nerdexam
GIAC

GCIH · Question #480

Which of the following is vulnerable to a dictionary-based, password-cracking attack against wireless networks using WPA and pre-shared keys?

The correct answer is B. A WPA2 network using PSK squirrelled. WPA and WPA2 networks using a pre-shared key (PSK) that is a common dictionary word are vulnerable to offline dictionary attacks because the passphrase is used directly in the key derivation function.

Vulnerability Exploitation & Privilege Escalation

Question

Which of the following is vulnerable to a dictionary-based, password-cracking attack against wireless networks using WPA and pre-shared keys?

Options

  • AA VPN using SSH public/private keys
  • BA WPA2 network using PSK squirrelled
  • CA WPA2-Enterprise network using PSK O3N7Ydp
  • DA network using EAP-MD5 for authentication

How the community answered

(31 responses)
  • A
    10% (3)
  • B
    74% (23)
  • C
    3% (1)
  • D
    13% (4)

Why each option

WPA and WPA2 networks using a pre-shared key (PSK) that is a common dictionary word are vulnerable to offline dictionary attacks because the passphrase is used directly in the key derivation function.

AA VPN using SSH public/private keys

SSH public/private key authentication relies on asymmetric cryptography; there is no shared secret or password hash exposed to a dictionary attack.

BA WPA2 network using PSK squirrelledCorrect

WPA2-PSK uses the passphrase in a PBKDF2-based key derivation (CCMP/TKIP), and an attacker who captures the 4-way handshake can perform an offline dictionary attack by hashing candidate words and comparing them to the captured material. The PSK 'squirrelled' is a real English word present in standard wordlists, making it trivially crackable with tools like Hashcat or Aircrack-ng.

CA WPA2-Enterprise network using PSK O3N7Ydp

WPA2-Enterprise uses 802.1X with EAP and does not use a PSK at all, so the premise is contradictory and the complex string 'O3N7Ydp' would not be a dictionary word regardless.

DA network using EAP-MD5 for authentication

EAP-MD5 uses a challenge-response mechanism over the wire and is vulnerable to different attacks (e.g., offline MD5 cracking of the challenge-response), not a straightforward WPA PSK dictionary attack.

Concept tested: WPA/WPA2 PSK dictionary attack vulnerability

Source: https://www.wi-fi.org/download.php?file=/sites/default/files/private/WPA3_Security_Considerations_20190408.pdf

Topics

#WPA2#pre-shared key#dictionary attack#wireless security

Community Discussion

No community discussion yet for this question.

Full GCIH Practice