Cracking WPA2 Password Of Belkin Routers

A number of Belkin wireless routers are shipped with a default WPA2 password to protect network connections. The apparently random passwords are printed on a label that’s on the bottom of the router.
Although this approach should be, in theory, more secure, because the password is likely stronger than what many users would set themselves, it turns out that the random passphrases aren’t so random.

The researchers have determined that the password is based on the device’s WAN MAC address, and since this information is not so difficult to obtain, a remote attacker could easily hack into a targeted network – given that the default configuration is used.

The default password is made of 8 characters which can be determined by replacing each hex-digit of the WAN MAC address with another value from a static substitution table.
Several device models are affected, including Belkin N450 Model F9K1105V2 and Belkin Surf N150 Model F7D1301v1.

The experts claim to have contacted Belkin back in January, but since they haven’t received any response, they’ve made their findings public. In the meantime, they advise users to change their default passphrases to something stronger and, implicitly, more secure.

Vulnerability :

Having a preconfigured randomly generated WPA2-PSK passphrase for wireless routers is basically a good idea since a vendor-generated passphrase can be much more secure than most user-generated passwords. However, in the case of Belkin the default password is calculated solely based on the mac address of the device. Since the mac address is broadcasted with the beacon frames sent out by the device, a wireless attacker can calculate the default passphrase and then connect to the wireless network.
Each of the eight characters of the default passphrase are created by substituting a corresponding hex-digit of the wan mac address using a static substitution table. Since the wan mac address is the wlan mac address + one or two (depending on the model), a wireless attacker can easily guess the wan mac address of the device and thus calculate the default WPA2 passphrase.

Moreover, the default WPA2-PSK passphrase solely consists of 8 hexadecimal digits, which means that the entropy is limited to only 32 bits (or 33 bits since some models use uppercase hex digits). After sniffing one successful association of a client to the wireless network, an attacker can carry out an offline brute-force attack to crack the password. The program oclhashcat-plus can try 131,000 passwords per second on one high end GPU (AMD Radeon hd7970) [Link]. Doing a full search of the 32-bit key space takes about 9 hours at this rate.

An attacker can exploit this vulnerability to calculate the WPA2-PSK passphrase of a wireless network. This allows sniffing and decrypting all wireless traffic in a purely passive attack given that the attacker has also sniffed the association.

Affected device :  

 

Belkin Surf N150 Model F7D1301v1
Belkin N900 Model F9K1104v1
Belkin N450 Model F9K1105V2
Belkin N300 Model F7D2301v1

How To Secure Yourself : 

Users of potentially affected wireless routers should change the wireless passphrase to something more secure.

Read more

Moscrack v2.02b Cluster WPA cracker

Moscrack is intended to facilitate the use of a WPA cracker on a cluster. Currently it has only been used with Mosix (clustering software) and SSH nodes. It works by reading a wordlist from STDIN or a file and breaking it into chunks and passing those chunks off to seperate processes that run in parallel. The parallel processes can then execute on different nodes in the cluster. All results are checked (to a degree) and recorded on the master node.

Version info

This release contains a new plugin framework that allows Moscrack to be extended beyond it's original design. Currently there are only two plugins. Pyrit and Dehasher. SVN will always have the latest bug fixes and enahancements. SVN download: https://moscrack.svn.sourceforge.net/svnroot/moscrack

 Requirements

Master server:

- Linux or possibly others
- Mosix (optional)
- zenity (GUI support)
- Pyrit (optional)
- rsh/rcp clients (optional)
- scp client (optional)
- Perl 5.8
- Perl DateTime
- Perl Math::Round
- Perl Getopt::Lucid
- Perl Acme::Tools
- Perl Storable
- Perl Term::ANSIColor
- Perl File::Basename
- Perl Sruct::Compare
- Perl LWP::UserAgent
- Perl HTTP::Request
- Perl Net::SSH2
- Perl Compress::Zlib
- Perl Config::Std

End nodes:

Linux/Cygwin/FreeBSD/Solaris/MacOSX/iPhone all tested or Moscrack Live CD. One of Mosix, SSH v2 daemon, RSH daemon, Pyrit in serve mode. Aircrack-NG v1.1 unless using Pyrit

Installation

- Run ./install_modules to check for (and optionaly install) required Perl modules
-Copy moscrack, mosctop, moscd to anywhere you like, possibly in your path like /usr/local/bin
- Copy moscrack.cgi to your web servers cgi-bin
- Edit moscrack.conf and copy to /etc/moscrack/moscrack.conf
- Copy plugins/ to /etc/moscrack/plugins/
- Create a working directory (home) for Moscrack (e.g. /opt/moscrack/)
- Edit nodes.dat and add all of your nodes and type. The format is documented in the file. Copy it to where   you specified in the configuration file
- Tune nodes.dat (mandatory). See "Auto tuning mode" and optionaly "Performance" for details
- If using ssh nodes, setup public-key authentication with each node (e.g. ssh-copy-id user@node)
- If using rsh nodes, configure .rhosts file on each node
- Install Aircrack-NG on each node
- Make sure you can access all nodes (of any type) without a password
- Launch "moscd" if using dynamic nodes
- Run "moscrack"
- In another terminal, optionally run "mosctop" relative to the Moscrack working directory to watch what's   going on .


                             DOWNLOAD : HERE

Read more