Stronger Encryption for Wi-Fi

sp00 writes "The first products certified to support Wi-Fi Protected Access 2, the latest wireless security technology, were announced by the Wi-Fi Alliance on Wednesday. The Wi-Fi Alliance says WPA2 is a big improvement on earlier wireless security standards, such as Wired Equivalent Privacy (WEP), which hackers have found easy to circumvent. It includes Advanced Encryption Standard, which supports 128-bit, 192-bit and 256-bit keys."

Comments

Sssssh!

[FooAtWFU]

Please don't tell my neighbors about this technology. Thanks. :)

Re:Sssssh!

[the_denman]

the ones I like the best are the "dlink" points
where they haven't even set the admin password yet

Re:Sssssh!

[Anonymous Coward]

The subject is misleading :P I thought it was secure-secure-secure-secure shell

Re:Sssssh!

[Hobadee]

Haha! Join the club!

I went over to my friends house and was surprised that I was getting a WiFi signal. I asked my friend, "Dude, when did you get wireless?" He was like "We didn't."

Cue a slow grin growing over my and his faces.

Re:Sssssh!

[LnxAddct]

Linksys APs are sweet too, no WEP by default, no firewall, and if you can root a wired computer on the network,the passwords on all the routers are "admin" (IIRC) and the username is blank. I'm pulling that from memory, it may be slightly off. The Metasploit project along with ettercap is really great too for such cases. Using those tools you can be a white hat and enable WEP for them, leave them a message explaining what you did and how to set their laptops up to use it, and then sleep well at night :)
Regards,
Steve

Re:Sssssh!

[Nyder]

too late, I know now.

=)

(at least the person I "borrow" my wifi from doesn't use any protection...)

Re:Sssssh!

[CaptBubba]

You don't even have to root a machine on the wired network. The administration page is accessible via wireless. Scary.

Re:Sssssh!

[jrockway]

My dorm is even better. I work for the computer center and know that it's illegal to have access points, but I felt like going war walking last night. One building, two floors, 17 access points. All named belkin54g, linksys, wireless, or default. Except for two (unencrypted) networks called "Pablo's Private Network" and "don't use".

If you don't want me to use it try some WEP at least. I am typing this on a channel-6 "linksys", actually. Now the next time I need illegal movies I'll just use this AP; it's not my quota that we'd be going over :)

And hey a bandwidth suspension takes effect after 1 day and lasts a week. So with 17 access points I have unlimited internet! Yay!

Re:Sssssh!

[gabba_gabba_hey]

No kidding, my SO thinks I'm a hero for getting her free broadband by putting a wifi card in her desktop. Thankfully she's got 4 neighbors within range so if any one of them in particular figures it out, she'll still have access for a while. Maybe it's not technically ok, but all she does is surf and check email about twice a week so I doubt they'll miss the bandwidth. Yay neighbors!

Re:Sssssh!

[Anonymous Coward]

I work for the computer center and know that it's illegal to have access points

Illegal? You mean the cops will come and take you away to jail for having an access point, even if you're not using it? How about if you were outside the library? I heard that's a Federal Law.

Re:Sssssh!

[XMyth]

The sad thing is that *IS* a feature! not a bug!

Re:Sssssh!

[Deideldorfer]

I must live in a paranoid neighborhood. I've got 3 networks within range and they are all encrypted!

Re:Sssssh!

[Hobadee]

...I like a lot!

Although if you are looking to download movies, there is a great windows program called "share scan" which scans a network for windows shares and creates and index which you can then search and download from.

For a Linux equivelent, try fast file search, which is actually a web server frontside for an index, which is created by a cron job which scans the network for samba shares.

(sry thisn't quite on topic to the original topic)

Re:Sssssh!

[jrockway]

> Illegal? You mean the cops will come and take you away to jail for having an access point, even if you're not using it? How about if you were outside the library? I heard that's a Federal Law.

What a waste of time spent writing that comment. Illegal as in prohibited by the AUP that you sign.

When you get caught, I call it getting AUP'd. Ahaha.

AES-256

[Anonymous Coward]

Be sure to use AES-256.

upgrades to old equipment

[the_denman]

The real question is will the manufacturers come out with new drivers/firmware to take advantage of this new technology?

Re:upgrades to old equipment

[aredubya74]

Nope. They'll come out with new equipment, which we will buy. Sigh.

Re:upgrades to old equipment

[pfunkmallone]

Yup, another technology where the first incarnation was buggy, and they charge you to upgrade to what you SHOULD have gotten the first time around.

I agree...it's highly unlikely Linksys will be releasing firmware for their older equipment.

Re:upgrades to old equipment

[ksilebo]

Manufacturers may not release the firmware, but others may develop their own firmware. OpenWRT is a good example, for Linksys WRT54G(S) routers. Perhaps a nice little package for it.

Re:upgrades to old equipment

[sadler121]

Unless you have a Linksys WRT54G router, where there are already open source firmware projects. Once the standerd is settle on, (which sounds like it is pretty much settled on now, from RTFA), I would expect these various projects to upgrade to WPA2.

Linksys may not like this, and may attempt to sue these projects into oblivian, (using our "friend" the DMCA). But it shouldn't be to hard to implimate.

Re:upgrades to old equipment

[afidel]

uh, is the hardware capable of doing multiple AES-128 conversations in real time with changing keys all without an ASIC? I doubt it. So new hardware will almost assuradly be needed.

Re:upgrades to old equipment

[interiot]

ASIC? ASIC?? Aren't most routers these days implemented on top of a general-purpose CPU?

And yes, the WRT54G already does AES-128 in its stock form.

Re:upgrades to old equipment

[brian ferullo]

and for the first eleven or so months it will be barely functional under windows XP and not at all in previous versions.

Question

[etymxris]

I hear that the various encryption protocols are easy to hack. But what about MAC filters? They have the advantage of putting all the security work on the server side. And though MAC addresses are easy enough to spoof, you have to know which MAC address to spoof, and there is quite a large address space.

So, are MAC filters any less/more secure than WEP?

Re:Question

[ericpi]

I believe MAC filters are inherently less secure than encryption: The MAC addresses, I believe, are sent in the clear (i.e., not encrypted), so all someone has to do is listen to which devices are already operating on the network, then spoof their MAC to match.

Re:Question

[etymxris]

Yes, but as far as I've seen, a (whitelist) MAC filter prevents anything not on the list from receiving any acks. So you wouldn't be able to listen to see what MACs are available, right?

Re:Question

[Anonymous Coward]

No. You don't need permission from the AP to look at stuff sent out cleartext.

Re:Question

[ericpi]

At first, you don't trasmit anything. (Since, as you point out, the whitelist would prevent the access point from responding to you, anyway.) However, you just listen to the existing legitimate traffic. Then clone your device with the same MAC as one of these legitimate (and already on the whitelist) devices.

Re:Question

[Anonymous Coward]

wrong

Re:Question

[etymxris]

Yes, OK, I understand now. You would need special equipment, I imagine, unless there is a way to get a standard card to listen to all traffic on a given channel. But this would still make it easier than WEP. So I guess that answers my question.

Re:Question

[Erik Hollensbe]

As I understand it (I'm not really a network geek, so I could be wrong here), arp poisoning is an easy tactic to start getting data from any machine with a signal strength that can reach you.

