Slashdot Mirror
Feds Hack Wireless Network in 3 Minutes
xs3 writes At a recent ISSA (Information Systems Security Association) meeting in Los Angeles, a team of FBI agents demonstrated current WEP-cracking techniques and broke a 128 bit WEP key in about three minutes. Special Agent Geoff Bickers ran the Powerpoint presentation and explained the attack, while the other agents (who did not want to be named or photographed) did the dirty work of sniffing wireless traffic and breaking the WEP keys. This article will be a general overview of the procedures used by the FBI team.."
WEP was almost a weak afterthought for wireless technology. This is just a demonstration of why WEP users should switch to WPA.
Do we really thing the FBI is so ignorant that they aren't aware of WEP and WPA cracking utilities?
As long as people continue to use dictionary based passwords, it doesn't really matter how good the encryption is.
People just need to realize that nothing is infalliable, maybe when this is mentioned on Fox News or CNN the general public will learn that they shouldn't trust their network for sensitive data. I know I don't.
This doesn't show that WEP is insecure... simply that the key-generation schemes favored by many manufacturers are insecure. Netscape 2.2 was vulnerable to the same type of weakness by using 22 bits of information to build it's 40 bit session key for SSL.
BTW, assuming a similar key generation scheme, this technique could break AES or 3DES, the encryption algorithm is irrelevant here. Why is it that vendors of security products can't figure out security?
Confidence and respect should not get in the way of pragmatism. To a great degree, the FBI's interests and one's own align. To a lesser degree, they are divergent. This is particularly true in the realm of privacy, where it is in the FBI's interest to violate it, and your own interest to protect it. In cases where interests do not coincide, it is completely rational to not be at least wary.
A deep unwavering belief is a sure sign you're missing something...
So, just about any law you can break with a computer is now fair game. When you go to court just refer to the three minutes it could have taken some nefarious hacker to use your network without your knowledge. Since the likelihood of such an attack is low then I recommend everyone use a dictionary entry to generate keys. It will keep your neighbours off your network and you'll leave yourself with a perfect reasonable doubt defence when sued or prosecuted.
It's not too difficult to change a MAC address anyway. I'd think it would be trivial, especially for the FBI, to modify the MAC address between attempts.
Now what would be really spiffy would be generating MAC-specific keys, so that (combined with blocking after X attempts) no progress could be with a dictionary attack...
I think I see your point. Individual FBI agents are probably very highly skilled.
The problem is that, as an agency, it is their collective duty to enforce bad policies. Increasingly, they are defeating their own purpose and becoming a threat to the very freedoms they supposedly protect. The war on drugs and PATRIOT spring to mind.
"They're only doing their job" is never an argument: unethical practice is not magically justified or even mitigated by being paid for it. If anything I'd say the opposite is in fact true.
And in that regard, the fact that their agents are such able individuals is really just sad: think of what they might accomplish if only they were not busy hatching plans to penetrate my tinfoil hat?
IMHO, no offense.
Gosh, thanks. That must be why the other ships call me Meatfucker -- GCU Grey Area (Eccentric)
Random password generator? On a website? And it's not logging my IP and the password it has generated for me? I would have to be paid to believe this
Seriously, how secure is that?
Then I felt dismayed.
It really is a shame when the prevailing "geek" attitude towards agencies like the FBI is mistrust and fear, not confidence and respect.
I find it refreshing.
The founders of our government were quite aware that the greatest threat to freedom was the very government intended to secure and maintain it. That governments are run by people, that people are fallible, and that the power of government tempts them to sieze still more power- to simplify their jobs, to enhance thier own lives, or just for the fun of it.
They knew that some people and some institutions would be corrupted, did their best to put roadblocks in the way of corruption to slow the process down, and to warn their successors (us) to be on watch, so we could catch the inevatable slippages and correct them.
