Original subtitles

1 1

In the previous lectures, 2

2

we've seen how to crack the WEP encryption in minutes 3

3

even if the target network is not busy. 4

4

Now in the next lectures, 5

5

we will talk about cracking WPA and WPA2. 6

6

First of all before we start talking 7

7

about how to crack these encryptions, 8

8

it is very important to understand 9

9

that both of them are very very similar, 10

10

the only difference between them 11

11

is the encryption used to ensure message integrity. 12

12

WPA uses TKIP 13

13

and WPA2 uses an encryption called CCMP. 14

14

In any case, this does not affect the methods 15

15

that we're gonna use to crack WPA and WPA2. 16

16

Therefore, all of the methods that I'm gonna show you 17

17

from now on, will work on both WPA and WPA2. 18

18

Now both of these encryptions came after WEP 19

19

and they were designed to address the weaknesses in it. 20

20

Therefore both of them are much more secure 21

21

and cracking them is more challenging. 22

22

So, before we start talking about how to crack them, 23

23

I want to cover a feature that if enabled and misconfigured, 24

24

can be exploited to recover the key 25

25

without having to crack the actual encryption. 26

26

The feature is called WPS. 27

27

It allows devices to connect the network easily 28

28

without having to enter the key for the network. 29

29

So it was designed to simplify 30

30

the process of connecting printers and such devices. 31

31

You can actually see a WPS button 32

32

on most wireless-enabled printers. 33

33

If this button is pressed 34

34

and then you press the WPS button on the router, 35

35

you'll notice that the printer will connect to the router 36

36

without you having to enter the key. 37

37

This way, the authentication is done 38

38

using an eight-digit PIN. 39

39

So you can think of this, as a password 40

40

made up of only numbers 41

41

and the length of this password is only eight. 42

42

So this actually gives us 43

43

a relatively small list of possible passwords 44

44

and we can try all of these possible passwords 45

45

within a relatively short time. 46

46

Once we get this PIN, 47

47

it can be used to recover the actual WPA or WPA2 key. 48

48

So as you can see with this method 49

49

we are not exploiting WPA or WPA2, 50

50

we are actually exploiting a feature 51

51

that can be enabled on these encryptions. 52

52

So for this to work, first of all we need WPS 53

53

to be enabled on the network because it can't be disabled. 54

54

Also it needs to be misconfigured, 55

55

so it needs to be configured 56

56

to use a normal PIN authentication 57

57

and not a Push Button Authentication . 58

58

If Push Button Authentication is used, 59

59

then the router will refuse any PINs that we try 60

60

unless the WPS button is pressed on the router. 61

61

Therefore, the method will not work 62

62

if push button or PBC is enabled. 63

63

So in most modern routers, PBC comes enabled 64

64

by default or WPS will be disabled by default 65

65

so this method might not work but because WPA and WPA2 66

66

are so secure and so challenging, 67

67

it is always a good idea to check if WPS is enabled 68

68

and tried the method that I'm gonna show you 69

69

to crack the network. 70

70

If it fails, then you can try the other methods 71

71

that I'm gonna show you after the next lecture.