The WiFi Protected Setup protocol is vulnerable to a brute force attack that allows an attacker to recover an access point’s WPS pin, and subsequently the WPA/WPA2 passphrase, in just a matter of hours. This is something that I’ve been testing and using for a while now, but Stefan over at beat me to publication. Such is life. 🙂 Stefan’s code isn’t quite ready for release yet, so I’ve open-sourced, my WPS attack tool.

I’ve paid my money, carfax email me an approval code. And I have been trying for a week to set up and account. Everytime I go in to set up a password it rejects it. Free CARFAX Flood Check. Exterior lights, air conditioning, windshield wipers, radio, turn signals and heater repeatedly; View the full CARFAX Vehicle History Report to check for reported flood damage. Close all the windows and doors let the car sit for a few minutes and then crack open the door a take a good sniff.

Reaver is stable and has been tested against a variety of access points and WPS implementations. Usage is simple; just specify the target BSSID and the monitor mode interface to use: # reaver -i mon0 -b 00:01:02:03:04:05 For those interested, there is also a commercial version available with more features and speed improvements.

So I got the thing compiled, on linux. And it looks like it isn’t merely tied to linux (that’s what you’re using pcap for, because it provides _portable_ capturing?) but more or less tied to your computer. You really should try and compile it on a different unix, fix all the includes linux silently adds but other unices don’t, heck even run that README through a text-formatter set to less than 80 characters wide, do some cross-testing and all that. Some sort of verbose reporting would be nice too. I just ran the thing for a night on two different wifi interfaces presumably in monitor mode (let kismet do the heavy lifting there) but all it did was say once “waiting for beacon” and sit there until eternity. Kismet sees beacons, your software doesn’t. Well, useful.

As much as I dislike the hype around python, I think I’ll wait for Stefan’s code as it looks like having a better shot at actually working on systems not equal to the author’s. I’m running -vv, but it seems I may have been blacklisted from the AP. Reaver tried about 2% of pins before i began recieving timeouts. Now, all I get is timeouts (WARNING: Recieved timeout occured) from this particular AP. I tried giving it a few minutes to recover, but nothing changed.

I changed my HW address to something different, thinking that may solve it and allow me to continue the brute force, but no beans. I can still associate with the AP, so it seems the device is up, but perhaps I’ve exhausted the PIN attempts maybe? Winreducer Serial Number. I’m letting it sit for about a half hour and then I’ll be trying again.

I’ll let you know more specifics then. Hi Craig, Thanks for your tool, I used by i have this problem: Any idea? Perhaps the router is not vulnerate??

Hi Craig, I follow your recomendation, I put my wiifi card more near to de AP. I have a (hopefully not stupud) question. In Stephan Viehbock’s white paper on this, it says this: “An attacker can derive information about the correctness of parts the PIN from the AP´s responses. If the attacker receives an EAP-NACK message after sending M4, he knows that the 1st half of the PIN was incorrect. If the attacker receives an EAP-NACK message after sending M6, he knows that the 2nd half of the PIN was incorrect.

This form of authentication dramatically decreases the maximum possible authentication attempts needed from 10^8 (=100.000.000) to 10^4 + 10^4(=20.000). As the 8th digit of the PIN is always a checksum of digit one to digit seven, there are at most 10^4 + 10^3 (=11.000) attempts needed to find the correct PIN.” I’ve noticed, using Reaver, that in the PIN attempts the second half of the PIN is reused quite frequently, sometimes 3 times out of 5 in a row.

Is this because the the second half of the PIN cannot be tested until the 1st half has been successfully identified? After re-reading the paper I think this is the case, but I was hoping for confirmation.

I have a question about walsh/wash: after probing about 30 APs with WPA/WPA2 enabled, I found that no-one of them has WPS. My router has WPS, but no configuration at all in the panel (it’s an ISP-provided), and I am sure only about the button-enabled WPS, unsure about external registrar. By the way, I’m pretty sure that two routers in my range support it.

They also respond to reaver’s attempts, but they don’t show up in wash’s output. What may be happening? Am I doing wrong?

My card’s driver are patched for injection and I use it seamlessly for other WiFi tests. Reaver/walsh works great on Sabayon Linux with a Realtek-chipset card I bought for about $13. My roommate was bitching about high Internet bills and blamed me for the bills. I have a wired connection and I *do* use Torrents a fair bit. My roommate uses a wireless connection (despite being less than 20 feet from the router, as the crow flies) and insisted I was the cause of the high bill, but I know damned well I wasn’t responsible. We have another roommate who watches YouTube *endlessly*, but I got the blame.