Here is a description of what it entails.

Re:Question

[Minna Kirai]

You would need special equipment, I imagine,

Nope.

unless there is a way to get a standard card to listen to all traffic on a given channel

Yep. Lots of normal cards can do this easily. The rare cards that can't are considered "crippled". A few cards can collect more than 1 channel at once.

Re:Question

[docstrange]

Mac filtering is way less secure than wep, and requires about 30 seconds to bypass. In addition your data is all transmitted in plain text when you don't use wep. The only thing mac filtering will prevent is random clients from associating (who don't have the tools needed to sniff the mac out of the airwaves, change their mac, then associate.)

1. You can still see the data in the air, unencrypted when mac filtering is used.
(kismet will do this for example...)

2. The mac address is transmitted in plain text along with the data. Picking the mac out of the air is easy.

Re:Question

[Anonymous Coward]

MAC filters are not encyrpted, because the router, and any other equipment along the way, needs to read them and will not be able to do this if you're encypting them. So, all I need to do is sit outside your house and sniff all packets in the air, watch for a MAC address that seems to be talking and then change my MAC to that address. Then, hey presto, you're gone...

Or to put it another way, yes, please only rely on MAC filtering. On another note, where is your house?

Re:Question

[Anonymous Coward]

But what about MAC filters?

Forget MAC filters. I want WINDOWS filters. That would stop 99% of the security problems right there.

Re:Question

[Anonymous Coward]

Mac Address filtering is most useful when used in a layered defense. Without encryption, a hacker can easily find the MAC Address by sniffing the unecrypted packets. Then, he need only spoof the Mac Address which is fairly easy to do if you have hardware that supports it. However, if encyrption is used, it must be broken before the MAC Address is revealed, adding one more step to the hacking process.

While WEP is very insecure and can be broken in a matter of days on most networks by a variety of applications, it still serves as a deterrent considering that over 60% of wireless networks have no security. If you're using WPA-PSK with a key that changes frequently, and have a 20+ character password which is not prone to dictionary attacks, you will probably be very secure against attacks on your network and WPA is already available as a firmware upgrade in nearly all 802.11g hardware. AES is even more secure, however it requires additional hardware to allow encryption/decryption without a performance hit. There are already some products on the market which support AES such as the Buffalo wireless Router, and I think will see some firmware upgrades on wireless routers and pc cards in the future. I believe for example that the netgear wg511 and wg511t were advertised as having the ability to support both AES and WPA with a firmware upgrade. As of now, they only support WPA.

Anyways, if someone is really paranoid about security they can always use a VPN to access their LAN. That way, even if an intruder does break into your wireless network, they still won't be able to access your files unless they crack the VPN.

I'm currently using WPA-PSK, Mac Address Filtering, and of course have turned of SSID broadcast and I feel quite secure. At this moment, I can access 4 unsecured wireless networks from my dorm room. Security isn't fullproof- it's only a deterrent. Why hack into my system, when there are 4 other wireless routers which can be accessed with the click of a mouse?

Good

[ergo98]

I feel I speak for wireless users everywhere when I say "Good". What more is there to say?

Re:Good

[SoSueMe]

I feel I speak for wireless users everywhere when I say "Wha?"

Sadly, this is more prevalent than we like to think.

Re:Good

[gabba_gabba_hey]

Sure, as long as the neighbors continue to set up their new gear with the default (unencrypted) settings then it's great!

overhead

[a3217055]

All these new ways of encrypting data over wireless is great. Security of data is a good service. But how much will it cost, do you need more expensive hardware to create such encryption, will there be a loss of performance and other related factors. These are important and must be tested before we start saying that wap2 is the world's greatest thing for wireless encryption.

Re:overhead

[The Islamic Fundamen]

Secure Wireless Network is pretty much an oxymoron. Just by nature, a Wireless Network is unsecure. I bet a WAP hacking group has already intercepted some packets that use this newfangled encryption and is already working on cracking it. Well, thats just my 2 cents.

Re:overhead

[a3217055]

i agree, wait for the patch that allows snort to crack this

Re:Does this means...

[0racle]

Depends on how motivated people are.

WPA2?

[Trygve]

Correct me if I'm wrong, but isn't WPA2 just the WiFi Alliance being stuborn about what to call 802.11i? I mean, WPA was just supposed to be 802.11i minus everything that required hardware upgrades. WPA2 is just 802.11i, only not a real standard, ooh boy!

Re:WPA2?

[lizrd]

Not exactly. Wi-Fi/WPA/WPA-2 are all industry standards based on the various 802.11? IEEE standards. The difference is that WECA (Wireless Ethernet Compatability Alliance) actually does testing rather than just publishing standards like IEEE does. In order to get the fancy sticker on the package you need to pay a couple of grand and get your product tested to the standards. The benefit of certification is that you have some idea that the product was actaully implemented to the standard correctly.

That said, WPA-2 provides basically zero benefit over WPA. WPA relies on the same RC-4 algorithm as WEP, but has a few patches put in place to resolve the problems it had. The most important one is using a new key for each frame. Given a choice between an algorithm that can be broken given 11MB of data and one that has no known attacks, do you think that it matters which you use to encrypt 1500 bytes? Not really.

The good news about WPA-2/802.11i (same thing, just certified and a less scary name for the PHBs) is that it breaks hardware compatibility, and that means there's a chance that things have been done right this time.

"Easy to circumvent"?

[Anonymous Coward]

All of the known WEP attacks are based on receiving weak IV frames (usually after sifting through gigabytes of data). Modern WiFi chipsets (i.e., those made within the last 2 years or so) do not send weak IV frames all that often, if at all.

It is not as easy as everyone says. Try it with some brand-new, high quality equipment and you may be surprised at the result.

Re:"Easy to circumvent"?

[Anonymous Coward]

Obviously you don't know what YOU are talking about. Just because you have a buunch of scripts that is capable of cracking WEP does not mean you have a knowledge of why WEP is vunerable. WEP cannot be made totally secure (the claim was not made by me or the grandparent), however, many vendors have highly reduced the vulnerability of WEP.

Please come back with an argument once you become a little more knowledgeable in this area. A**hole script kiddies need not apply.

Re:"Easy to circumvent"?

[Anonymous Coward]

your parent is right. weak IVs are no longer required to compromise WEP keys. so the efforts of the vendors you are talking about are void. WEP is inherently insecure.

google for "korek" and his ideas of WEP attacks and you will know what i mean.

Re:"Easy to circumvent"?

[Anonymous Coward]

Why do you think you are smarter than FMS? Read the paper. Then read the Wagner post reference in the paper. FMS published an attack knowing the Wagner attack, and the Wagner attack is three time more effective. Now does the new equipment filter those weak IVs. I don't know. But they have been selling crippled encryption for at least 3 years now, so I guess you could trust them:
http://it.slashdot.org/comments.pl?sid=118626&cid= 10018785

Re:"Easy to circumvent"?

[Anonymous Coward]

Sadly, you do not know what you are talking about. I mentioned nothing about IV.

Re:"Easy to circumvent"?

[Anonymous Coward]

Um, that post doesn't disagree with the grandparent you're arguing with. Whats the beef?

Re:"Easy to circumvent"?

