Slashdot Mirror
New Wireless Security Standard Has Old Problem?
eggboard writes "Wireless security expert Robert Moskowitz, who sits on IEEE and IETF committees on that subject, sent me a short paper on a glaring weakness in the Wi-Fi Protected Access (WPA) protocol that's replacing the weak and broken WEP system well discussed here at Slashdot. His paper, which I've posted here, proves definitively that while WPA itself remains robust and secure, the interface for choosing consumer passwords makes it simple to snarf a tiny bit of network traffic and perform an offline dictionary attack. For Slashdot readers, this probably seems trivial, but because Linksys, Apple, and others are letting users enter My Dog Has Fleas as their passphrase, WPA might be less secure for home users than WEP."
Way to tell everybody my password.
Man, now I have to change it.
My Dog Has Fleas is a positively fantasic password compared to the usual choice of a middle name, spouse's name, child's name or birthdate.
Or, of course, the infamous "password."
If all it took were a dictionary attack to sniff a password, at least it took that much.
This isn't some simple passthrough that can be gotten through by knowing a couple backdoor passwords, it's a real live algorithm.
But in the end, it's up to the user to enter a password and as long as humans remain humans easy to remember passwords will always be chosen over #HrS2sWmNw/()LggDwMn.
It doesn't matter how easy to break a new system is, it's better than having no security.
I recently took my laptop on a trip across Toronto and in a couple of hours spotted around 60 wireless networks. Around 80% had NO encryption enabled at all. And yes, the most common SSIDs are 'default' and 'linksys'.
So make a system more complex and people won't use it - which defeats the whole object of it.
Jolyon
Please read my Canon EOS tech blog at http://www.everyothershot.com
The important thing here is that this allows for actual security for users smart enough to use good passwords. Even in hex users can enter dumb passwords ("AA AA AA AA AA...").
Only long passwords and encouraging the users to use good quality passwords/phrases really helps.
Ultimately though, these passphrases are flawed anyway- they are a form of shared password. History has shown this to be a thoroughly bad idea, one passphrase per user/machine is a far better idea; and even the user shouldn't know what it is (that way it can't get beaten out of them- black cosh crytography works pretty darn well.) These standards organisations aren't even trying.
-WolfWithoutAClause
"Gravity is only a theory, not a fact!"Hold it, someone correct me if I'm wrong, but doesn't this mean that instead of collecting thousands of weak packets in RFMon you just need to collect one packet from each network and brute force it?
Which method is harder to crack? I'd take WEP. Simply because its takes longer to collect the necessary packets; especially on a smaller network. On a larger network it may work out to be better from a security standpoint for the cracker to start a brute force attack on the packet on a spare computer and let it sit for a few days instead of having him hide a pocket PC with a wifi card in range of the AP for a few days.
The idea here (I know, I was there when we voted it into the standard) is that the PBKDF2 is computationally significant.
Thus when you perform your offline dictionary attack, for each lookup in the dictionary, you must perform 4096 HMAC_SHA1s and this might take some time if you are looking up a large number of dictionary entries.
The basic conflict is the wide disparity between the power of processors in low end 802.11 transceivers and high end computers. The time to compute the 4096 HMAC-SHA1s is significant on say a slow ARM7TDMI and the 4096 value is a compromise to limit the delay in computing this. This delay affects the time from pressing return on the keyboard, to the time the PTK can be known and communications can begin.
However the attacker can apply his cluster of 3GHz PCs, or his FPGA HMAC_SHA1 parallel processor, or his supercomputer array, and make the speed of dictionary lookups relatively insignificant compared against the strength of the passwords being used.
The wise people asked for a much higher number than 4096. Some implementation types beat it down to 4096, and here we are..
Evil people are out to get you.
"Poorly choosen passwords lead to insecurity."
Well, duh. I didn't need three pages of dense, TLA-obscured claptrap to tell me that.
It takes far longer than that. Getting thousands of interesting packets takes weeks for a 256bit WEP network being used by only one person.
And yes, this is from experience. I will neither confirm nor deny that I was given permission to try this...
Ars Technica has a good summary of what you can do with SSID's and WEP to improve your wireless network's security:-
Security Practicum: Essential Home Wireless Security Practicesperform an offline dictionary attack
What, you sneak up behind the sysadmin and brain him with a copy of Webster's?
Just enable the WEP, use secure applications for sensitive data, and quit worrying about it.
