- cypherpunks - lists.cpunks.org

Cryptocurrency: Venezuelans Turn To Gold And Bitcoin
by grarpamp 01 Nov '21

01 Nov '21

https://mises.org/wire/venezuelans-turn-gold-nuggets-local-currency-implodes https://www.bloomberg.com/news/articles/2021-10-20/venezuelans-break-off-fl… Venezuelans Turn To Gold Nuggets As The Local Currency Implodes The Venezuelan government recently lopped off six zeros from its hyperinflating currency, the bolivar. The highest denomination currency note of 1 million bolivars, worth less than $0.25, was replaced by a one-bolivar note. At the same time, a 100-bolivar note, worth about $25.00, was introduced as the new highest denomination of the bolivar. The currency conversion was designed to spare the government the embarrassment of having to issue a 100-million bolivar note to enable people to purchases everyday items without having to carry around bundles of notes, given that the price of a loaf of bread had risen to 7 million old bolivars. Of course, the arbitrary scaling down of the denomination of the currency will not slow inflation, because the new currency notes can be printed just as cheaply as the old. The bolivar has already lost 73 percent of its value in 2021 alone and the IMF estimates the annual inflation rate will reach 5,500 percent by the end of 2021. It is not surprising, then, that all but the poorest Venezuelans have abandoned the bolivar as a medium of exchange, let alone a store of value or unit of account. US dollars are the exchange medium of choice in Caracas and other large cities, while the Colombian peso dominates along the Colombian border, particularly in the regional city of San Cristobal. The Brazilian real is current along the southern border with Brazil and the euro and cryptocurrencies have also found niche uses. What is wonderfully surprising is the spontaneous emergence of a pure gold currency in a remote region of southeastern Venezuela around the towns of Tumeremo and El Callao. The region abounds with precious metal ores and has a long history of luring prospectors and miners seeking their fortunes. Today, however, many of the larger mines are controlled by the government military, which is battling local gangs and guerillas. Despite the violence and lawlessness, jobless Venezuelans from far and wide are flooding into the area to work in thriving illegal mines in exchange for payment in gold nuggets. As a result, gold flakes, which are peeled off raw nuggets with hand tools, have become the currency of choice in the region with prices for commodities and services quoted in grams of gold. Half a gold gram buys you a one-night stay in a local hotel, while a meal for two at a Chinese restaurant and a haircut will cost you a quarter of a gram and an eighth of a gram, respectively. The gold flakes are carried in people’s pockets—usually wrapped in the nearly worthless bolivar notes. While some shops are equipped with scales to weigh the gold flakes, most sellers and their customers have become so familiar with the flakes that they evaluate them by sight. For example, the barber and his customer who transacted for the haircut agreed that three gold flakes equaled the one-eighth gram price (approximately $5.00). Gold is also starting to penetrate the nearby cities, such as the regional capital Ciudad Bolivar, as stores in shopping malls gladly accept the gold in exchange for dollars from miners who are seeking to cash out. For gold to become a full-blown currency that can viably compete with depreciating dollars and other foreign currencies, the raw nuggets need to be minted into convenient shapes and sizes and their weight and fineness certified by reputable firms. This means that any legal barriers to private mints must be eliminated. In addition, sales and capital gains taxes on gold must be abolished. Since it is highly unlikely that these measures will be implemented by the Maduro government, we can only cheer on the inroads made by the people’s gold flake currency.

1 0

Cryptocurrency: IMF and GovBanks in Total Panic Over Bitcoin
by grarpamp 01 Nov '21

