HakByte: Capture Wi-Fi Passwords From Smartphones with a Half-Handshake Attack

In this episode, we show how hackers can abuse convenience features of Wi-Fi to extract passwords from nearby smartphones belonging to Wi-Fi networks they've connected to in the past.

-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆

-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆

[trackerkan]

Should be named "Capture Wi-Fi Password Hashes..."

[dianenek]

I enjoy watching your videos. You're a good teacher. You should make it a little clearer that you are capturing hashed passwords. That being said, I work a second job cleaning offices at night. Based on passwords people leave lying around on sticky notes it's clear that people persist in using easily crackable passwords. There certainly needs to be more education about this.

[surajkanekal]

This only works if the password is listed in the wordlist.

[dontlikenamesonline]

I really don't see the point in this extra work. Why not just use the de-authentication attack? The bottom line is it still results in having to brute-force the password hash. This method just seems like it has unnecessary additional steps, for example, creating a Wi-Fi network. Just de-authenticate a device from its access point and then capture the handshake when it tries to authenticate. I suppose its good to know another method to capture the same information but it just seems like more work.

[thepianoaddict]

7:28 it is actually an OR operator, not an AND.

[DavidStringham]

Works as long as you know an SSID. If you try sniffing for probe requests, only mobile devices before Android 10 and iOS 14 send directed probe requests for non-hidden networks.

[OwenGilmoreOG]

So how should one protect against such an exploit? Tbh I am more worried about a back door on my el cheapo router than some hackers hanging about in my apartment lobby or something but it’s good to know that such things exist

[xAF]

It's odd to me that smartphones don't use a record of your Wi-Fi access point's BSSID/MAC address along with the SSID to avoid getting duped by fakes, or at least provide a pop-up a warning about the mismatch and requiring you to accept or decline allowing the connection before whitelisting or blacklisting the new MAC address. (Would be useful if you have multiple WIFI APs with the same SSID). I'm sure there are methods and gadgets that can spoof an AP's MAC address, but I'd be surprised if typical commercial Android or IOS devices have the ability even if they're rooted.

One easy way to help you avoid falling victim to this trick is to disable "Wi-Fi auto-connect" to all of your stored routers and access points on all of your mobile devices. You'll still be somewhat vulnerable at home or office, but if your phone doesn't auto-connect to your router, SSID spoofing attempts will be ignored while you're out and away from the nest.

[mr.quackersjunior]

Would you be able to send deauth packets to a network to make, for example a roku device, deauthenticate with the users home Wi-Fi (for example named “MyHomeWifi), but then the roku device would try to connect to your honey pot which is also named “MyHomeWifi” giving you the half handshake? Or would the roku device not try because it would keep trying the actual users home wifi instead of yours?

[scottlewis]

Seamlessly combining Mediatek 5G and Wi-Fi 7 with ATSSS could be a game-changer for rural areas and bridge the digital divide.

[____.__._.._]

Nice video, I've got a question tho. So the catch here is, we set up a network with same SSID as a network that we are interested in getting in (obtaining a password), because devices like smartphones and such would connect automatically when in proximity. Makes perfect sense, but now there are 2 networks with same SSID and different BSSID. It would make more sense for a device to remember the BSSID for such cases, and it would be a simple countermeasure, or I amgetting smth wrong?

[Andrei-cpjr]

I heard of this on the radio. They said to always disable Wi-Fi when leaving home.

[DresATX]

How do you know which of the many BISSDs to use? As you demonstrated, Wiggle pulled up many various options

[iMBox]

Great work, thanks for sharing. Could you explain the use of the password list file. It suggests that would have been included, so the password revelation is only as good as the list you have?!

[AntiFreakMachine]

I saw your collection of michael bolten mp3s when you exported packets.

[SchoolforHackers]

Kody, you’re an S-class hacking video boss.

[anthonysijera]

So still brute force right? Since you use Wordlist .

[evascordato]

In the end, all depends on having a good password list and a little luck

[Electrum]

Wait but you are using a list of passwords to verify ? What if the password is not in your bruteforce list of passwords ?

[cedricvillani]

P.s don’t let people know they have a “BAD”password unless you directly know that person!! And never forget, NO GOOD DEED EVER GOES UNPUNISHED !