[ericsan256]

Looks like my suspicion was correct about weak IV's still out there, even though most modern cards have firmware to avoid sending them. Aircrack is an example of how to inject packets to get weak IV's flowing again. What if someone brings there 3yr old WiFi card into the network. Don't they start sending weak IV's all over the place, and the AP responding with more of them??

Re:"Easy to circumvent"?

[virtual_mps]

All of the known WEP attacks are based on receiving weak IV frames (usually after sifting through gigabytes of data). Modern WiFi chipsets (i.e., those made within the last 2 years or so) do not send weak IV frames all that often, if at all.

That's actually not true. There were certain attacks that relied on weak IV's. So manufacturers stopped sending out the weak IV's--which means the keyspace is reduced and now other attacks are more feasible. I don't know of a script kiddie tool to do this, but there have been papers published.

Hmm

[Mattwolf7]

I doubt this is going to take off. Since we have enough problems with people enabling protection in the first place. Unless companys start requiring it, which won't happen because my local ISP gives you a wireless access point with service. But they do not enable WEP or any encryption on the devices.

Oh well mine is enabled

----
Free IPods

Re:Hmm

[gad_zuki!]

>Unless companys start requiring it

That's a bit out there. Do you really want the ISP doing what they think is best for you (or them)? "Oh, so you're running a webserver." Block port 80. "Oh, so you aren't using Microsoft's Firewall?" It gets installed by a tech and they charge you 50 bucks for the trouble, even though you have a hardware firewall, etc. Trust me, you don't want to be punished by rules set for the lowest common denominator.

The problem here is the problem we see everywhere when it comes to computers: usability. WEP is counter-intuitive to implement. WPA is a step in the right direction with a single password (as people understand the concept of passwords). The new MS wireless manager in SP2 goes a lot way to simplifying wifi also.

Make no mistake about it, there are lot of people who tried to get WEP to work only to have it fail. I know I've had bizarre issues with WEP that could only be fixed with a hard reset on the device and falling back to default settings, a firmware downgrade, upgrading firmware on the card, generating new keys every so often because the thing just didn't like the old ones, playing around with advanced wireless settings, etc. I don't think that level of troubleshooting should be expected from a typical end user.

Re:Hmm

[afidel]

Yes, Yes I do. I WANT the default to be secure. I want them to block outgoing port 25 traffic except when asked by a customer with a listed SMTP server. I WANT them to setup WEP at a minimum, and preferably WPA by default. People who know well enough to turn off the security features will do so when they feal it is apropriate and the great unwashed masses will be protected from their ignorance. It's the same reason I applaud Microsoft for turning off almost all services by default in Server 2003, and turning on the firewall by default in XP SP2. If there are stupid technical glitches with an implementation then fix it and support your clients, that is afterall what you are paid to do. The spam problem is one rooted in default permissiveness and trust, we don't need more similar problems.

So...

[NETHED]

So now instead of just a few hours with a current computer, it will take a bit longer, maybe a week or something. Then someone will figure out that the key string is MAC dependent based on time signitures, or something, and there we go, no more security.

I have no illusions about the "security" of WiFi, no matter how encrypted it may be. The signal is traveling through open space for anyone to look at, and if you look at enough of the signal, you can find the pattern. This just increases the processing power needed by the AP and Card, further pushing the development of more advanced, procs. (Don't get me wrong, I'm all for this)

I understand that corperations are interested in this for security, but for an average joe like me, I keep my access point wide open for anyone to use. If you want to look at my GF's reciepe's or our photos, go right ahead.

Security is only as important as you make it to be.

Re:So...

[Anonymous Coward]

The signal is traveling through open space for anyone to look at, and if you look at enough of the signal, you can find the pattern.

Thanks for letting us know you don't have the slightest clue how encryption works. Now go play in your room, we're talking about grown-up things.

;)

Re:So...

[Bruiser2B27]

While this might be a long shot, what if your neighbors decide to steal Internet access from you? What if they decide to use that access for illegal activies? If and when the FBI/police trace that stuff back to your IP, it will be you in custody, and your PC(s) taken away. Do you really trust your neighbors?

Re:So...

[Vellmont]

Wow. You certainly have put the security researchers in their place with that "or something". The truth is that if implemented properly you can have highly secure communications while anyone can monitor those signals.

It remains to be seen if this is the case, but if you really want security use proven technology like SSH or a well implemented VPN.

Re:So...

[spectral]

Then point to the logs the AP prolly keeps as to when various people connected using it, and say "Hey, wasn't me." There's at least an easy way to deny it.

If you have the thing encrypted up the wazoo, and they break it, then the courts are going to say "Sorry, not possible. It's using really good encryption."

If you're really worried about trusting your neighbors, then give them free access to it, and limit their speed somehow so it doesn't bother you. Voila, you're a carrier with no knowledge of what they did on your wires, and you can't be held responsible for their actions.

Re:So...

[Agent Green]

If you want to look at my GF's reciepe's or our photos, go right ahead.

Actually, we just want to see her photos. :)

Re:So...

[Anonymous Coward]

Actually, we just want to see her photos. :)

What he doesn't realize is that his girlfriend already posted some photos of herself on Kazaa for everyone to see. She looks wonderful in them.

Thanks for the great jerkoff material.

Re:So...

[Anonymous Coward]

This attitude is understandable but uninformed. This is like saying, "I know I won't use my gun so I don't bother locking it away".

It's people like you we have to thank for the millions of drones out there pumping spam and viruses around, all because you only think about how it effects YOU.

When you don't protect yourself because you think its not worth it - you punish everyone around you.

Re:So...

[sameerd]

You are right when you say that if you look at enough of the signal you can find the pattern. But that is what public key cryptography is all about. If public key crpytography is properly implemented NO MATTER how much you look at the encrypted signal the time you require to "find a pattern" could be made to be decades and centuries. The devil is in the implemtation.

The problem with the earlier WEP protocol was that they used a 24 bit IV key which they transmitted in plaintext along with the rest of the key. Some of these IV keys were cryptographically "weak". This is just poor implementation and many cards and AP's had updates to prevent them from using these weak IV keys. (making the old protocol much more secure)

Maybe the new protocol will have some flaw that will render it crackable. But that just will mean poor implementaion of "practically uncrackable" cryptosystems. Any who is to say an update wont be able to take care of that.

Re:So...

[kelnos]

Then point to the logs the AP prolly keeps as to when various people connected using it, and say "Hey, wasn't me." There's at least an easy way to deny it.

many consumer-grade APs don't keep logs, and those that do have the feature disabled by default. usually these logging features involve dumping the log to a certain port on a PC, so that would mean having another machine running all the time with software to receive and store the logs.

If you have the thing encrypted up the wazoo, and they break it, then the courts are going to say "Sorry, not possible. It's using really good encryption."

for starters, if you configure the thing properly, your neighbors aren't going to be able to break it without some serious effort on their part. if you employ some common strategies (changing WEP keys every X days, for example), your risk is lowered even further.