“And, you have an unnecessary wireless network, in a household where not one of us uses wireless devices.” “Dude, nobody can hack it because I have a very long and complicated password! I used a car’s VIN number!” Yeah, well, his Pontiac’s VIN, read through the windshield, wasn’t it. Reaver did it. “987654321abc” was his super-complicated password. Jesus, a password guessing program might have done it.

Reaver cracked it in about 4 hours. He no longer bitches at me. Even admitted that I know more about computers than he does (my degree in Electrical Engineering from a Canadian University kind of trumps his time spent at the counter of a car-rental company, I would have thought). Admin reaver -i mon0 -b XX:XX:XX:XX:XX:XX -vv switching to channel 1 [!] WARNING: Failed to associate with XX:XX:XX:XX:XX:XX (ESSID: XXXXX-XXXX) [!] WARNING: Failed to associate with XX:XX:XX:XX:XX:XX (ESSID: XXXXX-XXXX) [!] WARNING: Failed to associate with XX:XX:XX:XX:XX:XX (ESSID: XXXXX-XXXX) [!] WARNING: Failed to associate with XX:XX:XX:XX:XX:XX (ESSID: XXXXX-XXXX) [!] WARNING: Failed to associate with XX:XX:XX:XX:XX:XX (ESSID: XXXXX-XXXX) i got this problem at my home network what i have to do my athk9 adapter athero windows7,64 bit intel i3 processor.

An amazingly simple and effective tool! A genuine, heartfelt thanks to the author and the guys who thought of looking at WPS. You’ve made me aware how vulnerable I am and I just replaced my router because of the knowledge I gained with this program. I have been tweaking the -d, -a, -N and -A options on several attempts at my router to discover how quickly it could fall.

Is there a recommended guideline for the parameter values of these options given the operational environments (ie: signal power, AP feedback, etc.)? 24 hours working and nothing just this messages, any help? (!) WPS transaction failed (code: 0x02) re-trying last pin (!) WARNING 10 failed connections in a row (+)Trying pin 12345670 (+)Sending EAPOL START request (+) WARNING: Receive timeout occured (+)Sending EAPOL START request (+) WARNING: Receive timeout occured (+)Sending EAPOL START request (+) WARNING: Receive timeout occured (!) WARNING 25 sucessive start failures (+) Nothing done nothing to save (+) 0.00% complete @ date ( 0 seconds pin) (+)Trying pin 12345670 (+)Sending EAPOL START request (+) WARNING: Receive timeout occured (+)Sending EAPOL START request. Using version 1.4 to crack a Netgear WPA secured router.

Man, it is taking FOREVER. The problem with Reaver is when you start to attack routers with timeout values. It will get into a situation where there is a minimum timeout after so many attempts before it lets reaver rechallenge WPS. After 10 failed attempts, I set -x = 250 seconds. That’s over 4 minutes. So, it has taken me over 8 hours just to get to 18% of the pins. Worst case estimate, is it takes about 45+ hours to finish.

That’s a lot better than a straight dictionary attack, but it is way worse than 10 hours. Don’t delude yourself into thinking Reaver will crack WPA in 10 hours or less.

Also, lots of routers do not have WPS enabled or supported. For the newbies, you should use wash to figure out which AP’s and routers support WPS. Finally, some routers will lock down WPS after too many failed attempts. So, just so people know, Reaver is not the end alls. It is just another tool in the lockpicker’s arsenal.

Personally, I think a better way would be to do a middle man attack. Yes, if the AP rate limits you the attack will take longer. Most AP’s don’t, but Netgear is the exception. And yes, some completely lock you out after X number of attempts. I don’t think anyone is deluding themselves here, this is all documented behavior, and why reaver has options like -x. Yes, a lot of AP’s don’t support WPS, but they are typically fairly old APs.

Pretty much anything made within the last 4-5 years will have WPS support on by default (it’s very rare to see people actively disable WPS). The number of WPS enabled APs will only rise in the future. Good luck with a MITM attack. If that actually worked people would have been doing it for years now. 24 hours working and nothing just this messages, any help? Interface Chipset Driver wlan1 Atheros AR9271 ath9k – [phy1] wlan0 Broadcom b43 – [phy0] root@bt:~# airmon-ng start wlan1 Found 2 processes that could cause trouble. If airodump-ng, aireplay-ng or airtun-ng stops working after a short period of time, you may want to kill (some of) them!