01 Nov '21

https://bitcoinmagazine.com/culture/why-the-imf-hates-bitcoin The IMF Hates Bitcoin Because It Loves Total Control https://bitcoinmagazine.com/culture/how-bitcoin-fixes-the-money-saves-the-w… https://www.imf.org/en/About/Factsheets/Sheets/2016/07/27/15/31/IMF-World-B… https://latest.13d.com/what-is-the-fourth-turning-envisioned-by-william-str… https://bitcoinmagazine.com/culture/global-inflation-heats-up-bitcoin-saves The IMF hates Bitcoin because its decentralized protocol and programmatic monetary policy defies the control the fund wants to implement on us all. The International Monetary Fund (IMF), along with a string of other financial institutions, really does not like Bitcoin. So, let’s do the usual, thinking through what the IMF is and why it even matters. WHAT IS THE IMF? The IMF and the World Bank are like the parallel universe versions of Shaggy and Scooby-Doo. They have no idea what they are doing, and yet the decisions they make determine how the show ends. The only difference is that no one wants to watch this version of the show, because Shaggy and Scoob keep debasing your currency into oblivion. Sticking with the IMF alone for this article, its mandate is as follows: “The IMF promotes monetary cooperation and provides policy advice and capacity development support to preserve global macroeconomic and financial stability and help countries build and maintain strong economies.” –IMF.org For oversimplification, let’s just imagine the IMF as dictating a short- and medium-term global monetary policy. It responds to what is in front of it at any given time and “influences” global markets. This, obviously, requires a large amount of control, or centralization, if you will. So, who makes up the IMF? “IMF loans are funded mainly by the pool of quota contributions that its members provide.” –IMF.org It’s not a secret that a bunch of rich people influence the entire globe’s monetary policy. This is public information that’s easy to find. Obviously, these guys have good reason to maintain the status quo. So, as I said, the IMF doesn’t like Bitcoin. But why? PREVENTING THE FOURTH TURNING For those unfamiliar, the “Fourth Turning” is a concept that states there is a cyclical progression in society, typically with 20 years or so in each turn, the last of which results in a crisis that topples the old systems of power and ushers in a new era. Bitcoin is often thought to be the crisis moment of the Fourth Turning by toppling the financial institutions of old (here’s a summary). Following that track, over the past two years, the world has been rocked by a pandemic that led to the debasement of many global currencies, the U.S dollar being a very clear one, as outlined in this article by Jerry Goddard. The IMF knows all of this and has made it clear that it means to maintain control. On July 29, an article was posted on the IMF blog, including the following quote: “There is a window of opportunity to maintain control over monetary and financial conditions, and to enhance market integration, financial inclusion, economic efficiency, productivity, and financial integrity.” –IMF blog It’s honestly kind of smug how indiscreet this statement is. Clearly, through central banks in nation states, the World Bank and other institutions, the goal of the IMF is to maintain control. In the classic Bitcoiner phraseology:” Bitcoin fixes this.” But seriously, this is what Bitcoin was made for. HOW DOES BITCOIN FIX THIS? I’ll spare everyone the details of rehashing what Bitcoin is. Let’s stick to the basics: 1. Bitcoin is decentralized. There’s no group of developers, miners or businesses that can band together to manipulate the protocol. If consensus is not met, the hell with it, it isn’t happening. Understandably, the IMF, which settles short- and medium-term economic issues between countries by issuing out loans based on the currencies that it constantly has a hand in debasing, probably doesn’t want the money supply controlled by an unbeatable algorithm that makes you play the game the way Bitcoin wants to play. 2. Bitcoin has a programmatic monetary policy. We know how many bitcoin exist now, we know how many will exist in total and we know when the new bitcoin will be issued. We know all of this, and it’s publicly available to anyone willing to look. Not being able to control the supply or its issuance is a crucial concern for any central authority attempting to maintain power in the legacy system. They cannot control the protocol or the system of Bitcoin, and they cannot control the currency of bitcoin, either. These would be transparent reasons for not wanting it to succeed. THE IMF WANTS TO INITIATE BITCOIN PANIC “Digital money must be designed, regulated, and provided so that governments maintain control over monetary policy to stabilize prices, and over capital flows to stabilize exchange rates.” –IMF blog Read that first part again: “Digital money must be designed” for government control. The IMF will claim this is for consumer protection. We hear about the impending regulations on the darkening horizon constantly. And when discussing digital assets, the IMF made sure to speak directly on Bitcoin later on in the post: “The least stable of the lot, which hardly qualify as money, are cryptoassets (such as Bitcoin) that are unbacked and subject to the whims of market forces.” –IMF blog The only cryptocurrency named was bitcoin. (I hear you maxis, I know you don’t like us to call Bitcoin “crypto.”) It was named because it is feared. It stands before the IMF as an unstoppable algorithm designed as a relic of the new age. Debasement and financial instruments that enable it will fade to forgotten dust as a bygone age is swallowed whole, along with the financial legacy framework. IT’S NOT JUST ABOUT CONTROL It’s about IMF’s funding too. What happens when a governing body needs to raise capital quickly? That’s right, it issues garbage bonds. Well, what happens if other products result in larger yields in a shorter time frame, such as what is happening in the world of stablecoins and DeFi? “Countries are concerned with several scenarios. Substantial CBDC or stablecoin demand might absorb a large share of government bonds. This could affect the yield curve, and in the case of stablecoins whose reserves cannot be lent out, the availability of collateral. And stablecoins fully backed by central bank reserves could immobilize and segregate central bank liquidity which would otherwise be freely lent between banks to satisfy daily payment shocks.” –IMF, “The Rise Of Digital Money” For the United States, this is what is referred to as the “Federal Funds Rate.” This is the rate at which banks borrow money from each other or the central bank overnight to meet a reserve requirement (a percentage of the deposits you hold), each night. As you can imagine, the loss of bonds and the loss of another revenue stream via the Federal Funds Rate isn’t something any centralized player wants. BUT THAT’S NOT ALL, FOLKS! In December 2020, the IMF put up a post on its blog that discussed using your browser history to affect your credit score. “As Big Techs gather data, manage customer relations through ubiquitous digital platforms (as opposed to networks of physical branches), and become essential to better design and customize financial services, they will keep an increasing share of the producer surplus.” –IMF, “What Is Really New In Fintech” The IMF is ecstatic to talk to all of us about the opportunity to add every single thing we do on the internet to be calculated into our ability to get a credit card. It doesn’t want to simply have access to your finances and control that information on a global market anymore. No, that got too boring. Now, it wants to control who you are and control every digital action you make. Can you guess if Bitcoin fixes this?

