How to Steal Wifi Passwords Using Social Engineering

It is possible to obtain a Wifi password without the need for a powerful processor or a lengthy brute-force attack. Do you know how thieves steal cars and jewelry? They can also steal your password in a comparable manner: this is what will be described in this post.

Meet social engineering, a fancy designation for "phishing". This type of attack is commonly used for stealing sensitive data, such as credit card details or account credentials. The popularity and spread of this method come down to one single characteristic: ease of use. Perpetrators don't need any background knowledge in coding, cyber security, or computer science, and the technique doesn't require advanced hardware.

Today's attack is the art of fooling the user into thinking you're the legitimate manufacturer of his router: you then pretend that a firmware update is required and prompt the user for his password. You thus gain access to the Wifi network effortlessly, without using any brute-forcing tool whatsoever. The demonstration below is based on a Wifi pentesting tool called Wifiphisher.

Requirements

• Raspberry Pi 3 or later running Kali Linux (tutorial here)
• Two standard network cards and one supporting monitor mode and packet injection
• Your own Wifi network to perform the test (see legal disclaimer in the side menu of the website)
• Laptop with a decent internet connection to control the Pi via VNC (tutorial here)

Installing Wifiphisher

Wifiphisher is an open-source tool available on Github but we can also install it directly from the Kali repository:

root@kali:~# apt-get install wifiphisher

Next, we need to install the file setup.py located in the wifiphisher/ directory:

root@kali:~# cd wifiphisher/python setup.py install

Initiating the attack

First, we need to put our network interface into monitor mode with the airmon-ng command. Then, we'll start wifiphisher with a specific flag (--force-hostapd) to avoid a bug in the Hostapd section of the script:

root@kali:~# wifiphisher -aI wlan1 -eI wlan0mon --force-hostapd

The -aI flag sets the interface used to create the fake AP, and -eI sets the one used for the deauth attack (more on this later).

The script will start running, automatically selecting the network interface and listing all nearby wifi networks with basic info like their respective power, channel, and encryption. We then select the target and press enter to launch the attack.

Several "scenarios" are available, so we'll choose the first one (Firmware Upgrade Page):

Unfolding the attack

The first step in the automated process is deauthenticating all users from the target network, while creating in parallel a fake AP with the same SSID as the target, but without any encryption. The logic behind this is that the user, frustrated by the lack of Internet access, will head to his Wifi settings and see the new AP that we created. As he notices the absence of any password, he will connect to it and be greeted with a phishing page. Meanwhile, Wifiphisher will have already detected the model of the router (using its BSSID) to adapt the phishing page and make it look as realistic as possible. 

Unfortunately, I couldn't capture more images because my Pi overheated and shut down.

The page will inform the user that a firmware update is needed and that he needs to enter the WPA passphrase in order to proceed. To ensure that the user gives us the right passphrase and not some random garbage, Wifiphisher will capture during the deauth process a WPA handshake. If the given key doesn't match the handshake, it will result in an error and won't let the user continue. Once the right key is entered, a fake progress bar will appear and will slowly fill up in five minutes. And that's it, just like this, we see the target's passphrase appear in the Wifiphisher window on our screen. At that point, the fake AP will be shut down and the deauth attack will stop. All things should return to their normal state.

Wrapping up

This is a great opportunity to emphasize how careless users can be. Such tools would have never existed if they weren't successful, which proves that too many people are unaware of the security risks they are exposed to. Social engineering is by far the most effective attack method, with a success rate surpassing 90 percent.