If you're really worried about trusting your neighbors, then give them free access to it, and limit their speed somehow so it doesn't bother you. Voila, you're a carrier with no knowledge of what they did on your wires, and you can't be held responsible for their actions.

common-carrier laws are a bit more complicated than you think. you can's simply claim to be a carrier. at the very least, most ISPs contain clauses in their terms of use that specifically prohibit you from reselling their service (and no, giving it away for free doesn't exempt you from this clause).

if this guy really wants to give his neighbors access to his girlfriend's recipes or photo albums, he should put them on a webserver or something. running an unsecured wireless AP that is easily accessible by others outside your control is foolish and irresponsible, and there's no sane reason why anyone _needs_ to do so.

Wait...

[rmdir -r *]

Is this a software protection? A firmware protection? Will older devices be able to connect to WPA2 networks? That article is a bit... scarce on the details.

Why not get users to use what they have

[the_denman]

Using 128 bit encription on most residental points will take several weeks of listening to break (correct me if I am wrong here) Shouldn't we concentrate on convinceing users on just doing something.

Re:Why not get users to use what they have

[howlatthemoon]

It depends on the access point, some older ones from a few major manufacturers are vulnerable to a Newsham (I think I got that right) attack, you can get a key off of those with relatively few data packets, not that I have ever done that ;-). That said, you are right, a 128 bit key changed weekly will be very hard to crack given the light usage by most residential users.

Re:Why not get users to use what they have

[gad_zuki!]

> on most residental points will take several weeks

Try months (and thats on old equipment with no firmware upgrade to filter out weak frames). Try not getting spotted sitting there with your laptop and running airsnort all day.

Do these WEP fatalists also refuse to lock their cars/house doors because anyone with some skill and one easily gotten tool can open their doors? Do these people also make their own padlocks in their basement because every manufacturer has a master key? Do these people also use blank passwords because cracking NTLM or most passwd files is very doable, etc.

Re:Why not get users to use what they have

[dasunt]

Do these people also make their own padlocks in their basement because every manufacturer has a master key?

Warning: Geek nit-picking ahead!

I have taken a few padlocks apart, and have never seen the pins have more then one break. That means that there is no master key for the padlock.

I'm not saying that it is impossible to have a padlock with a master-key, but that every padlock that I've seen has no master key.

Re:Why not get users to use what they have

[Just Some Guy]

Do these WEP fatalists also refuse to lock their cars/house doors because anyone with some skill and one easily gotten tool can open their doors?

The problem lies more with people who say "we're already using WEP, so why enforce SSH/IPSEC/VPN?" People should think of WEP as a minimal "better than nothing" layer to keep casual visitors out while the real strong encryption protects from the more advanced crackers, but that's not usually what happens.

I'd rather build the entire network to be safe with WEP disabled and then turn it on when I'm finished than have it in the back of my mind as a safety net when I'm making design decisions.

Re:Why not get users to use what they have

[Taurine]

Do these WEP fatalists also refuse to lock their cars/house doors because anyone with some skill and one easily gotten tool can open their doors?

No, we don't use Wi-Fi at all because we don't trust it yet. Until we are sure that it is ready we continue to use wired networking.

Re:Why not get users to use what they have

[Anonymous Coward]

"Try months" ...

Try hours.

Packet replay/injection techniques, such as the one implemented in reinj.c can dramatically decrease the time needed to collect enough weak IVs to make cracking a breeze. WEPWedgie can also be used for this purpose, as well as a number of other interesting and frightening injection attacks (think host discovery, portscans, etc...). As I understand it, this technique will work whether or not the vendor has fixed their WEP implementation, but don't quote me on this statement. Also the improved FMS attack implemented in the bsd-airtools package should speed things up when you actually get around to cracking the collected packets.

On top of that any well equipped wardriver is going to have a high quality card like the Senao 200mw 2511CD PLUS EXT2, a wicked directional antenna, and perhaps a bidirectional amplifier. They can be a surprisingly long distance away, and still fsck with your network.

WEP is irrecoverably broken.
Google the above packages for more information.

AES is good, FIPS 140 AES is better...

[xxxJonBoyxxx]

If there's one place closed source is on the level with open source, its when the entire package has been validated by the folks at NIST under the FIPS 140 program.

http://csrc.nist.gov/focus_areas.html#cryptograp hi c

Flaw fixed?

[sploo22]

One of WEP's biggest design flaws has been that all data is encrypted with the same key. Sure, there needs to be some shared secret for authentication, but the actual data transfer should use a negotiated key known only to the user and the AP. WEP is all right for authentication, but when it comes to security it's useless against other authenticated users.

It wouldn't be a bad idea to use something like this for non-broadcase Ethernet either, now that I think of it.

Re:Flaw fixed?

[JavaNerd]

For a small or home network with trusted users, sharing the key works just fine. For larger networks, you would still want to secure the wireless access itself and also use IPSec to secure users from each other. This is as true for a wired network with a large user population as it is for a wired network (remember packet sniffers and switch hacks?) IPSec is standard with IPv6 and can also work with IPv4 (the "regular" internet).

Re:Flaw fixed?

[afidel]

Cisco LEAP fixed that flaw a long time ago by using per user dynamic WEP keys, so does WPA 1 and 802.1x. Hell WPA provides for per packet keys if the hardware can do it, so cracking the WEP is basically impossible and superfelous. Btw 802.1x is not specific to the 802.11 suite, it can be used on 802.3 wired ethernet as well (hell it can be applied to just about any medium).

Re:Flaw fixed?

[MoralHazard]

It wouldn't be a bad idea to use something like this for non-broadcase Ethernet either, now that I think of it.

Um, yes, it WOULD be a bad idea. WEP/WPA/WPA2 are all server-client protocols, in that they encrypt transmissions between a number of remote clients and a single central point. In order to make the analogy hold to wired Ethernet, you would have to make every Ethernet switch/hub/router support the crypto interaction with clients. As well as replacing every NIC in existence.

And even then, the encryption wouldn't buy you much, because it only encrypts between the Ethernet hosts and the switch. It CAN'T encrypt transmissions past the switch, because it would be hiding the IP addresses and port numbers that are need to route the packets at an IP level. If you wanted to move the link-level encrypted packets further, you would have to either decrypt them and transmit them upstream in the clear, or you'd have to configure every single route in between your endpoints with the WEP-ish key. Which would defeat the point of encrypting, because in order to use this on the Internet, everybody on the Net would have to have the same key.

This is one of the reasons why we have things like IPSEC and VPNs--they're based on PKI systems, or they're built with a centralized authenticator/concentrator, or both. And they encrypt IP packet contents, not the IP packet itself (including the header info), meaning that any router can pass them without having to open the crypto-envelope.

WEP and its relatives are link-level encryption, and only meant for a single physical hop, and they're not particularly scalable. They're niche solutions that either wouldn't work or wouldn't be worthwhile for most other applications.

Re:Flaw fixed?

[Abcd1234]

For a small or home network with trusted users, sharing the key works just fine

The point, though, is that if you use the same key all the time an attacker has even more time to crack the encrypted data stream. OTOH, if you only use the preshared key for negotiating a new session key, it becomes a lot more difficult for an attacker to sample enough encrypted material to perform a proper attack.

802.1x

[Anonymous Coward]

Our network uses a 802.1x system with dynamic WEP keys.. the system requires you to re-authenticate (handled automatically by 802.1x client software) with a randomly generated key every 15 minutes.

What is the real advantage to WPA here?