PID Name 2785 dhclient3 2790 dhclient3 Process with PID 2790 (dhclient3) is running on interface wlan0 Interface Chipset Driver wlan1 Atheros AR9271 ath9k – [phy1] (monitor mode enabled on mon0) wlan0 Broadcom b43 – [phy0] airodump-ng mon0 BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID 00:26:4D:16:E4:67 -62 43 0 0 5 54e WPA TKIP PSK DARKANGEL_Netzwerk C0:25:06:A9:8C:62 -75 24 0 0 11 54e. WPA2 CCMP PSK FRITZ!Box Fon WLAN 7390 68:7F:74:01:FA:FC -75 22 0 0 11 54 WPA2 CCMP PSK lufthaken C0:25:06:41:EE:4A -76 20 0 0 1 54e WPA2 CCMP PSK FRITZ!Box Fon WLAN 7112 C0:25:06:DC:B0:A4 -77 21 0 0 1 54e.

WPA2 CCMP PSK FRITZ!Box 6320 Cable BSSID STATION PWR Rate Lost Frames Probe (not associated) 54:26:96:84:0A:05 -71 0 – 1 38 27 wash -i mon0 -C -s reaver -i mon0 -b 00:26:4D:16:E4:67 -c 5 -vv (WPS Locked =N) Sending WSC NACK [!] WPS transaction failed (code: 0x02), re-trying last pin [+] Nothing done, nothing to save. I have a AWUS036NH with Kali linux in Virtual Box Go to devices and select your device from the USB. After that do: airmon-ng to see if the device is there. If so, then run airmon-ng wlan0 it will set the card to monitor mode then run reaver this is my code: reaver -i mon0 -b -S -N -a -c -vv -r 17:30 -d 0 sometimes it fails to associate so I run airmon-ng mon0 and then run reaver again. My problem is that I am not able to automate the process, I have to manually re associate the AP which means I have to be looking at it the whole time:/ Unless someone has a script or something that could help me out. Very much Appreciated it.

UPDATE 04/29/16: This is now fixed and I am extremely happy with the results. See Post #39 and 40 for what you need to know. This should really help you understand the process, what our widshields look like, parts that need to be changed and hopefully help you make a decision on the shop you use. So I had read about a lot of windshields cracking easily on the new M's and now it happened with me The crazy thing is that I never even noticed it till later today on my way back from work.

From what I have found out insurance will cover it but I still have to pay the $500 deductible Have a few questions and am hoping someone who has already been through this can help me make a decision: 1) The local Autolite quote me $732 for OEM glass. They told me that OEM is the only option and I was happy to hear that. Have any of you used Autolite?

Would you take them over the dealer? I would still go through insurance but have the work done by Autolite Edit: I meant Safelite not Autolite 2) Dealer told me they do the install inhouse but I am having some trust issues here because I have a hard time believing that their service center can replace windshields. For those of you who went with the dealer, any plus of going with the dealer? 3) If going through insurance for the windshield replacement, will it show up on the carfax? And if yes, what does it show up as? Last thing I want is some generic crap that drives buyers away when I have to sell this in the future. In summary, I am leaning towards autolite and am looking for feedback on their work.

Yeah, wouldn't file a claim for that. May effect your rates, and will only save you a couple hundred dollars. On a related note, is there anyway to polish a windshield to remove the small pits and marring that comes from driving in a state with a real winter, and rocks and salt on the road?

Or should I just bite the bullet and get a new windshield? My detailer polished the windshield on my previous car and it came out great. It won't take out cracks or chips, but may be worth a shot before replacing. There is glass polish that can be used. Yeah, wouldn't file a claim for that. May effect your rates, and will only save you a couple hundred dollars. On a related note, is there anyway to polish a windshield to remove the small pits and marring that comes from driving in a state with a real winter, and rocks and salt on the road?

Or should I just bite the bullet and get a new windshield? There are guys out there that can polish the windshield. Depends on the size of the chips, obviously. As for insurance, you'll end up paying for it over the long term anyway.

Just pay out of pocket. Insurance companies pay for chip repair to prevent the windshield from being cracked down the road.

They get claims for cracked windshields all the time. I don't see how a cracked windshield would affect your rates at all.

I don't know if you have Safelite in your area, but I've had more than one windshield repaired for chips. I had the windshield replaced on my S2000 after having a piece of metal strike and dent the A pillar, cracking the windshield, while I was on the freeway. My rates didn't increase after that incident. Safelite does an excellent job and Liberty Mutual pays for Safelite to repair chips. I was lucky, the strike was at head height and my top and windows were down. A foot farther back and it probably would have killed me.

Not sure what autolite is but I've used safelite and it was fine. Was also told by local socal dealers they sub out to safelite also. Just make sure it is 'oem dealer glass' and not just 'oem glass' so it has the roundel and everything, and it should be fine. Another nuance, is that (when it was done on my Z4) the sensors and trim pieces around the windshield were reused. I didn't care since it was a leased car, so OEM dealer glass going back on the car was good enough for a keeper, I would ask about replacing the trim with new parts.

