[Owasp-mobile-security-project] Cracking iOS personal hotspots using a Scrabble crossword game word list

Jeffrey Walton noloader at gmail.com
Mon Jun 17 16:58:52 UTC 2013

On Mon, Jun 17, 2013 at 9:19 AM, Andreas Kurtz <mail at andreas-kurtz.de> wrote:
> Within a recent study, we investigated the method used by Apple iOS to set
> up a secure WPA2 connection when using an iPhone as a Wi-Fi mobile hotspot.
> We found out that Apple iOS generates weak default passwords which makes the
> mobile hotspot feature of Apple iOS susceptible to brute force attacks on
> the WPA2 handshake. More precisely, we observed that the generation of
> default passwords is based on a word list, of which only 1.842 entries are
> taken into consideration. In addition, the process of selecting words from
> that word list is not random at all, resulting in a skewed frequency
> distribution and the possibility to compromise a hotspot connection in less
> than 50 seconds. Spot tests have shown that other mobile platforms are also
> affected by similar problems. Users of mobile hotspots, especially of
> iOS-based mobile hotspots, are advised to change their initial passwords.
Nice work Andreas.

>From page 6: "Since our preliminary word list was not precise enough
and contained many entries, not complying with the underlying password
scheme, reduction of the search space was our primary goal. Therefore,
we reverse engineered the relevant parts of the Apple iOS operating
system, to extract the exact word list which is used during the iOS
setup procedure to create hotspot default passwords."

Did you publish the word list? Publishing the wordlist would be very
helpful for password management. Others could use the list to ban the
words in their filters. In fact, Gutmann recommends the practice in
his book on Engineering Security
(http://www.cs.auckland.ac.nz/~pgut001/pubs/book.pdf, page 541): "A
far better approach to checking passwords is to use the attacker’s
strategy against them. Instead of applying an arbitrary set of rules
to block out an equally arbitrary amount of password space, check the
passwords against a dictionary or wordlist [40]."

Again, citing Gutmman (p. 534): "The current state of the art in
proactive password checking uses a decision-tree based classifier
(which works much better than the standard Bloom filter-based approach
for this kind of problem) that checks against a 28MB wordlist of 3.2
million words stored in condensed form in a classifier occupying a
mere 24kB of memory, with the various implementations being freely
available on the Internet... [54][55][56][57]"

You would also want to check the user supplied password against that
wordlist filter, too.


More information about the Owasp-mobile-security-project mailing list