An attitude of healthy suspicion combined with grudging respect and occasional heartfelt praise is precicely right, when it comes to agencies such as the FBI. Healthy suspicion because agents - singly, in groups, or institutionally - have gotten out-of-hand repeatedly. Grudging respect (which must be earned but is honest when it is), because the government and its agencies houseclean from time to time, the agency mostly stays on track, and many of its agents are honest, hard-working, and often heroic, doing their best to identify, protect us from, and bring to justice some truly evil people. Occasional heartfelt praise - when they earn it (which they often do), spending their sweat, smarts, and blood to make the rest of us safer.
The reason I find "the 'geek' attitude" refreshing is that it show that a new generation - no, a large social group that crosses several generations - have "gotten it". Like most powerful tools, law-enforcement and investigative agencies can do significant when used properly, and even greater harm when misused or broken. Eternal vigilance is needed to keep them in good repair and on the right job. Now we have yet another generation that understands the need for this vigilance and is standing guard.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Note that even if WEP is trivial to crack it serves a purpose: The same purpose as a lock on a screen door or window.
It doesn't keep out a burglar.
It DOES make it clear that your INTENT was to keep him out, and that if he breaks in his INTENT was to break in.
This is a very important legal point if/when you, or law enforcement, bring action against him.
Similarly, the computing community has generally interpreted permission settings (on files and the like) as an expression of intent, generally honoring them even if they have the ability to bypass them.
This transfers directly to wireless access points: Some people deliberately leave their APs open, to let others use them as a community resource. Generally this is done by leaving them at the default settings. While there may be confusion about it if an AP is in this state, there is NO confusion about the intent if WEP is enabled.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Others are mentioning COINTELPRO, or Hoover's reign of terror, or Waco, and on and on. No need for me to cover that territory, which any well-informed citizen knows. There's always Wikipedia if you need to bone up on the cheap.
No, I wish to call attention to your language. Therein lies your problem: your language shortcuts thought. Do you realize you write less like a citizen than a subject?
Agencies like the FBI, you write.
Government agencies, law enforcement agencies, you mean. Please stop and think about that.
"Agencies like the FBI"--which would include, of course, the CIA, the NSA, the DEA, the BATF, for starters--are nothing more than arms of power. It is that power to which we must turn, thoughtfully, and ask our questions. We cannot say de facto that an enforcement agency is worthy of "confidence and respect," as you would have it, unless we first examine whose laws and whose agenda these agencies are enforcing.
To take but one high-profile example: the war on drugs. This irrational prohibition has stocked our prisons with the poor, but failed demonstrably by creating more crime in illegal drugs; yet it is blindly enforced by those before whom you would have us genuflect. What choice have they, after all? Yet, fortunately, we have a choice: we can think, they cannot. We can withhold automatic "confidence and respect," as we should, since a brutal and destructive prohibition depends on patsies and collaborators.
The founders of our nation viewed overweening power with deep suspicion, and they anticipated the glamor of irrational obedience--the impulses of mob-like majorities, of good little yes-men. Examine their writings, and behold their constitutional framework: it is in sum a work of almost beautiful paranoia, conceived by men who looked on history as realists. They designed the nation to survive not terrorists or criminals but the surrender of thought by its own inhabitants.
I always ask people to turn their WEP keys off anyways.. nothing like creating scarcity out of the plenty of wi-fi networks out there.
Look, your computer ought to be secure at the TCP/IP level. If you're depending on WEP link security, you're probably hosed anyways. And you'll almost surely be hacked by the teeming swarms of infected computers on the net long before you get trouble from a neighbor, a drive-by script kiddie, or now the FBI. Unless you're a paranoid freak and you're sure they're really out to get you. The roving script-kiddies that is.
Worried about bandwidth? If you and your neighbors cooperated instead of hording bandwidth from each other, you'd have more to go around. Heck, you could multi-home your laptop and get multiplexed bandwidth. That's more, not less.
Now turn off those keys and rename your home wi-fi network "public"!