On a related note, is there anyway to polish a windshield to remove the small pits and marring that comes from driving in a state with a real winter, and rocks and salt on the road? Or should I just bite the bullet and get a new windshield? You can fill and/or polish out the pits and chips, but only the minor ones. Anything major, and you will trade the chips for visual distortions. Which would be even more irritating. For DD cars, windshields are a regular maintenance item, especially if you commute into sunrise/sunset. I checked with insurance and they assured me that this doesn't affect rates. Free Download Program Aspekte Mittelstufe Deutsch B2 Pdf Creator.

I understand it seems like is only $232 but I am already dishing out $500. To spend another $232 just on the assumption that instance might increase doesn't make sense.

If there is a way to confirm that it will definitely go up then I see it as making total sense to pay the complete thing out of pocket. Insurance games vary by state, so please don't take internet advise and check with your local car club / friendly local insurance adjusters. I did have an E90 windshield replaced by Safelite (or was it Autolite?) 3-4 years ago. The glass was perfect, but they didn't order the right windshield gasket, and had to re-use the old + plenty of glue.

The repair held and didn't leak, but I was less than thrilled with preparation and execution. It was a leased car, so I ultimately didn't care.

I was merely pointing out that he was telling me to go with the dealer and not stress over 200 bux. I never stated what the dealer would charge so not sure how he assumed the $200 would be associated with the dealer. Abyways, the point here was that I am trying to decide between the dealer and the other vendor. Just wanted feedback on who to go with.

Money would be the same cuz as I stated in the original post insurance will cover it and I'll be liable for $500. It was a about the quality of work, not the amount of money. That said, looks like I'll go with the dealer and hope it comes out ok. The dealer charges $1385. You need to check if your insurance will pay that full amount or if they will force you into the autolite quote. If so, you'll need to discuss the differences between the two and get an exception pushed through before doing any work My GUESS from the last time I did this, is the gap is from the dealer using new trim pieces (maybe new sensor) and using dealer labor rates. As I mentioned earlier, if they will sub out the job anyway, just see if autolite with also do the new trim and sensor, and get insurance to pay for it lastly, the first time I had a rock chip, I lowered my comprehensive deductible from $500 to $50 and found it had a negligible impact on my rates.

It helped me a lot when it was windshield replacement time. Could be worth considering for next time. So I had read about a lot of windshields cracking easily on the new M's and now it happened with me The crazy thing is that I never even noticed it till later today on my way back from work. From what I have found out insurance will cover it but I still have to pay the $500 deductible Have a few questions and am hoping someone who has already been through this can help me make a decision: 1) The local Autolite quote me $732 for OEM glass.

They told me that OEM is the only option and I was happy to hear that. Have any of you used Autolite? Would you take them over the dealer?

I would still go through insurance but have the work done by Autolite 2) Dealer told me they do the install inhouse but I am having some trust issues here because I have a hard time believing that their service center can replace windshields. For those of you who went with the dealer, any plus of going with the dealer? 3) If going through insurance for the windshield replacement, will it show up on the carfax? And if yes, what does it show up as? Last thing I want is some generic crap that drives buyers away when I have to sell this in the future. In summary, I am leaning towards autolite and am looking for feedback on their work.

I would check with your insurance, mine doesn't have a fee for windshield replacements, does it raise my rates if used is other question. It was considered an 'act of god' the times I have used it. I would also read the find print of others vs OEM at the dealership. The warranty could be worse or better, BMW may have a standard of repair that is higher. Also keep in mind any issues specific to sensors on the windshield maybe beyond the ability of the common shop.

My windshields replacements have never gone on Carfax, because its not often considered and accident but again as others have stated, its different in each area. I would check with the body shop/ insurance if your concerned.

I have done both OEM and Safelite replacements and can report no issues with either. Windshields are 30% glass and the rest is the ability of the installer, worst case if you don't like the results have them pull it out an do it over. My only recommendation is the odds are better at a shop vs the come to my office/home and do it in the parking lot, lowers the odds of outside uncontrollable outside factors. Yeah, wouldn't file a claim for that. May effect your rates, and will only save you a couple hundred dollars.

On a related note, is there anyway to polish a windshield to remove the small pits and marring that comes from driving in a state with a real winter, and rocks and salt on the road? Or should I just bite the bullet and get a new windshield? Its possible but you have to have the tools and skill set to do it. My experience is if you can run your nails on it and it catches you can't polish that out. Only option is to fill it or new windshield.