Re:802.1x

[ImaLamer]

Why not solve the problem by putting another line of authentication in place?

My school *shudder* has access points in many of the labs but after a student said he was going to "hack" into it there was a simple warning:

1. We know the MAC address to every computer in the building...
2. We keep logs of MAC addresses that don't match our set (apparently he went around reprogramming the MAC addresses to a now defunkt card maker's line for easy log watching, except for one lab which was un-re-programmable)
3. Breaking the WEP key is a crime, during the investigation we will try to track your MAC to you (hope you didn't pay with a credit card - your breaking into "protected" systems, in fact a federal crime)
4. You can't get anywhere, you must authenticate through the NT (blah) server for network access
5. It's pointless

Really, it made sense. He simply stated that there was no point in getting a signal without access rights. The man's first job was to secure the wired network. Once the AP's were put in, it wasn't a problem.

Could you run wild on your companies network by just plugging into the next available switch?

If so, fix that problem first.

Re:802.1x

[Anonymous Coward]

MAC address logs are not likely to be court admissable becuase for one thing, network device manufactuerers will produce more than one device with a given MAC address over a period of time (sorry, there are only so many unique addresses you can make with the small MAC field).

Secondly, MAC addresses can be spoofed. How do we know that someone else didn't try to make it look like someone else to frame them? Or why not just sniff the network and find a good MAC address to use?

I hope you're not using a shared WEP key. That would make your network trivial to crack!

Can we upgrade firmware ?

[phoxix]

Or do we have to buy new products ?

I'm finding those wireless encryption thing to be a load of bullshit.

It seems like everytime they finally seem to get the crypto part down (WPA), we get something new (WPA2). I think I'll wait for WPA12938491849034 before upgrading any of my hardware.

Thankfully we have IPsec. (if only the OS-X version didn't suck so much)

Sunny Dubey

Re:Can we upgrade firmware ?

[ctime]

the original design specks for WPA included the ability to flash/bios upgrade the code on the wireless adaptor to support these new fangled protocols...pending the original hardware has the processing ability to support the new stuff (256 bit aes encryption for eg. might be difficuilt on really early adaptors)..although i might add aes encryption is actually less cpu intensive than say wep, but it could remain a problem.

Re:WHY WONT SLASHDOT POST THIS STORY?

[pilot1]

That's obviously BS - just look at who wrote it.
Lyons doesn't exactly have a reputation for writing accurate, nonbiased, intelligent pieces.

hers the deal

[ctime]

WPA-2 with AES 256bit encryption and Protected Extensible authentication protocol (PEAP).

Deal.

I still prefer a wired connection.

Re:hers the deal

[presmike]

why... did you just figure out a way to break AES that your not sharing with everyone else?

Pointless..

[mcknation]

As long as these acess points are shipped with encryption turned *OFF* by default this is like pissing in the wind. It could be 1 billion bit one time pads and woulnd't make any difference. In my neighboorhood there are 10 unencrypted networks....all on the default channels. Out of the box straight onto the network is how they are set up. Joe Sixpack doesn't have time to deal with encryption.

*don't worry much residential war drivers..there will still be free lunch for a long time to come... /-McK

Re:Pointless..

[lavorgeous]

All of the 2Wire routers I've seen, which are, I think, distributed by DSL providers, seem to have WEP turned on.

So some provider is doing something right.

Re:Pointless..

[subreality]

Not pointless.

Even if it's turned off by default, the ability to turn on good crypto is perfectly useful.

Re:Pointless..

[bolind]

Amen Brother. Having just completed a 2½ week roadtrip in California, it never took us any longer than 20 minutes to locate unencrypted WiFi internet access, no matter the town. The option of good security is great, but don't expect the sheeple to start thinking just because of that.

Re:Pointless..

[Takeel]

Joe Sixpack doesn't have time to deal with encryption.

It might be more accurate to say "Joe Sixpack won't set aside the time to learn how to properly use the really complicated technology he buys".

I mean, really...if the huddled masses had their way, there'd be one really big red button on a computer that says "do what I want" on it. You and I both know it's not really that easy, although companies love to spend big bucks on marketing to try to convince people that it is that easy.

Re:Pointless..

[ivan256]

As long as these acess points are shipped with encryption turned *OFF* by default this is like pissing in the wind. It could be 1 billion bit one time pads and woulnd't make any difference. In my neighboorhood there are 10 unencrypted networks....all on the default channels.

You make it sound like this is the end of the world. What's the point of turning on encryption if you're not trying to hide anything? So what if somebody can see what porn site you're surfing... And if you're sending confidental data you should be doing it over an encrypted protocol anyway. There's no reason to turn this stuff on by default because most people just plain don't need it. If you need to turn it on because you have neighbors that live close by who steal your bandwith otherwise, or you need encryption to feel like you're enough of a geek, then it's there for you. As for me, my access point is open dispite WEP being enabled by default. Maybe somebody driving by some day will find it useful for a few minutes, and it sure is nice not having to tell people how visit what the key is to connect.

Re:WHY WONT SLASHDOT POST THIS STORY?

[Anonymous Coward]

Which part is BS? The one where he directly quotes the people who chose Windows over Linux because it is cheaper?

Re:WHY WONT SLASHDOT POST THIS STORY?

[Anonymous Coward]

As slashdot is becoming more "mainstream" you can expect more fluff and less punch. Hell, half the "science" articles are just ads now.

AES protects entire frame

[jonabbey]

I believe the AES implementation they are using actually does encrypt the ethernet (MAC) address, unlike WEP. (See Tying It All Together in this article for corroboration of that.)

WPA2 with AES is the real deal.

Re:AES protects entire frame

[mbvgp]

If AES encrypts the Mac address it would make base 802.11 not work. So it sends the mac address normally.
But it uses the mac address and some other header fields along with the encryption key to make the encryption more tight.

Re:AES protects entire frame

[ThisNukes4u]

So what your saying, is that they are creating another layer ontop of Ethernet? Well then I don't see how it could be backwards compatiable, unless this behavior could be turned off when it is being used with older equipment.

Re:AES protects entire frame

[Erik Hollensbe]

The negotiation is done in hardware, so if drivers are implemented correctly all the OS sees is another ethernet device with a possible extra set of status information and twiddles.

This is how some hardware SSL accelerators work as well.

Although you are correct in the fact that the encryption standards are not compatible with each other.

Re:AES protects entire frame

[jonabbey]

But I wouldn't want base 802.11 working with my AES-using base station, would I?

That doesnt explain it...

[nmoog]

Cause Slashdot doesn't exactly have a reputation for posting accurate, nonbiased, intelligent pieces.

Re:That doesnt explain it...

[Anonymous Coward]

That's not true of the pieces they post.. I wish I could say the same for some of the comments.

Re:That doesnt explain it...

[Anonymous Coward]

Um.. you're living in a strange world if you think Slashdot's journalistic itegrity approaches that of any respectable media outlet. How many times are we going to see Michael or Taco comment on a story (hint, is this a news site, or an opinion section?). Or what about stories that get duped several times per month? Or when someone like Pudge posts some "cool" thing from Apple just because he is an Apple sealot? Or what about the stories of a "Tactile Digitial Assistant" that doesn't exist posted by a known troll that Slashdot accepted twice and posted as real news?

