RE: New attack on WPA/WPA2 using PMKID - dominikg43g34 - 08-08-2018 The only thing that remains open is the combination of PSK networks with 802.11r FT - because there is a (small) functional benefit (2 messages instead of 6 during the roaming event). => Disable sending of PMKIDs for PSK network (because it does not make sense, right). Despite of the fact, that the playrules for a WPA2 PSK network doesn't change because of the new attack, the mitigation for a vendor is pretty simple: However, some vendors might send the PMKID anyways. So, the combination PMKID caching and PSK networks does not makes sense (right?). The reason is, that the PMK is dynamically derived per user per session and is a random value, not included in any dictionary (at least I'm sure for all TLS based EAP methods like EAP-TLS, PEAP, EAP-TTLS etc.). However, as you outlined, the attack does not work for these WLANs. PMKID caching makes sense for WPA2 Enterprise (802.1X) networks. In my opinion no, because there is no functional benefit (except with 802.11r FT). Maybe this is a silly question, but does PMKID including make sense for WPA2 PERSONAL networks? The PMKID is included in the first EAPoL message of the 4 way handshake. However, I tested it as well using enterprise grade equipment (Cisco). => Therefore, it is not vulnerable, right?! There is no PMKID in the first message of the 4-way handshake. I did a quick test using an AVM Fritz!Box (popular model in Germany). I guess, consumer grade hardware won't be attackable using this tool, because these simply do not perform PMKID caching (i guess). However, regarding the question whether 'my device is affected' or not: Mostly for me, I'm writing a short summary of the stuff here: RE: New attack on WPA/WPA2 using PMKID - netgab_joe - 08-08-2018įirst of all, congratulations to your work - nice job.Įspecially, because the attack is so simple, I'm wondering why nobody discovered it earlier

Figured I'd bring scapy into play and make this a lot easier to work with. RE: New attack on WPA/WPA2 using PMKID - stryngs - nice work. I'll keep testing with a few more adapters and routers and post once I've got something worth posting! 'test.txt' was the file containing the BSSID of the AP (colons removed) Hcxdumptool -o output.pcapng -i wlan0 -t 5 -enable_status -filterlist=test.txt -filtermode=2 I've used two separate adapters (Panda PAU09 148f:5572, and Alfa AWUS 051NH v2 148f:3572) against all previously mentioned APs. All configured with WPA2, no clients attached. I've used three separate routers (Linksys WRT54GL, Netgear Nighthawk R7000, and Belkin N450). So far, nothing but goose eggs (no success yet).

RE: New attack on WPA/WPA2 using PMKID - M4d6r33nh4t - 08-06-2018

Best wpa2 wordlist 2018 german