Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Researchers Crack iOS-Generated Hotspot Passwords in 50 Seconds

Yes, we should all be scared of someone hacking our iPhone hotspot since someone is going to setup a multiple computer hacking device just to screw with us. And by the time they figure it out, we'll have finished our coffee and left.
 
So next time someone stands next to me with a Radeon GPU I´ll turn it off :D

Seriously: can´t all password be hacked?
 
Quite frankly, the chance of someone wanting to break into your hotspot is so small to begin with, that this is more than enough security.
 
As noted by ZDNet though Apple's password generation system is flawed, it is a more robust solution than what is used by other companies like Microsoft. For example, the Windows 8 phone utilizes default passwords that consist of eight digit numbers.
Click to expand...

We are doing it better than Microsoft, therefore it must be ok.

Seriously though using dictionary words and using 8 digit numbers - security wise both are equally lame. Why ZDnet would claim one to be "robust" than other is beyond me.
 
fivedots said:
Genuinely curious: What is the advantage of using a GPU for this type of processing vs. standard CPU processing?
Click to expand...

GPUs are designed to operated on MANY thousands of identical objects simultaneously. For example to move al the vectors that make up some wire frame.

Or more simply the GPU can try many guesses all at the time time whee as the CPU has to make guesses one by one. The GPU can be thousands of times faster as very simple receptive tasks but is harder to program
 
Really? This is a concern?

Oh yeah, because I have such great concern of someone going to this effort at the airport or hotel in a nearby room while I have a hotspot open for my kids. This is so inane. Not to mention, the device broadcasting the hotspot shows if anyone is connected and how many connections are using the hotspot. Not too hard to shutdown if you have an unexpected user. This of course is assuming you don't want to make your own password. And people make worse passwords on their own frequently than these auto-generated ones.

Simply useless post IMO.
 
People don't change the default hotspot password? That's the first thing I did when I toggled personal hotspot on the first time. I figured iOS gave the same default hotspot password on every iOS device just like home routers do.

I guess they'll have to change iOS 7 so that it prompts people to create their own hotspot password. Then you'll have people typing in "12345678" or "password" for the password.

The people who are uninformed about good security practices or those who value personal convenience over security will continue to be easy targets no matter what.
 
avanpelt said:
People don't change the default hotspot password? That's the first thing I did when I toggled personal hotspot on the first time. I figured iOS gave the same default hotspot password on every iOS device just like home routers do.

I guess they'll have to change iOS 7 so that it prompts people to create their own hotspot password. Then you'll have people typing in "12345678" or "password" for the password.

The people who are uninformed about good security practices or those who value personal convenience over security will continue to be easy targets no matter what.
Click to expand...
Eh, that's overblown. The default passwords are random enough vs. the likelihood that someone will be trying to brute force your Personal Hotspot with an array of GPUs.
 
notabadname said:
Oh yeah, because I have such great concern of someone going to this effort at the airport or hotel in a nearby room while I have a hotspot open for my kids. This is so inane. Not to mention, the device broadcasting the hotspot shows if anyone is connected and how many connections are using the hotspot. Not too hard to shutdown if you have an unexpected user. This of course is assuming you don't want to make your own password. And people make worse passwords on their own frequently than these auto-generated ones.
Click to expand...

Totally agree.
I guess it depends on how you use it though. If you leave it on all the time, you can always assign a secure password.

If you only turn it on when you want to let a co-worker use it to check their email, and they ask "what's the password?"

"chair5620" is a lot more convenient than "4a?2ozeATK:RDsM"
 
So next time you are in a cafe' or airport lounge, and using the default generated password, be wary of anyone with a quad-SLI AMD Radeon 7970 rig. Got it! Thanks for the heads up.
 
Alpi69 said:
So next time someone stands next to me with a Radeon GPU I´ll turn it off :D

Seriously: can´t all password be hacked?
Click to expand...

Yes they can ALL by hacked but some would take so long to gues that the sun would burn out first. I'd say if it takes over a million years you are safe. But 51 seconds is to short.

Why would some one want to sit a Starbucks and guess passwords, He may hope to collect some data from some one doing on-line shopping. Granted must people will not be typing in credits cards but if you wait long enough and if the process is automated you can just let it run for a few weeks.

This is the kind of "hack" some one might install in that 7/11 store that is next door to the Starbucks. He puts it in a closet and leavs it running for months. or maybe the machine sets in a car parked in the lot outside.

The four vide cards do NOT need to be physically at the Starbucks place, I could build a server at my house with a tiny Android phone left on a carter at serveral stores in the area. The phones send the passwords to my decrypt server.


Who would do this.. I had a credit card number stolen then he theft within a minuted had placed an order for $10,000 of wholesale women's clothing. I disputed the charge and did not pay it. (this CC number was stolen the old fashion way by a waiter in a restaurant. You give him your card and he buys something with in before he hands it back to you so it is not reported stolen.)

So there is good motivation to hack passwords. One in a hundreds times you can get maybe a CC number that is not reported stollen.

So to answer the question "Why woulf anyone pick me to target?" They don't they target everyone, thousands of people and you just happen to be in range.

What is the "range" of a WiFi? Using just a cell phone antenna not far. Using a big high gain antenna that is maybe about a foot long, 1/2 mile is not unreasonable. People have done 13 miles but that takes careful setup at each end.
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back