I'm sorry but you are full of shit.

Re:WHY WONT SLASHDOT POST THIS STORY?

[Anonymous Coward]

6th paragraph:

Add in the cost of retraining users and IT staff, rewriting applications to run on Linux, and the cost of paying separately for programs like application servers, Web servers and directories (which come bundled with Windows)...

HAHAHAHA!

Re:Does this means...

[bloo9298]

The number of bits used by the key is not enough to judge the security of the system. You could have a crap cryptographic algorithm or, more likely, a crap protocol.

Missing a point here...

[z3021017]

People talk about WPA security and how it's important, but the fact is most home users don't even change the default password for their wireless routers.

Re:Missing a point here...

[KillerCow]

People talk about WPA security and how it's important, but the fact is most home users don't even change the default password for their wireless routers.

There is a difference between not having a technology and not using it. The difference is that people who want to use it can if it's available, while no one can if it's not.

Re:Missing a point here...

[burns210]

Most home users don't care if they get the 'source code' to their 'operating system' but some of us appreciate that option. I want the option to affordably secure my data wirelessly.

So I have to upgrade...again?

[Powertrip]

So this means to take advantage of the latest security, I would again have to upgrade all my AP's and Clients... $ $ $ When will this whole industry be commoditized enough that we have 'soft' radios for wireless (Like AC97 Audio) that allow us more flexibility in upgrading older hardware to newer standards? Heck, with a true soft-wireless chipset we could use one RF device for WiFi and Bluetooth and whatever they dream up next...

Re:Does this means...

[brain159]

Sufficient for what?

Keeping a serious attacker away from your data, if it's specifically you he's after? Possibly not.

Keeping a casual war(mode-of-transport)'er out of your WLAN to stop him leeching your bandwidth? Probably.

The real question now is ...

[ProfMoriarty]

Are we for encryption ...

or against it?

Who mods this crap up?

[Anonymous Coward]

Seriously. You don't know what the purpose of encryption is.

The purpose of encryption is to make it so that information cannot be decoded by third parties who may intercept your information. There are years of mathematical proof and basis to prove that properly done encryption to be not capable of being cracked but simply so exceedingly difficult and time consuming that it is considered to be tantamount to being secure.

Link level security is fairly useless.

[pingus]

Link level security is fairly useless. It's fine for the average user, but the average user doesn't know how to turn it on. It would be great if there was some kind of auto-negotiated application layer security. Like IPSeC that has the user transport a USB dongle with the keys or something. This is just frivilous.

Re:Link level security is fairly useless.

[Moskit]

Linksys and Intel are already working on that. They will have an auto-config functionality which should also configure security features:
http://www.linksys.com/press/press.asp?prid=172

Wireless Network Configuration Wizard - simplifies configuring through three simple steps. The application prompts users through the 3-step setup process which simultaneously configures both a wireless router/AP and the Intel Centrino mobile technology notebook computer. The wizard automatically pops up on a notebook computer when the Intel PROSet/Wireless Wi-Fi client software senses a new and unconfigured Linksys wireless router*. There is nothing to install or run – it runs users through the steps automatically.

WPA 2? How about WPA 1 support?

[Anonymous Coward]

There are still so many devices that don't support WPA one.. Tivo, I'm looking at you. All this nonsense about a supplicant this and that. When is Tivo going to get on the WPA 1 train?

To me the chief advantage of WPA is a human readable password.

Serious answer form geeks in the know...?

[aardwolf204]

I just setup a wireless access point in the conference room at my company's headquarters. Not my idea but when the CEO wants to use his centrino notebooks wireless its move or be moved. Anyway, they wanted to leave it open and just turn it on when needed but I talked them out of that. Instead I set it up with 64bit WEP. The AP supports 128 bit but getting them to all key in a huge hex pass isnt going to fly. Havent figured out how to get the passphrase to parse on XP SP1. SP2 looks nicer. Anyway all the wifi equipment is new, within the last year or two, and as netstumbler has shown me we're not the only kids on the block to have wifi with WEP in the building. I've read conflicting reports about how easy it is to crack WEP with tools as simple as those included with knoppix std, so I think what I'm asking is, is 64bit enough, and should I be more paranoid, setting up VPNs and the like?

Were talking about light traffic (email, little browsing) from 5 or 6 users about 8 hours a day.

Re:Serious answer form geeks in the know...?

[John Courtland]

I'd set up at least PPTP VPN's. If not, then IPSec and an IDS. Explain it to them thusly: If you get owned, not only do you have to figure out what the hell happened (before it happens again), but you have to repair and replace a lot of data. I just lost a router and have yet to perform forensics on it to determine exactly WTF went wrong, but it looks like a trademark script kiddie attack, which is dirty and it pretty much wasted that box. And this is just my house where it might take me an hour to get it back up. You're at a company. Get your systems tightened down before that happens to you and your job becomes jeopardized.

Re:Serious answer form geeks in the know...?

[Anonymous Coward]

Unless you like being the scapegoat when someone breaks into your boss's notebook, you should strive for real security. With WPA it is possible to implement reasonable security about as easily as it is to screw up with WEP.

Here is a good article detailing various attacks against WEP. Choice quote: Tim Newsham discovered that there are a number of problems with the key generators for several vendors. [...] This reduced the actual entropy of the PRNG seed to 21 bits. Using a PIII/500 MHz laptop performing 60,000 guesses per second, Newsham was able to crack a 40-bit WEP key from a key generator in 35 seconds.

Re:Serious answer form geeks in the know...?

[Anonymous Coward]

I just lost a router and have yet to perform forensics on it to determine exactly WTF went wrong, but it looks like a trademark script kiddie attack, which is dirty and it pretty much wasted that box.

Wasted that "box"? Thats why you need to use a real router, such as a Cisco. As long as you keep a relatively new firmware on it (as well as keeping up with Cisco advisories), firewall the fuck out of it, and send logs to another device, you will not have any problems there.

Re:Serious answer form geeks in the know...?

[Anonymous Coward]

I'd set up at least PPTP VPN's. If not, then IPSec and an IDS

I have Windows XP on a laptop, and a linksys wireless access point. How do I do that?

Re:Serious answer form geeks in the know...?

[peacefinder]

Is the AP connected to your internal network behind your firewall?

If so, you should lay on the best encryption you have. If you can see other APs on the block, they can see you, too. You don't want someone to come in and rifle through your network, or release a worm or whatever. It is prudent to consider anything connected to the AP as untrusted.
The best solution, in my mind, is to put a firewall between your APs and your internal network, and allow only VPN access to your internal net. A few steps back in paranoia from that is to use the best security your hardware supports.

64-bit WEP is only one step up from an open AP. It'll keep the honest people honest, but will barely cause the dishonest people to break stride.

With a Centrino-based laptop, the boss's machine (almost certainly) has good enough hardware and OS to support WPA. With WinXP, it'll even roam between different netwoks reasonably well when he takes it home or wherever. If your AP doesn't support WPA, then at least use the highest level of WEP available to you... and consider getting a new AP that supports WPA2. (I think the Proxim Orinocos look good, but I haven't got one yet. Their AP-600 sounds about right for your use.)