1 0

Malware WinDealer used by LuoYu Attack Group
by zeynepaydogan 01 Nov '21

01 Nov '21

During [JSAC2021](https://jsac.jpcert.or.jp/archive/2021/en/index.html) on 28 January 2021, there was a presentation about an attack group LuoYu, which targets Korean and Japanese organisations since 2014 [1](https://blogs.jpcert.or.jp/en/2021/10/windealer.html#1)[2](https://blogs.jpcert.or.jp/en/2021/10/windealer.html#2). Recently, JPCERT/CC came across malware WinDealer used by this group. This article introduces some findings of our analysis https://blogs.jpcert.or.jp/en/2021/10/windealer.html

1 0

Cryptocurrency: AUS to Approve Spot ETFs, US Approves Shit Futures ETFs
by grarpamp 01 Nov '21

01 Nov '21

Cash settled crypto futures ETFs, even crypto settled futures ETFs, do not result in much actual lockup or float of physical coin, plus they degrade, etc. If you want the coin, buy the real fucking coin, or at least be a nohodler and buy physical funds. Not your keys, not your crypto. US GovBank obviously approved futures in attempt to "tame" and tank prices and kill crypto, but cryptos will evolve faster than GovBanksters can approve their own GovBank ShitFunds. Australia's Top Securities Regulator Says It Will Approve Bitcoin ETFs https://www.businessinsider.com.au/asic-greenlights-bitcoin-etf https://www.smh.com.au/business/companies/asic-gives-trading-of-bitcoin-eth… The Australian Securities And Investments Commission (ASIC) has given early approval to fund managers seeking to launch Bitcoin spot exchange traded funds (ETFs), according to Business Insider. Many Australian funds have already begun the application process after ASIC green lit the spot ETFs. After months of consulting with experts in the Bitcoin and crypto industry, the corporate regulators issued new guidance for the space, and detailed a draft of regulatory requirements for funds eager to offer Bitcoin spot ETFs. In a statement on Friday, ASIC wrote, “We recognise the interest in, and demand for, ETPs and other investment products that hold crypto-assets in Australia.” One requirement for fund managers is they will need to appoint a Bitcoin custodial expert who is “required to ensure crypto-assets are held in safe and secure custody”. Safe and secure custody includes storing Bitcoin private keys in air-gapped cold storage, through wallets which are subject to “robust physical security practices.” Redundant backups of seed phrases stored in geographically separate locations are also required, according to the Sydney Morning Herald. Funds must also front a minimum of $10 million in net tangible assets to launch a Bitcoin ETF, along with adhering to other pricing and risk management obligations. ASIC commented on why Bitcoin is one of just two newly approved assets, “We proposed this because we recognize that crypto-assets vary greatly in their features, characteristics, risks and how they operate, and we consider that only some may be appropriate to be held by a registered managed investment scheme.” This comes just one week after Valkyrie and ProShares launched the first Bitcoin futures ETFs in the United States. Many in the U.S. are eagerly awaiting the approval of a Bitcoin spot-based ETF, which is considered to be a safer investment vehicle that can more closely track the price of Bitcoin. In any case, Australia's coming spot ETFs are a step in the right direction in terms of educating traditional investors about Bitcoin and spreading adoption.

