

A reasonable prosumer-sized (~US$5K) GPU cracking rig with s can try around 2 million hashes per second – but there are 36^11 candidates to try! But don’t feel too reassured by the “2087 years” estimate. The speed of WPA2, and the speed of modern GPUs, are essential to this answer. Unfortunately, as demonstrated in several published attacks, an attacker is easily able to force the same key to be used twice by replaying network traffic in a way that forces a tremendous amount of packets to be generated. WEP is a stream cipher which relies on never using the same key twice to provide security. This tool will be able to use statistical attacks to determine the key stream and the WEP key for the target network. Once we have done that, we will use a tool called aircrack-ng. In order to crack WEP, we need first to capture the large number of packets that means we can capture a large number of IVs. >Naive-hashcat uses various dictionary, rule, combination, and mask attacks and it can take days or even months to run against strong passwords. On most recent firmware, there is an exponential backoff on WPS connection attempts. In my experience this has usually been under 10 minutes.

