Wi-Fi security vs. government spie
Source: Michael Horowit

Its one thing to be lectured to about Wi-Fi security and quite another thing to see the actual manuals used by government spies.

At The Intercept, Cora Currier and Morgan Marquis-Boire have just published software manuals from "The hacking suite for governmental interception." The software is called Remote Control System (RCS) and it is made by an Italian company, Hacking Team.

The Hacking Team CEO says the software, which can "activate cameras, exfiltrate emails, record Skype calls, log typing, and collect passwords," is used in over 40 countries.

One way of installing RCS software on a target device is over Wi-Fi, and page 117 from the RCS Technicians Guide caught my eye. You can see it below.



RCS offers three types of Wi-Fi attacks: a WPA/WPA2 dictionary attack, WEP brute forcing and WPS PIN brute forcing.

WEP, of course, is the least interesting as it has been known to be terribly insecure for a very long time. The 12 year old kid next door can probably break WEP encryption.

That WPA2 is vulnerable to dictionary attacks is also not news, but, since WPA2 is the best encryption available on Wi-Fi, some advice on choosing passwords is in order.

WPA2 PASSWORDS

The manual says that the WPA2 attack "collects handshakes". This is because the encryption key/password is only transmitted when a device joins a network. Patient spies may not mind waiting for a device to join the target network, but that's not necessary.

Anyone in range of a Wi-Fi network can send a disconnect command to a computing device connected to the network. Then, when the device automatically re-connects, the encrypted password is sent over the air, where it can be captured for later analysis.

There is nothing that Wi-Fi users can do to prevent this. The only defense is to chose a really hard to guess password.

Although the attack is referred to as a dictionary attack, it, no doubt, includes many more guesses than just words in the dictionary. Very likely RCS will also guess words with zeros replacing the letter O, ones replacing the letter I, and threes replacing the letter E. If the software stinks, that's all it will do.

Better software will also try brute force guessing (aaa, aab, aac, etc). A password of 14 or 15 characters should be long enough to defeat most brute force guessing even with computers making a billion off-line guesses a second.



If the software is really good, it will also include a database of stolen passwords.

The many data breaches over the years have yielded millions upon millions of in-the-wild passwords.

A password such as "Mickey Mouse" may be found in a dictionary, but phrases like "DisneysMickey", "IlikeMickeyMouse" or "MinnieMouserules" will not be. But chances are that some person, somewhere, used that as their password at one time. If that password was stolen in a data breach, it may have been added to a database of in-the-wild passwords.

Did you go to Denver last year? Some people did and important things happened to them there. No doubt "Denver2013" has been used as a password by someone, somewhere at some time. Thus, you shouldn't use it.

Defending against a thorough dictionary attack means not using a password that any other human has used before.

A tall order indeed.But not impossible.

Here's a suggestion: start with a name or address and then modify it a bit.

For example, if you live at 123 Main Street, you might use a password of

Pick an arbitrary "something".

Like baseball? Then "BabeRuth123MAINstreeet" is a great password. Better yet is "KC123MAINstreeetRoyals". Each is unlikely to have ever been used before, even by another baseball fan with the same address.

If I were to start with my name, I might use

xyzMICHAEL#horowitz
            - or -
1234michaelQQQhorowitz

Neither is all that hard to remember and each is likely to be globally unique, even though my name is somewhat common (one of me is Winona Ryder's father, another is the Inspector General at the Justice Department).

Of course, there is no reason to start with your name or address.

Like history?

Use "123LooeyTheXIV123". Chances are that other history buffs will not have used it.

Like the St. Louis Cardinals? Then start with the address of Busch stadium and modify it.

700_ClarkAVENUE__63102
        - and -
700#CLARKavenueStLouisMO

are both great passwords.

WPA2 passwords can be up to 63 characters long, and can contain a host of special characters.

WPS

That the Hacking Team software attacks WPS is also not a surprise. Reasonable people may well conclude that WPS was made part of the Wi-Fi standard specifically to allow spying.

WPS operates in four different modes, but its PIN mode is the one with the security flaws.

In this mode, wireless devices can get onto a Wi-Fi network by supplying an 8 digit WPS PIN code instead of a WPA2 password. The WPS PIN code is on a label on the back or bottom of any router that supports WPS. The image below shows the back of an Asus router. The "PIN NO" is the WPS PIN code.
asus.router.wps.pin.code620

The obvious flaw is that anyone in the same room as your router can turn it over, take a cellphone picture of the label on the bottom and get into your network forever.

The other flaw has to do with the PIN codes. Although they are 8 digits, assorted design choices were made that limit the total number of possible PIN codes to 11,000. It doesn't take computers very long to make 11,000 guesses, although on average, only 5,500 will be needed.

I have written about WPS previously on this blog, see The Woops of WPS (Wi-Fi Protected Setup) raises its ugly head again    and Wi-Fi routers: Oldies are goodies.

Optimists advise just to turn off WPS (as far as I know, it is not possible to disable just the PIN mode while leaving the other secure WPS modes of operation enabled). I am not an optimist. When this first got publicized back in 2011, there were routers that did not actually disable WPS, even when instructed to do so.

As a Defensive Computing kind of guy, I would avoid any router that supports WPS, even if it lets you disable the feature. WPS is intellectual pornography.



Avoiding WPS-enabled routers means not using any consumer oriented router, and that's a good thing.