If you're doing IT for this company, you need to be able to get your users' machines set up right, even the CEO's. Y'all only need to enter that nasty hex password once on each machine; it's not that big a burden and you can do it for him.

If he won't let you do it, tell him that it's your job to protect his company, and in order for the company to be protected this must be done. He can do it or you can, but it must be done.

If he still refuses, I'd either kill the AP (pulling the patch cable from the switch back in the server room should do nicely) or resign. This sounds extreme, but if he's not letting you do your job right, you probably don't want to work there anyway. Besides, he's probably not updating his virus scanner like you told him to, either. :-)

I trust it won't come to that, though. If you lay the issues out for him and tell him that its his company's data (possibly financial data) at stake, I think he'll listen. Good luck!

Re:Serious answer form geeks in the know...?

[Anonymous Coward]

put another (firewall) router behind the wireless point, where your lan lives. routing gets fun...

Re:Serious answer form geeks in the know...?

[aardwolf204]

Right, all that you say sounds good. Problem is most everyone looks at me like I've got my tinfoil hat on too tight and all shrug it off saying "Who would attack us?"... My experience with WiFi includes chalk, pda, and gps :), but it looks like I need to grab a good book on wireless security and start having fun with firewalls.

Re:Serious answer form geeks in the know...?

[peacefinder]

Well, that's the problem, isn't it? :-) Security is always hard for people to take seriously.

One approach is to ask if they would seriously consider leaving the front door of the business unlocked at night. The wireless AP is a doorway to your network that is unlocked, and that no one is watching. (Well, no one but you.)

Okay, it's locked, but with a crappy lock. Think of SSID as a little hook-and-eye gadget, not a real lock. WEP-64 is a little luggage lock; anyone with sidecutters and a strong hand can break it. WEP-128 is more like a decent padlock... but anyone with good boltcutters can get in. What you want is WPA or WPA2, which are more like a real deadbolt in a good metal door. Go get some samples from the hardware store, and pull 'em out of your pocket during your pitch. Ask them which lock they would like protecting their office.

Most importantly, look at the data on your network. Have you got any databases with names and SSNs? This could be a list of inhouse personnel, customers, or whomever. (Every US company has a list of employee SSNs somewhere, and odds are it's on the network.) Those files are a great target for identity thieves, a target with potentially better cash value to the thieves than your office equipment! Identity theft has been in the papers, they'll understand that.

If they come to understand that a little luggage lock is all that stands between their own SSN and identity theft, I expect they'll see the light.

Also, see if you can find a warsurvery site that lists AP's in your town or neighborhood. It'll let you prove that there are people looking for these things nearby. I had the good (?) fortune to actually chat with a wardriver at a 7-11 not half a mile from my network. Reporting that conversation got the partners attention. They already took security seriously, but that really brought it home.

Re:Serious answer form geeks in the know...?

[John Courtland]

Yeah, but this is my house. I don't have the cash nor the care to install a hardware router. If it were a company, you'd better believe the thing would be hardware.

This one hasn't been

[jjp5421]

cracked yet!!! Estimated time to flaw; 30 days!

its about time

[presmike]

you guys can piss and moan all you want but AES is rock solid. This is a great solution for those who don't have time resources or knowledge to use 802.11x with RADIUS. Finanaly a secure encruption scheme for home users who know absolutely nothing about encryption and how it works. I give it 2 thumbs up :)

Re:its about time

[Anonymous Coward]

AES is just a symmetric block cypher. RC4 would have worked just fine if WEP wasn't designed to use static keys and just 2^24 initialization vectors. It's the crypto system that fails, not the cypher.

Re:its about time

[Gollum]

Don't assume that because they are buzzword compliant (AES 256-bit encryption!!!) that they have implemented it correctly.

That was the first mistake which led to all the war-driving originally - early WEP implementations used good algorithms, but chose a weak Initialisation Vector, which made it easier to decrypt the traffic.

Let's hope that they've learned their lesson this time, and aren't just trying to get people on the upgrade cycle again - WEP -> WPA -> WPA2 -> when will it stop?!

Re:its about time

[Just Some Guy]

Substitute a hypothetical Perfectly Unbreakable Cipher (PUC) for AES and I'd still disagree with you.

Suppose that a frame looked like this:

field0: 16 bytes: address
field1: 4 bytes: timestamp
field2: 1024 bytes: message
field3: 32 bytes: checksum

Now, suppose a chipset is specced to implement:

encryptFrame(frame):
return field0 + field1 + PUC_encrypt(field2) + field3

decryptFrame(frame):
return field0 + field1 + PUC_decrypt(field2) + field3

However, their c0d3r is an off-by-one idjit and really implements the codec on field3 instead of field2. Hey, the devices are talking correctly (mean that they're both broken in the same way), so it must work, right? Ship it!

All the crypto in the world won't save you if you screw up the details. From my understanding of WEP, the crypto was OK but the overall algorithm was fundamentally weak. That's what we're hoping that WAP2 fixes.

BTW, if you think my example is contrived or unlikely, then you'd be truly amazed at how badly people manage to mess this stuff up in the real world. Read "Applied Cryptography" sometime to see how hard it is to get all of the details right.

Re:its about time

[Naito]

I don't know about AES being rock solid, but setting up a 802.1x RADIUS server is a pain in the ass. I've still yet to figure it out.

At least this is giving us tools to make it more secure when we want to, instead of making it hard as hell to TRY being secure.

LEAK length?

[Anonymous Coward]

How many bits is the Law Enforcement Access component of the key?

Re:Does this means...

[presmike]

AES if implemented correctly is 10 time better then having an open ethernet port outside your house. For the love of God people, please understand cryptography before making un-informed comments about how weak this will be.

http://home.ecn.ab.ca/~jsavard/crypto/co040801.h tm

"As of 2004, no successful attacks against AES have been recognised" http://en.wikipedia.org/wiki/AES

NSA Encryption Restrictions

[Gumpmaster]

I remember hearing that the NSA restricts the export of high level encryption protocols. Is this still in effect and does this new Wi-Fi encryption push the limits of this restriction?

Re:NSA Encryption Restrictions

[Anonymous Coward]

You must be thinking of the mid 1990's. There are presently no real restrictions on the export of strong crypto, aside from some minor details like not exporting it to known terrorist countries, etc. Besides, the NSA did not ever regulate cryptography; that was the BXA.

In other words, your concern is baseless.

Re:NSA Encryption Restrictions

[Bayleaf]

Besides, AES was created in Europe, I think by the Danish, and is an open standard of encryption. This means that it has undergone a lot of peer reviews and is supposedly a lot stronger because of that process. Still, there is nothing to stop the Danes from restricting it Oops too late - it is already out there.

Re:NSA Encryption Restrictions

[Bayleaf]

Sorry, a quick look at wikipedia http://en.wikipedia.org/wiki/AES tells me that it was developed by a couple of Belgians. Should have looked before I wrote.

PGP?

[CaptainPinko]

didn't you just basically describe PGP? wouldn't that do? in fact why wasn't that the first place they looked? RSA too resource demanding?

WEP security

[rips123]

WEP is a LOT more secure than people imagine these days. Most AP's and clients refuse to use weak IV's making the statistical attack used by Airsnort and other apps effectively useless.