1 0

The Verge: The US Copyright Office just struck a blow supporting right to repair
by jim bell 01 Nov '21

01 Nov '21

The Verge: The US Copyright Office just struck a blow supporting right to repair. https://www.theverge.com/2021/10/27/22747310/us-copyright-office-dmca-secti…

4 7

PINNED Tweet
by professor rat 01 Nov '21

01 Nov '21

Cypherpunks collapse governments. Subject: Everyone a remailer: Everyone a Mint: Everyone an assassin https://marc.info/?l=cypherpunks&m=100872510706876&w=2 Strong-crypto, digital money, anonymous networks, pseudonyms, zero- knowledge proofs, reputations, information-markets, netwar, collapse-of-governments. http://nakamotoinstitute.org/static/docs/cyphernomicon.txt What forbids us translating the freedom afforded by the Internet to ordinary life? I think that blockchains will replace armies for national defense, because a blockchain-based assassination market will be created…" Zach. CryptoGo To launch attacks under favorable circumstances is not only every anarchist revolutionary’s right, but their plain duty. The killing of spies, policemen, commissars, the blowing up of police stations, the liberation of prisoners, the seizure of government funds for the needs of the uprising—such operations are already being carried out wherever insurrection is rife. TIMOTHY " An anonymous computerized market will even make possible abhorrent markets for assassinations and extortion " C. MAY 1992 TIM " I guess now that the Pentagon is setting up a murder pool it can't be illegal for us to do it " MAY. 2003

1 0

For all Batshit ' Commodities are Jewish " Morons
by professor rat 31 Oct '21

31 Oct '21

Don't say I never do anything for you Karl Marx, Capital, Volume One, Part II: The Transformation of Money and Capital CHAPTER FOUR: THE GENERAL FORMULA FOR CAPITAL: "The capitalist knows that all commodities, however scurvy they may look, or however badly they may smell, are in faith and in truth money, inwardly circumcised Jews . . . "

1 0

JEW-GLE
by Punk-BatSoup-Stasi 2.0 31 Oct '21

31 Oct '21

I had the pleasure of using a 'brand new' JOOGLE tablet. The new JOO-O.S. is fucking un-usable, it would be hilarious if it weren't annoying as fuck. the JOO file manager is completely broken. This level of incomptence is surprising even for something like JEWGLE. When I turned up the volume I got a message telling me that it was too loud and 'dangerous' or something like that. See, these CHILD MURDERING, JOO, NON-HUMAN-TURDS are concerned that your hearing may be 'damaged'...while MURDERING CHILDREN for FUN. https://www.wsws.org/en/articles/2018/05/19/pers-m19.html Yeah, that is Jim Bell's American System.

