LLegoLLaS Posted August 15, 2014 Report Share Posted August 15, 2014 # Exploit Title: Sky Broadband Router Â? Weak algorithm used to generate WPA-PSK Key# Google Dork: # Date: 08/08/2014# Author: Matt O'Connor / Planit Computing# Advisory Link: http://www.planitcomputing.ie/sky-wifi-attack.pdf # Version: # Category: Remote# Tested on: Sky SR101 RouterThe SR101 routers supplied by Sky Broadband are vulnerable to an offline dictionary attack if the WPA-PSK handshake is obtained by an attacker.The WPA-PSK pass phrase has the following features:Â? RandomÂ? A to Z Uppercase onlyÂ? 8 characters longÂ? 208,827,064,576 possible combinations ( AAAAAAAA Â? ZZZZZZZZ ) 26^8We notified Sky Broadband about the problem in January 2014 yet Sky Broadband are still supplying customers with routers / modems that use this weak algorithm.At the time, graphics cards were expensive and clustering several machines was not financially viable to the average hacker.We purchased a used rig in December 2013, comprising off:Â? Windows 7Â? I3 ProcessorÂ? 4GB RAMÂ? 2TB DriveÂ? Radeon HD 5850We generated 26 dictionary files using Â?mask processorÂ? by ATOM, piping each letter out to its own file, for example:A: ./mp32 A?u?u?u?u?u?u?u > A.TXT = AAAAAAAA Â? AZZZZZZZB: ./mp32 B?u?u?u?u?u?u?u > B.TXT = BAAAAAAA Â? BZZZZZZZetcEach .txt file weighed in at around 60GBÂ?s each. The 26 files took up about 1.6TB of storage.We now had the complete key space, partitioned into 26 different files. This allowed us to distribute the brute force attack amongst multiple computers. There are other ways with ocl-hashcat but this was the simplest.Using our Radeon HD5850 on standard settings, we were hitting 80,000 keys per second. Breakdown below:Â? 26^8 = 208,827,064,576 ( 208 billion possible combinations )Â? 26^8 / 80,000 keys per second = 2,610,338 secondsÂ? 2,610,338 / 60 seconds = 43,505 minutesÂ? 43,505 / 60 minutes = 725 hoursÂ? 725 hours / 24 hours = 30 DaysFor Â?185, we had built a computer that could crack the default Sky Broadband wireless password within 30 days. The WPA-PSK handshake we used started with the letter S and was cracked within 96 hours.We ended up getting a second machine for the same price which resulted in our maximum cracking time being reduced to 15 days.If youÂ?re using the default password on your Sky Broadband connection, we recommend changing it immediately to a more secure password, using a mix of letters, numbers and symbols.sursa: bugsearch.net Quote Link to comment Share on other sites More sharing options...