Analysis of Wi-Fi network
security
Coordinator:
Prof. dr. ing. Daniel Volovici
Graduate:
Alin Dinescu
“Lucian Blaga” University of Sibiu,
Engineering Faculty – ACS
1
Analysis of Wi-Fi network
security
Introduction p2
State-of-the-art p4
Packet capturing p6
Python Implementation p7
Efficient dictionaries p9
“Lucian Blaga” University of Sibiu,
Engineering Faculty – ACS
2
Introduction
Open
System
WEP
Wi-Fi
security
WPA/WPA2
Both security and wireless communication will remain
an interesting topic for many years to come
“Lucian Blaga” University of Sibiu,
Engineering Faculty – ACS
3
Objectives
Methods used to crack WPA/WPA2-PSK 4-way
handshake
Proof of Concept Python implementation
Chances of success – how to increase them?
“Lucian Blaga” University of Sibiu,
Engineering Faculty – ACS
4
State of the art
RFMON Allows wireless card to monitor all traffic within its range
WPA Uses TKIP with two alternatives: EAP and PSK
aircrack Well know tool used for dictionary attacks
“Lucian Blaga” University of Sibiu,
Engineering Faculty – ACS
5
WPA 4-way handshake
Generate dynamic
unique encryption keys
for each client connected
to an AP
PTK – encrypts
unicast frames
GTK – encrypts
broadcast/multicast
frames
“Lucian Blaga” University of Sibiu,
Engineering Faculty – ACS
6
Packet capturing
Packet 8 Packet 10
Packets 8, 9, 10, 11 – the 4 critical packets required
by aircrack-ng to crack WPA using a dictionary
“Lucian Blaga” University of Sibiu,
Engineering Faculty – ACS
7
Python implementation
“Lucian Blaga” University of Sibiu,
Engineering Faculty – ACS
8
Python implementation
“Lucian Blaga” University of Sibiu,
Engineering Faculty – ACS
9
Efficient Dictionaries
A good dictionary represents the key to success
But what makes them good?
Analysis of 13 wordlists:
Merged each collection into one file
Removed duplicate entries, leading/trailing spaces, non-
printable characters, HTML tags
Collections 13 Total files 122
Starting words 3.840.616.056 Starting size 40.5GB
Ending words 2.093.041.430 Ending size 21.6GB
Unique (%) 54% Compressed 4.2GB
“Lucian Blaga” University of Sibiu,
Engineering Faculty – ACS
10
Efficient Dictionaries
Number of lines in collection
1.2E+09
Number of lines 1E+09
800000000
Start Amount
600000000 Unique lines
400000000 End Amount
200000000
Name of collection
“Lucian Blaga” University of Sibiu,
Engineering Faculty – ACS
11
Efficient Dictionaries
100.00%
90.00% 99.70% 99.40%
80.00% 93.60%
84.40%
70.00% 76.60%
60.00%
50.00% 63.40% 61.20%
56.20% 55.90%52.20%
40.00% 45.90% 46.80%
30.00%
20.00%
10.00% 7.20%
0.00%
Percentage of words between 8-63 characters (WPA)
after clean-up
“Lucian Blaga” University of Sibiu,
Engineering Faculty – ACS
12
Conclusions
Having gigabytes worth of wordlists may be good; but
having a personalised/specific/targeted wordlist is great
Being able to read a capture file is an important skill
because it allows troubleshooting a connection with
problems
As long as the WPA/WPA2 passphrase used to protect
the access point is strong, complex, dictionary attacks on
WPA handshakes are not really a concern
“Lucian Blaga” University of Sibiu,
Engineering Faculty – ACS
Thank you!
Alin Dinescu
“Lucian Blaga” University of Sibiu,
Engineering Faculty – ACS
