A Tamagotchi For WiFi Cracking

October 16, 2019 by Bryan Cockfield 8 Comments

OK, let’s start this one by saying that it’s useful to know how to break security measures in order to understand how to better defend yourself, and that you shouldn’t break into any network you don’t have access to. That being said, if you want to learn about security and the weaknesses within the WPA standard, there’s no better way to do it than with a tool that mimics the behavior of a Tamagotchi.

Called the pwnagotchi, this package of artificial intelligence looks for information in local WiFi packets that can be used to crack WPA encryption. It’s able to modify itself in order to maximize the amount of useful information it’s able to obtain from whatever environment you happen to place it in. As an interesting design choice, the pwnagotchi behaves like an old Tamagotchi pet would, acting happy when it gets the inputs it needs.

This project is beyond a novelty though and goes deep in the weeds of network security. If you’re at all interested in the ways in which your own networks might be at risk, this might be a tool you can use to learn a little more about the ways of encryption, general security, and AI to boot. Of course, if you’re new to the network security world, make sure the networks you’re using are secured at least a little bit first.

Thanks to [Itay] for the tip!

Forming Voltron’s Blazing Sword For Real

June 14, 2016 by Adam Fabio 14 Comments

Activate interlock! Dynotherms connected! Infracells up! Mega thrusters are go! If you grew up in the 80’s you undoubtedly know that quote means it’s time to form Voltron. The 1984 Lion Force Voltron series has shown an incredible amount of staying power. These 5 lions have come together to form no less than 3 reboot series, the most recent coming out just this month from Dreamworks and Netflix.

[Matt and Kerry Stagmer], blacksmiths for the Man at Arms web series haven’t forgotten Voltron either. Every episode of the original series ended with the mighty robot defeating enemies using an iconic blazing sword. While they might not be able to bring us 5 robot lions which join together to form one mega robot, [Matt and Kerry] can bring us a human sized version of Voltron’s sword (YouTube).

Starting with a high-resolution image of a toy version of the sword, [Matt] traced the outline. The shape was sent over to a plasma cutter. Rather than cut one sword, two outlines were cut. One in 1/4″ steel, the other in 3/16″. A CNC was used to cut grooves in the 1/4″ section. These grooves became the manifold for propane gas jets. Separate jets were cut around the perimeter of the sword. With this complete, the two pieces were carefully TIG welded together.

This sword isn’t all prop and no chop. The upper sections were heat-treated and sharpened to a razor edge. We won’t go so far as to call this practical. It wields more like an ax than a sword. At the end of the day it doesn’t really matter though – this blazing sword is completely awesome.

An Interesting Take On WEP Cracking

October 7, 2010 by Mike Szczys 19 Comments

[Ben Kurtz] is doing a little WEP cracking but in a bit of a different way than we’re used to. WEP cracking makes us think of war driving; driving around with your laptop open, looking for WiFi access points, and stopping to run some software when you find them. [Ben’s] way is similar but different in one key way, he’s using an iPhone as the frontend.

This started as a way to find a use for some leftover equipment. He threw together a Linux box and loaded up Aircrack-ng, the software we often see used in penetration testing. To remove himself from shady-looking activities in public he coded a web interface using the Python package Turbogears. It uses screen, a program often used with SSH to run services concurrently in different terminals, with the option to disconnect without stopping the processes. Now it’s just a matter of parking the hardware near an AP, and doing the work in a browser on your mobile device. You can check out the script he wrote, as well as installation instructions, in his post linked above.

[Thanks Tech B.]

[Note: Banner image not directly related to this post]

Crack WEP Using BackTrack

July 2, 2009 by Zach Banks 48 Comments

wepcrack04

Lifehacker wrote a guide for cracking a WiFi network’s WEP password using BackTrack. BackTrack is a Linux live CD used for security testing and comes with the tools needed to break WEP. Not just any wireless card will work for this; you need one that supports packet injection. The crack works by collecting legitimate packets then replaying them several times in order to generate data. They point out that this method can be hit-or-miss, especially if there are few other users on the network, as the crack requires authenticated packets. We covered cracking WEP before, but using BackTrack should smooth out compatibility issues.

New WPA TKIP Attack

November 9, 2008 by Eliot 7 Comments

wifibox

[Martin Beck] and [Erik Tews] have just released a paper covering an improved attack against WEP and a brand new attack against WPA(PDF). For the WEP half, they offer a nice overview of attacks up to this point and the optimizations they made to reduce the number of packets needed to approximately 25K. The only serious threat to WPA so far has been the coWPAtty dictionary attack. This new attack lets you decrypt the last 12 bytes of a WPA packet’s plaintext and then generate arbitrary packets to send to the client. While it doesn’t recover the WPA key, the attacker is still able to send packets directly to the machine they’re attacking and could potentially read back the response via an outbound connection to the internet.

[photo: niallkennedy]

[via SANS]

Criminals Steal Credit Card Data Just By Wardriving

August 15, 2008 by Strom Carlson 24 Comments

Anime doll holding VISA card
A federal grand jury in Boston has charged eleven people with the theft of more than 41 million credit and debit card numbers from retail stores. What makes this case interesting is that, although the defendants stole the data from retail establishments, they did so without ever having to leave their cars; they stole the numbers while wardriving. While the report doesn’t make it clear whether the targeted networks used weak encryption or were simply unsecured, it’s obvious that the security of your data is still not a top priority for many companies.