Over 70% of Wi-Fi networks from a sample size of 5,000 were hacked with “relative ease” in the Israeli city of Tel Aviv, highlighting how unsecure Wi-Fi passwords can become a gateway for serious threats to individuals, small businesses, and enterprises alike.
CyberArk security researcher Ido Hoorvitch, who used a Wi-Fi sniffing equipment costing about $50 to collect 5,000 network hashes for the study, said “the process of sniffing Wi-Fis and the subsequent cracking procedures was a very accessible undertaking in terms of equipment, costs and execution.”
The new Wi-Fi attack builds on previous findings by Jens “atom” Steube in 2018 that involves capturing what’s called the PMKIDs associated with a client (aka SSID) in order to attempt a brute-force attack using password recovery tools like hashcat.
PMKID is a unique key identifier used by the access point (AP) to keep track of the pre-shared key — i.e., pairwise master key aka PMK — being used for the client. PMKID is a derivative of AP’S MAC address, client’s MAC address, PMK and PMK Name.
“Atom’s technique is clientless, making the need to capture a user’s login in real time and the need for users to connect to the network at all obsolete,” Hoorvitch said in the report. “Furthermore, it only requires the attacker to capture a single frame and eliminate wrong passwords and malformed frames that are disturbing the cracking process.”
The collected hashes were then subjected to a “mask attack” to determine if cell phone numbers were used as Wi-Fi passwords, a practice common in Israel, uncovering 2,200 passwords in the process. In a subsequent dictionary attack using “RockYou.txt” as a password source, the researcher was able to crack an additional 900 hashes, with the number of breached passwords decreasing as the password length increased.
A successful compromise of the Wi-Fi network could enable a threat actor to mount man-in-the-middle (MiTM) attacks to gain access to sensitive information, not to mention pivot laterally across the network to breach other critical systems that are connected to the same network.
“The lesson here? The longer the password, the better,” Hoorvitch said. “A strong password should include at least one lower case character, one upper case character, one symbol, one digit. It should be at least 10 characters long.”