Theres a very small minority of people still using weak 64-bit ASCII key generator algorithms that were found to be only 21-bits of effective keyspace. These can be cracked offline in about 15 seconds with a single encrypted frame but other than that, offline cracking of WEP is still a hard thing to do (from a practical point of view).

Actually...

[TPS Report]

...keep my access point wide open for anyone to use. If you want to look at my GF's reciepe's or our photos, go right ahead.

Yesss.. that sounds like a great idea.

However, if you don't mind, I think I'll skip all the "take a look at my recipies" formalities and go straight to

- sniffing your email passwords,
- reading your email,
- sending email under your account from your IP,
- using your wireless access point to spam,
- surf some underage porn using your IP,
- seed my "next big worm" from your connection,
- browse/sample your internal network from the IP your WAP so conveniently gave me,
- and finish up by making various explicit threats against the president on the newsgroups while simultaneously using your cable connection to make VoIP calls to the NSA and reading them some of your previously mentioned fine recipes.

I almost forgot to say thank you for the free access point. Where are my manners...
;)

Re:Actually...

[Anonymous Coward]

He said he had an open access point, not open internet access. Did you just assume you could authenticate through his proxy server? Kinda like you just assumed his e-mail traffic wasn't using SSL? Open access point only means you get an IP address on the network. It does not imply anything about Internet access or the lack of proper encryption on that network.

WPA vs WPA2 ?

[M1000]

I just got a WRT54g router, and I'm using WPA-PSK / AES.
Of course, one week later, they release WPA2 ;-)

What is the diference between WPA and WPA2 ?

Re:WPA vs WPA2 ?

[jonabbey]

All of the sites I've seen discussing WPA vs. WPA2 make is seem like the big thing in WPA2 is the use of AES.. I would suspect that there is more to it than that, but WPA-PSK/AES is probably pretty close to 802.11i/WPA2. More to the point, I'd expect that any hardware capable of using WPA with AES could be firmware upgraded to full WPA2 if there are any lingering changes.

This is all a WAG, of course.

"basically zero benefit"?

[Anonymous Coward]

Most people would agree that AES is much stronger than RC4. Of course proper use of RC4 would be good enough to keep away the wardrivers, but not a determined PhD with too much time on his hands.

Re:"basically zero benefit"?

[Anonymous Coward]

What does having a PhD have to do with anything? There are WEP crackers avaliable that are practicaly point and click made by teenagers in high school and undergrads in college.

We really need to get away with our obsession with credentialism.

It works great!!!

[Anonymous Coward]

I just got the new encryption set up on my local network at home, and I'm finally back on slashdo23h[oifa fejw093 fawejio;32feaw [NO CARRIER]

VPN

[mrph]

Why not just set up a VPN? For example, OpenVPN is quite easy to configure and maintain, and also
allows for a variety of client systems to connect.

I'm thinking of setting up a small WLAN using old equipment that i can get almost for free.
I would just plug another NIC in my OpenBSD firewall and keep nothing but the necessary ports for the VPN open.
There's a broad range of encryption and authentication methods available, and if the one I use
would be too weak, I could just change to another one instead of having
to buy new hardware such as PCMCIA cards, APs etc.

Is Broadcast allowed with WPA2?

[Anonymous Coward]

Are Broadcast packets allowed with WPA2?

If so, are they just the same packets sent multiple times with different encription to each receiving end-point, or is there a wiser kind of transmission?

WISP do not use encryption, but Corp America?

[Your Average Joe]

I had a buddy that ran his own WISP and he said most all did not use any encryption because of the CPU overhead and the loss of bandwidth. In Corporate America I cannot believe they approve of standard MAC filtering, WEP and SSID broadcast turned off. WEP is so bad I cannot recommend it to anyone for anything.

WPA and a long password are the way to go. 16 characters of mixed case with one number and one special character should be 99.9999 percent effective.

Watch my neighbours

[Zod the Merciless]

I don't want my neighbours to find out about this. I have my access point wide open so I can watch all the exceedingly weird things they browse. And I am biding my time for enough users so that I can inject a bit of goatse.cx in there. ARRRRRRGGGHHHHH MY EYES!!!!!!!!!!!!!!!

The really important question.

[DrXym]

Will hardware and software makers actually make it easy to use the crypto?

If you use WEP at the moment, some operating systems will prompt you to enter the key. Not the passphrase, but the digested key. So even though I know the passphrase, I must type 26 characters of hexidecimal into my iPaq with a stylus. Linux is no better for wireless and the last time I looked required hex too. Linux is particularly lousy if you use more than one WLAN since all the dists I've tried only store the details for one of them.

It is absolutely ludicrous. XP doesn't do that and I doubt (though I haven't tried) that OS X would either.

Given that, it would not surprise me that of those who even know to enable crypto if half don't just give up or use MAC filters or no security at all.

My preference would be whatever standard they choose be mandated to use crypto by default - and by virtue of the even longer key length it will force software makers to improve their support for it.

Re:The really important question.

[Anonymous Coward]

RTFM.

I use passphrase keys all the time in Linux using iwconfig. Just becuase you don't know how to read the manual does not give you license to trash Linux for your own inabilities.

Re:The really important question.

[DrXym]

Thanks for sharing your elitist prick attitude with the rest of us.

Re:The really important question.

[Anonymous Coward]

OSX makes you type in the hex password for WEP as well. Thanks for playing though. Worse yet, it won't even let you paste the password in.

The only reason i like WPA is for the easy to type password!

Re:The really important question.

[jeremyhu]

Even if he is a prick about it, it's still partially true. Linux's pcmcia-cs has good tools for setting up multiple wireless profiles with your pcmcia devices (just look at /etc/pcmcia/wireless). And it's easy to use the passphrase on linux... just instead of entering the hex, you enter 's:' or maybe it's 'p:'... I forget off the top of my head.

Cracking WPA2

[Anonymous Coward]

Cracking WPA2 is really all dependent upon three things: How much time you have, and how much CPU you can throw at the problem, and how sophisticated is your statistical analysis?

The goal of any security is to secure something long enough that by the time it is cracked/stolen, it is no longer of any value.

For data, his time can be reduced by half by doubling the CPU horsepower applied to the problem.

The simple statistical analyses available in airsnort or other COTW (common, off the web) softs are probably a bit lightweight for this, but a full blown data mining database (e.g. Oracle 10g) running on a cluster can handle this. It's what they do: statistical analyses on huge datasets of seemingly unrelated data.

FWIW - One of Oracle Corporation's largest customers is the NSA.

Re:Does this means...

[brain159]

Correctly implemented AES is not what he's got in a stock 64-bit-WEP access point (where "he" is the person whose comment I was replying to - that comment is now at -1 Troll for some unknown reason).

We already know that old-style standard WEP can be defeated. Grandparent wasn't discussing this new arrangement in his post - hence, neither was I.

No, YOU are wrong.

[xtal]

Obviously you don't know what YOU are talking about. Just because you have a buunch of scripts that is capable of cracking WEP does not mean you have a knowledge of why WEP is vunerable. WEP cannot be made totally secure (the claim was not made by me or the grandparent), however, many vendors have highly reduced the vulnerability of WEP

You are incorrect. One hole has been plugged; others appeared, some are still theoretical, and not all are widespread.

If you care, run a VPN and then it doesn't matter.