Rogue Device Spotlight: Reaver Pro II
Popularity: 5
How often the rogue device is used in the wild to conduct real-world attacks, with 1 being the rarest, 10 being widely used.
The Reaver is a common enough device, thanks to its simplicity and how easy it is to acquire. However, its limited capabilities has made it less popular than some of the other pre-built network testing devices on the market.
Simplicity: 7
The cost or “DIY burden” of the device, availability (ease of acquisition), and degree of skill necessary to deploy/operate the device, with 1 being expensive/difficult to build, not publicly available, and requiring deep technical expertise to operate, 10 being low-cost, available for purchase online, plug-and-play operation.
The Reaver was built for simplicity and ease of use. Not only is the product being sold fully built for the reasonable price of $75 online on the manufacturer’s website, even the Amazon reviews focus on the ease of use (and the fact that it’s being sold on Amazon should further emphasize the intended audience). However, the $75 price is still quite high when comparing The Reavers capabilities to similar devices at similar price points.
Impact: 3
The potential damage caused by successful execution of the attack, with 1 being exposure of trivial information from the target, 10 being organization-wide superuser-level compromise or equivalent.
The Reaver Pro II simply won’t compromise most systems. It’s meant as a fairly basic tool that is very good at one thing - cracking insecure wireless networks. Even the Reaver Systems blog points out that you should not use the device if you are in a hurry and that for pros familiar with Kali Linux or the original Reaver open source tool, the Reaver Pro II might not be the best device to use.
Reaver Pro II
Created by Reaver Systems, the Reaver Pro II is a WiFi penetration testing tool focused on networks with insecure WEP and WPA2 implementations. Requiring minimal configuration, and capable of being controlled entirely through a straightforward web interface, the Reaver Pro II is advertised as one of the easiest methods available to identify and breach vulnerable WiFi networks. As the name implies, the Reaver Pro II makes extensive use of “reaver-wps”, an open source implementation of the WPS PIN brute forcing attack revealed in 2011 by Stefan Viehböck. The hardware is simply a branded version of theOpenWRT supported Alfa AP121U travel router; the same hardware used in previous versions of the Hak5 WiFi Pineapple.
Reaver Pro II Hardware Specifications
- CPU: Atheros AR9331@400MHz
- RAM:32 MB
- ROM: 8 MBOS: OpenWRT
- I/O: Ethernet, USB
- Radios: Atheros AR9331 802.11 b/g/n
Reaver Pro II Pictures
Reaver Pro II Notable Features
Like many other portable penetration testing devices, the Reaver Pro II is based on the popular OpenWRT distribution of Linux. Unfortunately, there is little support or documentation available for modifying the system software on the device. Whereas other OpenWRT devices are easily extendable with the addition of new software packages or even peripheral devices, the Reaver Pro II is essentially a “black box” product meant for fairly basic tasks. This lack of extensibility can be a hinderance for more advanced operators, as it puts arbitrary limits on an otherwise extremely capable software and hardware combination.
The web interface on the Reaver Pro II is designed to be stylish and simple to operate by users of all skill levels; more like configuring a home router than operating a penetration testing device. Configuration and operation of the Reaver Pro II is indeed extremely easy, but much like the limits placed on the hardware and software, more advanced users may feel encumbered by an interface which clearly puts design aesthetics over flexibility.
However, issues with the product’s software design and hardware capability are moot in light of the more pressing functionality issue: fewer and fewer networks are still vulnerable to the WPS brute forcing that the Reaver Pro II is primarily designed to perform. While the product’s WEP cracking functions will make short work of networks still running such as an outdated encryption scheme, the number of variables involved in successfully performing a WPS PIN brute force attack make cracking into a WPS network much less likely (and much slower). The target network needs to have WPS enabled in the first place, and even then, improved protection routines in modern routers may block attempts to guess the PIN after only a few minutes. Even under ideal conditions, the brute force attack employed by Reaver can take over 8 hours to successfully recover the key, making this online attack about as easy to track as the sun on a cloudless day.
Conclusion
Between the automatic configuration and slick web interface, the Reaver Pro II is certainly one of the easiest to use penetration testing tools on the market. Almost anyone could pick up a Reaver Pro II and begin scanning for, and gaining access to, vulnerable networks. Priced at an attractive $75, the Reaver Pro II is a dream product for the average person who simply wants to crack their neighbour's WiFi.