1 0

Machines learn better than Batshit-Crazy technophobes
by professor rat 31 Oct '21

31 Oct '21

Here's just one example Chess programs running on commercially available desktop computers won decisive victories against human players in matches in 2005 and 2006. The second of these, against then world champion Vladimir Kramnik is (as of 2019) the last major human-computer match. Human–computer chess matches - Wikipedia

1 0

Cracking WiFi at Scale with One Simple Trick (ED: lol, wut)
by coderman 31 Oct '21

31 Oct '21

will catch up on other threads, in a signed fashion shortly... as one with 1.3TB of captures in LasVegas metro over 15 mo. i find this amusing :P [NOTE: substitute dedicated GPU hardware for on-demand cloud to same effect!] https://www.cyberark.com/resources/threat-research-blog/cracking-wifi-at-sc… How I Cracked 70% of Tel Aviv’s Wifi Networks (from a Sample of 5,000 Gathered WiFi). In the past seven years that I’ve lived in Tel Aviv, I’ve changed apartments four times. Every time I faced the same scenario: the internet company took several days to connect the apartment, leaving me disconnected and frustrated while trying to watch laggy Netflix on the TV with my cellphone hotspot. A solution I have to this scenario is having the “Hello. I am the new neighbor” talk with the neighbors while trying to get their cell phone number in case of emergencies — and asking if I could use their WiFi until the cable company connected me. I think we all can agree that not having internet easily falls into the emergency category! Often, their cell phone number was also their WiFi password! I hypothesized that most people living in Israel (and globally) have unsafe WiFi passwords that can be easily cracked or even guessed by curious neighbors or malicious actors. The combination of my past experience, a relatively new WiFi attack that I will explain momentarily, a new monster cracking rig (8 x QUADRO RTX 8000 48GB GPUs) in [CyberArk Labs](https://labs.cyberark.com/) and the fact that WiFi is everywhere because connectivity is more important than ever drove me to research, whether I was right with my hypothesis or maybe just lucky. With the continued shift to remote work due to the pandemic, securing home networks has become imperative and poses a risk to the enterprise if not done so. Home networks rarely have the same controls as enterprise networks. And a security program is only as strong as its weakest link. [Figure 1 - CyberArk Labs new cracking rig] Figure 1- CyberArk Labs new cracking rig To test this hypothesis, I gathered 5,000 WiFi network hashes as my study group by strolling the streets in Tel Aviv with WiFi sniffing equipment. At the end of the research, I was able to break more than 70% of the sniffed WiFi networks passwords with relative ease. The Tel Aviv Metropolitan area has more than 3.9 million people — you can imagine what the numbers would have been had we not cut our research off at 5,000 WiFi networks. And while this research was conducted in Tel Aviv, the routers that were susceptible to this attack — from many of the world’s largest vendors — are used by households and businesses worldwide. In this blog, I demonstrate how easily (you do not need a cracking rig) and with little equipment unsecure WiFi passwords can be cracked, thus hacking the WiFi network .At the end, we will reveal statistics of the cracked hashes and explain how to defend your network from this type of attack. Therefore, it is of utmost importance that we know and understand the cracking method to form an adequate defense. Let’s dig in Before [Jens “atom” Steube’s](https://twitter.com/hashcat) (Hashcat’s lead developer) [research](https://hashcat.net/forum/thread-7717.html), when a hacker wanted to crack a WiFi password, they needed to capture a live four-way handshake between a client and a router occurring only during the establishment of the connection. Simply put, the attacker would need to be monitoring the network at the time the user or device connects to the WiFi network. Therefore, a hacker needed to be in a physical location between the access point (router) and the client, hoping that the user would enter the right password and that all four packets of the handshake were sniffed correctly. If a hacker did not want to wait until a victim establishes a connection (which can take hours, who connects to their home network while they are at work?), the attacker could de-authenticate an already-connected user to force the victim to have a new four-way handshake. Another