Don't worry, set him up, turn on wep, make some keys, and also use MAC filtering so only known stations can get in. To get around both those someone has to be fairly determined, just like someone determined to get in your house can probably do so, no matter what locks and alarms you install. That'll keep out the accidental neighbors and casual drive by scanners. Anything important like credit card numbers should be encrypted from browser to server with SSL anyway.
Now, if a bank or hospital was going to install a wireless wep on a campus with account passwords etc in the air in the parking lot, then you'd have good reason to worry.
try { do() || do_not(); } catch (JediException err) { yoda(err); }
Actually, a dictionary attack is inlikely to break 'My Dog has Fleas' because it is composed of multiple words, is fairly long, and has mixed case. Dictionary attacks typically involve just one or possibly two words strung together. Anymore and it becomes pretty impratical.
The only pratical way to find that password is through brute force. In this scenario, the longer the password and more possible different characters (ie lowercase and uppercase, and spaces) makes it more difficult. Thus, 'My Dog has Fleas' would be more secure than 'mdhfaymdt' against a brute force attack. The latter could be broken in a matter of hours through brute force.
I.O.U One Sig.
Speaking as a cryptographer and longtime security geek, this weakness is about as damning as... using a 128 bit cipher that only gives 120 bits of protection. Look at the big picture. Most people don't even use WEP, let alone limit access by MAC address. The average user is SO oblivious to security, sharing passwords, opening .EXE attachments... I'd hate to recall how many times I found things like .rhosts files with '++' in them among career Unix programmers who must have known better. WEP was a semi-broken protocol, TACACS+ was a totally broken protocol, there was no way one could use them without compromising security. Just as nobody can use a number of commercial software products without compromising security.
WPA, on the other hand, is a very well-designed protocol. It is only as weak as its users are careless. And one need not choose "h^Ne#b8SV@,4g%yP" as a password to avoid this attack, any semi-uncommon phrase of 4 or 5 words will do.
I will deal with this problem by threatening users with a nasty note in their personnel file if they choose a sh*t passphrase -- and terminate their wireless access. And yes, I will try cracking the passwords myself, just as I have done with operating system passwords for several years.
I sure wish all my security problems were so simple! At least WPA *can* be secure, unlike the steaming heap of offal that most folks call a desktop operating system.
Okay, so users might pick a password which is less than 20 characters and is dictionary based. Guess what? They always will... Security is a balancing act. If you make security too cumbersome, then users will find a shortcut and abuse it, making it worse than no security. If the spec enforced something like: "passphrases must be at least 128 hex characters" you'd end up with a bunch of passwords which were all "AAAAA..." (or something similiar)
The simple truth is people are lazy. How many passwords do you have? And how many password guarded accounts? I bet even the most diligent of us out there only have a small number of "good" passwords which we use for damn near everything and never rotate.
The problem with WEP was flawed crypto. No matter how good my password was, someone could crack it with unacceptable ease. At least with this new scheme those of us with "good" passwords have a chance.
A program implementing a true brute force attack would be really stupid, though, at least for [J. Random Muppet]'s account; lots of time would be wasted trying aaaa, aaab, aaac etc., when the password is far more likely to be "password" or "150367". Once you force people to use passcodes of a length sufficient that even dumb people are likely to enter more than one word, or a word with at least one number, you enforce a level of security unbreakable by most entities over the average duration of a user's session. OK, that isn't anywhere near perfect but it's a lot better than allowing "password", "banana" or "slashdot"....
"'I pass the test,' she said. 'I will diminish, and go into the West, and remain Galadriel.'"
- JRR Tolkien.
Home users are going to generate less traffic than businesses, and so it will take even longer to get enough traffic. Unless you happen to notice a van parked outside your house for a couple days, or find yourself staring down the barrel of a pringles can, you can relax.
- Turn off SSID broadcasting
- use a unique SSID
- For God's sake, change the admin password
- Turn on WEP
- Use MAC address filtering
Congratulations, you're now more trouble than you're worth.It's actually a stupid idea.
Your chance of winning the lottery is exactly the same if they change the winning numbers, or if they don't change them.
Making users change passwords does the following:
1) Annoys the users.
2) Users are likely to pick easy passwords to remember, rather than memorizing a really good password just once. Or worse, they will write the password down.
3) Does all that for no increase in security. Yay!
If tits were wings it'd be flying around.