ycombinator.com/item?id=982159

mattmaroon• 14 years ago

I love how they quoted Hacker News, as if Hacker News is some sort of editorial team.

icebraining2• 14 years ago

It was actually tptacek: http://news.ycombinator.com/item?id=982197

AndyKelley• 14 years ago

If so, they misquoted tptacek.

abcd_f• 14 years ago

That's pretty creative even if it's prone to abuse. I bet one can source pretty much any quote from HN, in the worst case linking to one's own post :)

peterwwillis2• 14 years ago

Unfortunately pentesters can't send their capture files to third parties, so this has limited uses.

windexh8er2• 14 years ago

Why not? A WPA handshake can be considered public information. Connecting to that particular ESSID yields all that's needed to brute force WPA and would be considered external. There's no limitations this presents to pen testers. However, for $17 this is a relatively small dictionary set. Based on what we use for real world pen testing we have just shy of 1 billion unique words / phrases.

peterwwillis2• 14 years ago

Technically it's public but you need to be responsible with how you deal with your client's data. Even if the NDA says nothing about releasing handshake details, you still have to explain to your client why a WPA-cracking website has details about their infrastructure.

I agree the convenience is attractive but I wouldn't want to put myself in that position.

colonelxc• 14 years ago

That depends entirely on the terms of the engagement. If this service (or others) had agreeable data retention/use terms, then the pentester and the client could include that as an acceptable use of their data.

kevs• 14 years ago

I'm not sure what they're using but if I recall from when this has come up before Amazon's EC2 ToS prohibits this usasge.

martey• 14 years ago

From a Reuters article about a similar program by German security researcher Thomas Roth [1]:

"Nothing in this researcher's work is predicated on the use of Amazon EC2. As researchers often do, he used EC2 as a tool to show how the security of some network configurations can be improved," said Amazon spokesman Drew Herdener.

[1] http://uk.reuters.com/article/2011/01/07/us-amazon-hacking-i...

organico• 14 years ago

Which part of the ToS are you referring to?

veverkap• 14 years ago

But if you can't get on Wifi, how do you reach the cloud? :)

zdw• 14 years ago

Ah, so don't use any of the 300,000,000 words in their dictionary - https://www.cloudcracker.com/dictionaries.html

Any simple password generator (say, Apple's Keychain, or pwgen) should be able to generate a non-dictionary key of length 12-16 characters in a few seconds that would withstand this and most similar techniques for the next few years.

sukuriant• 14 years ago

Where did you get 300m words from? Reading that page, I gathered they had many billion words in their dictionary at the highest price...

lastkarrde• 14 years ago

The big sticker in the top right hand corner of the main page (https://www.cloudcracker.com/css/images/sticker3.png).

chris123• 14 years ago

Interesting. Trend.

thereallurch• 14 years ago

At least someone found a use for all those old bitcoin mining rigs...

cypherpunks01• 14 years ago

And if you lose your important WPA key and can't recover it via dictionary attack, there's always reaver-wps: http://code.google.com/p/reaver-wps/

catch23• 14 years ago

only if they have wps enabled...

icarus_drowning• 14 years ago

A depressingly large number of recently manufactured routers do, and it is on by default by mandate of the WiFi alliance. If the router is Cisco/Linksys, in many instances you can't disable it, at least as I understand it.

dfc• 14 years ago

What pentest team does not have this capability inhouse?

jasonzemos• 14 years ago

I <3 Moxie Marlinspike and all of his work. It's great to see this project is alive and well again.

csomar• 14 years ago

I don't have any knowledge in Wireless networks. Any idea how to use that? Where do I get the handshake file and ESSID?

nodata• 14 years ago

I'd like to see prices for both WPA and WPA2 encryption.

philjohn• 14 years ago

It's times like these I'm glad my WPA password is 63 characters long. It's easy for me to remember though as it's a long sentence. Bit of a pain when setting stuff like Apple TV up though :/

Crack WPA on the cloud

Related Stories