attack vector is to set up a malicious twin network with the same SSID (network name), hoping that the victim would try to log in to the fake network. A major shortcoming of this is, of course, that it is very noisy (meaning it can be easily traced) and can be easily noticed. In simple English, if an adversary wanted to hack/crack a WiFi password, they need to be in the right place (between users and a router) at the right time (when users log in) and be lucky (users entered the correct password and all four packets were sniffed correctly). All of this changed [with atom’s groundbreaking research](https://hashcat.net/forum/thread-7717.html), which exposed a new vulnerability targeting RSN IE (Robust Security Network Information Element) to retrieve a PMKID hash (will be explained in a bit) that can be used to crack the target network password. PMKID is a hash that is used for roaming capabilities between APs. The legitimate use of PMKID is, however, of little relevance for the scope of this blog. Frankly, it makes little sense to enable it on routers for personal/private use (WPA2-personal), as usually there is no need for roaming in a personal network. Atom’s technique is clientless, making the need to capture a user’s login in real time and the need for users to connect to the network at all obsolete. Furthermore, it only requires the attacker to capture a single frame and eliminate wrong passwords and malformed frames that are disturbing the cracking process. Plainly put, we do not need to wait for people connecting to their routers for this attack to be successful. We are just in the vicinity of the router/network getting a PMKID hash and trying to crack it. To crack a PMKID, we first need to understand how it is generated. How is PMKID hash generated and what elements does it contain [Figure 2 - Flow of Calculating PMKID hash and PMK] Figure 2- Flow of Calculating PMKID hash and PMK The hash calculation might seem daunting at first glance but let us dive into it. We need to generate a PMK driven from SSID (the network name) and the Passphrase; then we generate a PMKID driven from the PMK we generated, the AP MAC address, and the client MAC address. So let us see where we can find those: The PMK is computed as follows: [Figure 3 - PMK calculation] Figure 3- PMK calculation - Passphrase– The WiFi password — hence, the part that we are really looking for. - SSID – The name of the network. It is freely available at the router beacons (Figure 3). - 4096 – Number of PBKDF2 iterations [Figure 4 - SSID from a beacon] Figure 4 – SSID from a beacon After a PMK was generated, we can generate a PMKID.The PMKID is computed as follows: [Figure 5 - PMKID calculation] Figure 5 – PMKID calculation - PMK – What we are searching for, generated above. In WPA2 personal, the PMK is the PSK (will be explained in the next paragraph). - “PMK Name” – Static string for all PKMIDs. - MAC_AP – Access Point’s MAC address – This address can be found in any frame send by the router (Figure 4). - MAC_STA – The client’s Mac address can be found in any frame sent by the client’s computer(Figure 4). It can moreover be found in the output of ifconfig\ip a commands. [Figure 6 - PMKID,AP's MAC,Client's MAC]Figure 6 – PMKID, AP’s MAC, Client’s MAC Cracking the PMKID hash is ultimately just generating/calculating PMKs with the SSID and different passphrases, then calculating PMKID from the PMK and the other information we obtained. Once we generated a PMKID equal to the PMKID that was retrieved from the AP (Figure 3), the hash is cracked; the passphrases that were used to generate the right PMK that the PMKID was generated from is the correct WiFi password. Now we know how a PMKID is being generated, and we can continue to the sniffing and cracking phases of our research. Sniffing PMKID To gather WiFi PMKID hashes, a wireless network interface that has monitor mode capabilities is required. Monitor mode allows packet capturing without having to associate with an access point. I bought an AWUS036ACH [ALFA Network](https://www.alfa.com.tw/products/awus036ach?variant=36473965871176) card for $50 (there are even cheaper options) that supports monitor mode and packet injection and went around the center of Tel Aviv to sniff WiFis. Before we can start the sniffing, we need to prepare our environment: I used an ubuntu machine with AWUS036ACH ALFA. [Figure 7 - AWUS036ACH ALFA NIC] Figure 7 – AWUS036ACH ALFA NIC We build the package [Hcxdumptool](https://github.com/ZerBea/hcxdumptool) — a great utility by