Distributed Brute Force @ Home Project

[Sys7emR00t]

Greets peeps,
Roughly 7 or 8 months ago a rather interesting discussion appeared on the ol' Backtrack 4 forums on brute forcing. You can view that topic here, http://bit.ly/nB2diq. The author, CKing, is mostly (to my understanding) just conceptualizing a free-to-use online WPA brute forcer for Backtrack Forum members. Well, he mentions that cost would still be an issue, but that he'd fork up some preliminary hardware. This got me thinking... why not build a WPA Brute Forcing (or even brute forcing in general) distributed computing project. I think it'd be best not to focus on WPA only (especially since there's already a fatal flaw in TKIP I've been looking into... those of you wondering why tkiptun-ng doesn't work, I can help), it'd be especially nice if we could make a versatile platform that can run a number of brute force attacks.

It would be much like the folding@home (http://bit.ly/9yJHvq for more) or other @home distributed projects. Distributed computing harnesses millions of volunteer computers as a parallel supercomputer. This means we'd need a willing audience. To help with this I'm thinking the client used to perform an attack would require that you've already donated somethign like 24 hours of GPU/CPU time. Lots of people with small servers could easily add a VM to handle additional volunteerin which would be nice. Someone may have to run a centralized server, which I'd be willing to sink a little "one-time-only" money into.

As far as the programming goes, I'm not too familiar with this sort of project, but Berkley offers some tools like BOINC (the Berkeley Open Infrastructure for Network Computing. More here, http://bit.ly/aUbL0P). Clients would be supported on all OSs.

That's about as far as I've gotten, right now I'm really just looking for reactions and maybe a few dedicated people with some basic (or expertise) programming skills to contact me. You can email me directly @ jesusfreak2121@gmail.com

P.S. The project would be called TRANSLTR.

[Barry]

Other than the "because we can" and "it's cool", I don't see the point of a system like this. Businesses really shouldn't be using wpa, they should be using some kind of radius server. If someone is using a distributed system, or other kind of cluster to crack your home network, you have bigger things to worry about.

[Sys7emR00t]

I'm confused, what's the point of any brute force tools? Projects like this already exist (like http://www.wpacracker.com/) but cost because they aren't distributed computing projects.

[Scamentology]

I am not a big fan of helping people spy on their neighbors. You might also want to consider the implications of not knowing whose .cap file you are cracking and who may knock on your door. It is a good idea but that's where it ends. Sorry.

By the way - breaking into someones personal network and spying on them is similar to the creepy pervert that peeks in peoples windows at night. ITS WEIRD.

[Sys7emR00t]

Scamentology, I agree 100%. This tool would be developed for authorized penetration tests. Granted, it would undoubtedly receive lots of traffic from others abusing the tool, just like every pen testing tool included in Backtrack. All I'm saying is, your point is well made against every brute force tool in Backtrack. It doesn't nullified the development of another one.

[Scamentology]

My argument wasn't against the tool itself (because I like the idea). Its against the fact someone else is using the tool on my computer that bothers me. I know what the tools in my install are doing. I would have no control over this setup and don't think the benefit (quick cracking) is worth the risk to me or that it may potentially harm the public.

I get it - there will always be someone to abuse a system but they won't do it with my computer if I can help it (This isn't a challenge folks ).

Scamentology, I agree 100%. This tool would be developed for authorized penetration tests. Granted, it would undoubtedly receive lots of traffic from others abusing the tool, just like every pen testing tool included in Backtrack. All I'm saying is, your point is well made against every brute force tool in Backtrack. It doesn't nullified the development of another one.

[Sys7emR00t]

I'm going to say this isn't really going anywhere... sounds like the consensus is it's a bad idea.

[CKing]

Getting someone to prove that they aren't using the service illegitimately is probably the biggest hurdle I came across while working on my project. The only reasonable solution I came to was my original "trusted only" scheme that only allowed credible or respected members of a group upload files for cracking, ie backtrack forum members with a minimum post count. The second biggest problem I ran into while pursuing the distributed cracking idea was lack of bandwidth; sending and receiving that volume of information is a huge burden even on most home LANs, let alone over the internet. I do have a contact willing to provide server space and a large chunk of bandwidth, but obviously if the project gets big and we end up with over 20 or so people constantly contributing cpu a much more expensive solution will be required. Projects like @home are likely donated bandwidth and many resources from big companies that get tax credits and good pr out of it, no-one is going to want to put there name on a cracking service.

I don't think we should be looking at these problems as a reason to quit trying, but just as hurdles that must be overcome.

[arpad]

CKing how can I reach your service? We talked via email before some month.
I think it is good. I sent the CAP file and after some hour I got the ....

[CKing]

CKing how can I reach your service? We talked via email before some month.
I think it is good. I sent the CAP file and after some hour I got the ....

Site was taken down by my host despite my asking if the project would be acceptable and checking the t.o.s.
If you want a cap to be checked against my word-list you can email a handshake to c.kingwpa@gmail.com WITH EVIDENCE THAT YOU HAVE PERMISSION TO ACCESS THE NETWORK.