There's a big challenge to configuring wireless devices in particular the whole idea for a person to
have to type in a pre-shared key into their client and set it up on individual computers and on smart
devices that's not a big deal.
But when it comes to things like printers and things like that we don't have an easy Windows or OS 10
interface or something to be able to go through this configuration process.
So that's why many years ago they came up with something called Wi-Fi protected setup or WPA.
Now for those of you who don't know WPX the whole idea behind WPX is push button configuration.
So I've got a wireless access point and this wireless access point has a pre-shared key and nice big
complicated pre-shared key in it.
The idea the IWP is simple.
Now if you look really close here can we get a photograph of this button right here.
That button is how WPX starts.
If I have a WPX wireless access point and I have a WPX capable device all I need to do is press this
button.
Then I go over to my printer whatever it is and I press and usually hold the button on that other device
for a couple of minutes sometimes three minutes depends on the manufacturer.
Then you let go and they automatically configure themselves.
They make this configuration by having a built in key a hardware burned in key that they can use just
to make that initial connection that it's never used again and the exchange the true pre-shared key
and WPX is up and cooking.
Now if you really need to you can actually go into like a Windows system and type in this eight digit
number and you can configure that way as well.
And WPX is great stuff except for one big problem and it has to do with.
All right.
You'll get one more photograph of this.
OK so what you're looking at is an 8 digit key so every GPS enabled device has this eight digit keep
this a digit key is only used for those few short moments while they're making the initial key exchange
of the K.
However there's a bit of a problem with it now.
An 8 digit key would be two to the eighth power.
So you know it's a pretty long chunk of data for a guy to be able to crack it just a couple of minutes.
However there are some weaknesses.
Weakness number one one of those eight digits is just use as a cyclic redundancy check for the other
seven.
So now we're down to two to the seventh power.
Still pretty hairy in terms of a quick crack yet.
There's another problem with WPX the actual process of the key exchange is done through first four bits
and then three bits so really instead of two to the seventh power you have to to the fourth power and
two to the third power which basically means you only need about eleven thousand iterations to be able
to crack this stuff.
So this was first discovered back in 2011 and it set everybody into a tizzy.
So what we've seen since 2011 is number one.
A lot of wireless access points where you can turn WPX off a lot of wireless access points that you
could turn it off.
However the right kind of tools could turn it back on a lot of wireless access points where they simply
dumped WPX completely just not even a feature anymore.
And now what we're starting to see especially in the Ayro to live in a sea world is a lot of wireless
routers that are using WPX but they're using it very cleverly so before we get into how they're doing
this I want to go through the process of actually cracking something so we're going to take a look at
the Cisco box right here.
And I know he is passing out on this total Wi-Fi SS ID.
Now if you look right here on the screen it's red.
And the reason it's red is this scanner is actually querying the wireless access point and the wireless
access point has W.P. turned off and there is nothing we can do about it but if we keep look at here
you see here is a wireless access point called aces and it's green.
Well what we're actually doing right here is I knew this guy wasn't working.
So I brought in another wireless access point
and this guy I've got WPX turned on.
Let me show you how WPX looks on this particular device.
So if we take a look over here what I've got is I've set up I've got the SS I.D. as a default.
Just called aces and I'm going to go ahead and give it like a WPA too personal.
And I think I was using the password.
Timmy Timmy before yet still remembers that great right.
So what I'm going to do is go ahead
like that up.
Now keep in mind we're talking about a this is a pretty modern 1:52 11 AC wireless router here.
So you know we're not talking about 2011 technology here this is pretty recent stuff.
So if we come in here we'll see it does have a WPX tab that we can turn on and off and for the record
with this particular router if I turn it off it really turns it off.
There are some older routers from the 2011 to 2015 World where you can actually turn off WPX but a good
cracker can literally turn it on remotely and that fun anyway.
So what I've done here is I've gone ahead and turn this on and he's up and cooking now right here do
you see the pin code now this pin code here let me pull up.
This guy has his own pin code on the outside as well.
So what I want to do one more time is go ahead.
Just take a picture.
Can we get a photograph of that OK.
Now compare that photograph that we're we're looking at with this pin code in fact let's look at them
together.
You could see it's the exact same code.
So we now know what exactly we're looking for now I'm going to go ahead and crack this because my survey
tool said that WPX was on and cook and even though I turned off and back on again it's Rayder rock n
roll and the tool I'm going to use is a wonderful well known tool called River which you get as part
of the Kalli Linux tool kit.
Now you can see that I've gone ahead and I ran my arrow dump one more time here so I can see who's out
there
and there's aces keeps popping in and out but he was there.
The important thing is as I already had that SS ID so let me scroll up to the top here since you're
a man that has been running for a while.
So the.
So you can see I started Reaver and I went to W. land 0 mon and I just typed in the MAC address for
that particular access point and I've been letting this go for a while.
Try to get to the bottom here.
And you can see he's trying different iterations.
So he's basically doing a brute force WPX attack.
He started with seven zeros and he's going to go to seven nines until he gets the right answer.
Now it's interesting as he's been at this for a while he's been at it for a while because I told him
to one of the big problems we run into with especially the newer generation WPX capable wireless access
points is that they know if somebody starts hitting on him really really fast keeps trying each iteration
that that means they're being attacked and they will either shut down.
They will turn off WPX.
I've got particular routers that will literally factory reset themselves.
Yipe if they get attacked too many times so what I'm doing with Reaver right now as I said just hit
him very slowly very very slowly.
So if you do it even one iteration per second you're talking about it's eleven thousand thirty six hundred
iterations per hour so you're talking about a maximum of three hours and that's it if you hit it one
per second.
If I hit this guy one per second he's going to just cut off.
He will literally turn off WPX on me.
So what I'm doing is just I'm just going to let him run a little bit.
And usually in this case I would consider letting him run as much as a week.
Seriously.
Just to make sure I don't set the routers.
The end result is is that Reaver will work I guarantee it will work.
It might take a couple of tries but it absolutely will work.
So here let me put up what a successful Reaver attack is going to look like for you.
So that's the beauty of WPX attacks now Reaver is not the only tool out there.
There are zillions of them.
It's just the one I am most comfortable with it's been around for a while if you want to stop WPX attacks
you're going to have to be very very careful.
Number one if you have older routers that are susceptible to this and there's great documentation online
about this get rid of it.
You can also consider a firmware update.
One of the things I do love about the DD dash w r t firmware for all of these little home routers is
that it almost invariably shuts off WPX in a way that it's very very difficult to turn it back on unless
you intentionally want to do it yourself.
And the last thing you want to do is consider a modern wireless router.
They will have WPX on them.
A lot of times but they come with so many tools it's very very difficult for a guy like me to be able
to crack.
Yeah unless I really really really have a lot of time.