ZerBea to capture packets from WLAN devices. git clone https://github.com/ZerBea/hcxdumptool.git sudo apt-get install libcurl4-OpenSSL-dev libssl-dev pkg-config make After that, we need to install drivers with monitor mode capability. Each chipset has its drivers: git clone -b v5.6.4.2 https://github.com/aircrack-ng/rtl8812au.git make && make install It is recommended to shut down services that might interfere with [Hcxdumptool](https://github.com/ZerBea/hcxdumptool) execution: sudo systemctl stop wpa_supplicant sudo service NetworkManager stop Then it is time to start sniffing. [Hcxdumptool](https://github.com/ZerBea/hcxdumptool) is a powerful tool that can be used for various attacks, not only the PMKID; therefore, we disable any attack that is not targeting PMKID. sudo ../../tools/hcxdumptool/hcxdumptool -i wlx00c0caac2745 -o Wi-Fi_PMKID.pcapng --disable_deauthentication --disable_client_attacks --enable_status=3 - -i my Alfa NIC, you can execute ifconfig\ip a to find your interface name. - -o the output pcapng of the execution. Now wear a hoody, because you will get a PMKID of every network you cross by that is vulnerable to the attack. [Figure 8 - Me in a hoodie] Figure 8 – Me in a hoodie When I reached 5,000 collected networks, I decided to quit; Israeli summer was too hot for me, so I turned to the fun part — cracking. It’s cracking time! Our first step in the cracking procedure is to install [hashcat](https://hashcat.net/hashcat/), the world’s fastest and most advanced password recovery tool. As the sniffing results are in the form of pcapng, we needed to convert them into a hashfile format to fit it to hashcat. For this goal, I made use of another tool from the great suite of [hcxtools](https://github.com/ZerBea/hcxtools). hcxpcapngtool -o Wi-Fi_pmkid_hash_22000_file.txt Wi-Fi_PMKID.pcapng Resulting in a hashfile that each line takes on the following structure: SIGNATURE*TYPE*PMKID/MIC*MACAP*MACSTA*ESSID* * * Here is an example of a hashline: WPA*01*c6d5c97b9aa88cbe182429275a83efdb*302478bee0ee*acde48a84862*54686557494649*** - SIGNATURE = “WPA” - TYPE = 01 for PMKID, 02 for EAPOL, others to follow - PMKID/MIC = PMKID if TYPE==01, MIC if TYPE==02 - MACAP = MAC of AP - MACSTA = MAC of station - ESSID = ESSID - Not used in a PMKID attack: - ANONCE = ANONCE - EAPOL = EAPOL (SNONCE is in here) - MESSAGEPAIR = Bitmask The next step is to commence the cracking procedure by executing hashcat: Hashcat’s capabilities include several cracking methods, of which the most common are dictionary + rules and mask attack. The methods differ in the way they are forming the Passphrase. We chose to start with what’s called a “mask attack,” due to the terrible habit many people living in Israel have of using their cellphone numbers as WiFi passwords. You can think of mask attack as Regex: - ?d – digits - ?l – lower case characters - ?u – Upper case characters - ?s – special symbols as ? ! $ ….. The mask for the password: 202!$ummeR would become ?d?d?d?s?s?l?l?l?l?u Here is my Hashcat command that tried all the possible cellphone numbers combinations in Israel [the Israeli cellphone prefix is 05] sudo hashcat -a 3 -w4 -m 22000 /home/tuser/hashes/Wi-Fi_pmkid_hash_22000_file.txt 05?d?d?d?d?d?d?d?d -o /home/tuser/hashes/pmkid_cracked.txt During this first execution of the mask attack, we cracked 2,200 passwords. Let’s calculate the number of options for Israeli cellphone numbers: It is 10 digits long and it starts with 05. Therefore, we need to guess the remaining 8 digits. Each digit has 10 options (0-9), hence 10**8 possible combinations. One hundred million seems like a lot of combinations, but our monster rig calculates at the speed of 6819.8 kH/s which translates into 6,819,000 hashes per second. A cracking rig is not required as my laptop can get to 194.4 kH/s, which translates into 194,000 hashes per second. That equals more than enough computing power to cycle through the possibilities necessary to crack the passwords. Consequently, it took my laptop roughly 9 minutes to break a single WiFi password with the characteristics of a cellphone number. (10**8)/194,000 = ~516 (seconds)/60 = ~9 minutes. The cracking speed for hashtypes differs because of different hash functions and the number of iterations. For example, PMKID is very slow compared to MD5 or NTLM. Nonetheless, it is feasible to crack a PMKID hash if the attacker focuses on a specific network, and the password is not complicated enough. Afterward, we executed a standard dictionary attack with the most common