View Single Post
StefanL's Avatar
Posts: 298 | Thanked: 341 times | Joined on Aug 2010 @ This world :)
#41
I ran some tests on my router last night (Netgear WNDR 3400) in the standard mode
Code:
sudo ./reaver -i mon0 -b XX:XX:XX:XX:XX:XX -vv
and ended up with a rate of 320ish seconds/attempt. There were loads of timeouts reported by reaver and everytime it hit a pin the WPS button on top flashes (like when you are performing a normal WPS connection). I used airmon-ng to turn on the mon0 interface and ran other internet activities (downloads on gpodder on the N900 and my computer connected via LAN) during the test. Noticed that the downloads on the N900 were interupted when reaver reported testing of a pin, but continued when reaver reported the time-outs. A few times the N900 reset it's wireless connection and reconnected automatically.

The number of succesful pins tried was variable, sometimes 1, sometimes 7 in a row before getting the time-out messages.

The log file (mac_to_crack.wpc) created by reaver has a total of 11003 lines and starts of with the number 135, a zero each on the next 2 lines (this seems to correspond with actual progress, first half and second half found pin values) and then a whole bunch of 4 digit numbers (the first half of the pins to be tried) on a line each for the next 10000 lines and then a bunch of 3 digit numbers (the second half of the pins to be tried) for the next 1000 lines. This attack has a maximum number of 11000 (10000 + 1000) tries to succeed (readme for reaver).

For my router at least, this standard attack is pretty useless, after 12 hrs I got 1.09% of the pins and the flashing light let's you know that something is going on. WPSCrack is supposed to be faster, but I have not yet been able to run it successfully on the N900.

Edit/Update:
Best command line options for my router thus far is the following:
Code:
sudo ./reaver -i mon0 -b XX:XX:XX:XX:XX:XX --dh-small -t 1 -vv -d 0 --eap-terminate
Still getting plenty of time-outs, but speed is now down to less than 100 secs/attempt and I got to 1.22% within a few hours and at a rate of 56 secs/attempt. Still not anywhere near the '4-8 hrs to crack' advertised elsewhere on the web. Interesting exploit, but not all that useful on my set-up.

When running the -p option with the correct pin, the program cracked the key in 64 seconds, displays the correct pin, the correct WPA PSK key and lists the correct AP SSID. It does not update the log file when running it with a specific pin.

A list of affected routers can be found here.
__________________
My phone evolution: Nokia 7610 (RIP), N82 (RIP), BB9000 (RIP), N900, BB9760 (RIP), N8, BB9900, N9 64GB
Working : Python Gorillas (Maemo5) Faircrack0.50 Update (Maemo5)
Not so much : WPScrack (Maemo5)

Last edited by StefanL; 2012-01-09 at 07:34. Reason: More info added
 

The Following 4 Users Say Thank You to StefanL For This Useful Post: