I was browsing YouTube and I came across this video In the video they show how to crack the password of a wifi using CommView, Aircrack and Wordlist.

According to the video it takes about two minutes to crack the password, but I guess it can take a longer time, depending on the difficulty of the password. But what is the downside of this method? I mean, if it is so easy to crack a wifi password, why do wifi which requires payment exist, for example on an airport?

Is the likehood of getting caught 100 percent? Or was the person in the video cracking an "easy" wifi?

And to the main question, how does one protect oneself from an attack like this?

  • 3
    It depends on which encryption is used on the network. WEP can indeed be cracked in minutes given the right conditions regardless of the strength of the key. WPA and WPA2 are pretty secure however and the only option is brute force which isn't practical of the key is strong. – André Borie Sep 4 '16 at 23:01
  • Usually when you get a new router the password is something like "e43FkO21fda", I would guess this is a though one using bruteforce? @AndréBorie – Olba12 Sep 4 '16 at 23:04
  • There is several reasons why brute force is not what one should think about when thinking about getting network access – happy Sep 5 '16 at 1:11

Essentially, yes, the person in the video was cracking an "easy" WiFi. The password chosen to secure the network ("plausible") was simple enough to be contained in a short wordlist. They simply tested all of the entries in the wordlist until they found the correct password. In practice, this method is unlikely to work as effectively as it did in the video because most actual networks are, at least in theory, secured with longer and more complex passwords that would not be found in most wordlists. Brute-forcing takes exponentially longer as password length grows, so once a certain password length and complexity is reached this method becomes impractical.

Paid public WiFi networks generally don't use any encryption at all, so that is a separate discussion entirely.

  • 1
    Doesn't many routers also have some kind of rate limiting to stop brute force attacks? (I don't know if they do, I am just hoping...) – Anders Sep 5 '16 at 8:18
  • 1
    At least for WPA-PSK2, there is no brute force protection, as one can easily do the cracking offline. This way, an attacker can easily rent a cloud (Amazon EC for example) and let them crack the key. There are even some (shady) services who do this if you pay them... – Lukas Sep 5 '16 at 8:24
  • 4
    @Anders Brute-forcing a WPA encryption key need not not involve actual attempts to connect to the network. It only requires capturing a "handshake" that occurs between the AP and an authorized client, after which the brute-force procedure is essentially an attempt to figure out what key would generate the captured handshake. All of this can be done passively, and away from the AP once the handshake has been captured. Thus there is no way to implement brute-force protection, aside from setting a key that is too long to brute-force in the first place. – tlng05 Sep 5 '16 at 15:24

Your Answer