dictionary, [Rockyou.txt](https://github.com/brannondorsey/naive-hashcat/releases/downlo…, and cracked more than 900 hashes. Here is a small glimpse into [Rockyou.txt](https://github.com/brannondorsey/naive-hashcat/releases/downlo… content: 123456 12345 123456789 password iloveyou princess 1234567 rockyou 12345678 abc123 nicole daniel babygirl monkey lovely jessica 654321 michael ashley Let’s look over the statistics of the cracked hashes: Cracked passwords by their length: Password Length Occurrences 10 2405 8 744 9 368 12 14 11 14 14 7 13 7 Sum 3,559 As you can see, except for the 10-digit password — which we had a tailored mask for — as the password length increased, the number of cracked passwords decreased. The lesson here? The longer the password, the better. Top 4 masks for the cracked passwords: Mask Occurrences Meaning Mask Occurrences Meaning ?d?d?d?d?d?d?d?d?d?d 2349 10 digits ?d?d?d?d?d?d?d?d 596 8 digits ?d?d?d?d?d?d?d?d?d 368 9 digits ?l?l?l?l?l?l?l?l 320 8 lower case letters Sum 3,633 We can see that cracked passwords most often fit a mask that contains only digits or only lower-case characters. Not all routers support roaming features and are, therefore, not vulnerable to the PMKID attack. However, our research found that routers manufactured by many of the world’s largest vendors are vulnerable. As I estimated beforehand, the process of sniffing WiFis and the subsequent cracking procedures was a very accessible undertaking in terms of equipment, costs and execution. The bottom line is that in a couple of hours and with approximately $50, your neighbor or a malicious actor can compromise your privacy and much more if you don’t have a strong password. Conclusion In total, we cracked more than 3,500 WiFi network in and around Tel Aviv – 70% of our sample. The threat of a compromised WiFi network presents serious risk to individuals, small business owners and enterprises alike. And as we’ve shown, when an attacker can crack more than 70% of WiFi networks in a major global city with relative ease, greater attention must be paid to protecting oneself. At the most basic level, people who use your network take part of your bandwidth, which may slow down your internet experience. However, more consequential is that once attackers gain access to your network, they can launch various man-in-the-middle (MITM) attacks. That can lead to attackers gaining access to your important accounts, such as your bank account, your email account (which is everything in modern life) and compromising other sensitive credentials. This also further opens attack vectors to your IoT devices like smart home equipment, smart TVs, security systems, etc. For the small business, the risk lies in an attacker infiltrating a network and then moving laterally to high-value applications or data, such as a billing system or cashier. Concerning the enterprise, it’s possible for an attacker to gain initial access to a remote user’s WiFi and then hop to the user’s computer and wait for a VPN connection or for the user to go to the office and move laterally from there. From a broader perspective, computers and other devices are usually not accessible from outside of the network because of NAT, but once an attacker is in the network, it facilitates a range of attack vectors. How should I protect myself? - Choose a complex password. A strong password should include at least one lower case character, one upper case character, one symbol, one digit. It should be at least 10 characters long. It should be easily remembered and hard to anticipate. Bad example: Summer$021 - Change the default username and password of your router. - Update your router firmware version. - Disable weak encryption protocols (as WAP or WAP1). - Disable WPS. It’s important to note that implementing [multi-factor authentication (MFA)](https://www.cyberark.com/what-is/mfa/) for personal WiFi is difficult and largely impractical for a personal WiFi and a non-technical consumer. It is also unlikely that MFA will be widely available for general consumer use cases in the near feature. I would like to give a big shout-out to [Atom](https://www.github.com/jsteube) and [ZerBea](https://github.com/ZerBea) for their incredible work on this attack technique and for their work in general. I hope you enjoyed this blog and that you will take the required steps to secure your WiFi network. And as a reminder, none of the passwords we cracked were used for unauthorized access to these WiFi networks or any other information accessible via these networks.

3 4