Slashdot Mirror
Feds Hack Wireless Network in 3 Minutes
xs3 writes At a recent ISSA (Information Systems Security Association) meeting in Los Angeles, a team of FBI agents demonstrated current WEP-cracking techniques and broke a 128 bit WEP key in about three minutes. Special Agent Geoff Bickers ran the Powerpoint presentation and explained the attack, while the other agents (who did not want to be named or photographed) did the dirty work of sniffing wireless traffic and breaking the WEP keys. This article will be a general overview of the procedures used by the FBI team.."
Note to self: change WEP key to something other than "DEADBEEFDEADBEEFDEADBEEFDE".
WEP was almost a weak afterthought for wireless technology. This is just a demonstration of why WEP users should switch to WPA.
Do we really thing the FBI is so ignorant that they aren't aware of WEP and WPA cracking utilities?
Was the password public?
I bet it was public:public
Silly FBI
Damn those feds are good.
It takes me longer than 3 minutes just to type the WEP key from my router into my client!
I only came here to do two things; kick some ass, and drink some beer...looks like we're almost out of beer.
I live in the middle of nowhere. I think I may notice two men sitting with a laptop in an ominous black car with government plates, as the only place they could be close enough is my driveway.
Still, it may be time to look at running an IPSEC tunnel over the wireless network.
When I first read the closing line of the article, I chuckled.
Then I felt dismayed.
It really is a shame when the prevailing "geek" attitude towards agencies like the FBI is mistrust and fear, not confidence and respect.
Obliteracy: Words with explosions
As long as people continue to use dictionary based passwords, it doesn't really matter how good the encryption is.
None of the agents could be reached for comment, as they were all busy arresting eachother citing the Patriot Act and the DMCA.
-Peter
People just need to realize that nothing is infalliable, maybe when this is mentioned on Fox News or CNN the general public will learn that they shouldn't trust their network for sensitive data. I know I don't.
Assembled, for your pleasure:
-------
Title: The Feds can own your WLAN too
Introduction
Millions of wireless access points are spread across the US and the world. About 70% percent of these access points are unprotected--wide open to access by anyone who happens to drive by. The other 30% are protected by WEP (Wired Equivalent Privacy) and a small handful are protected by the new WPA (Wi-Fi Protected Access) standard.
At a recent ISSA (Information Systems Security Association) meeting in Los Angeles, a team of FBI agents demonstrated current WEP-cracking techniques and broke a 128 bit WEP key in about three minutes. Special Agent Geoff Bickers ran the Powerpoint presentation and explained the attack, while the other agents (who did not want to be named or photographed) did the dirty work of sniffing wireless traffic and breaking the WEP keys.
This article will be a general overview of the procedures used by the FBI team. A future article will give step-by-step instructions on how to replicate the attack.
WEP Cracking - The Next Generation
WEP is an encryption scheme, based on the RC-4 cipher, that is available on all 802.11a, b and g wireless products. WEP uses a set of bits called a key to scramble information in the data frames as it leaves the access point or client adapter and the scrambled message is then decrypted by the receiver.
Both sides must have the same WEP key, which is usually a total of 64 or 128 bits long. A semi-random 24 bit number called an Initialization Vector (IV), is part of the key, so a 64 bit WEP key actually contains only 40 bits of "strong" encryption while a 128 bit key has 104. The IV is placed in encrypted frame's header, and is transmitted in plain text.
Traditionally, cracking WEP keys has been a slow and boring process. An attacker would have to capture hundreds of thousands or millions of packets--a process that could take hours or even days, depending on the volume of traffic passing over the wireless network. After enough packets were captured, a WEP cracking program such as Aircrack would be used to find the WEP key.
Fast-forward to last summer, when the first of the latest generation of WEP cracking tools appeared. This current generation uses a combination of statistical techniques focused on unique IVs captured and brute-force dictionary attacks to break 128 bit WEP keys in minutes instead of hours. As Special Agent Bickers noted, "It doesn't matter if you use 128 bit WEP keys, you are vulnerable!"
On with the Show
Before we get into the steps that the FBI used to break WEP, it should be noted there are numerous ways of hacking into a wireless network. The FBI team used publicly available tools and emphasized that they are demonstrating an attack that many other people are capable of performing. On the other hand, breaking the WEP key may not necessarily give an attacker complete access to a wireless network. There could also be other protection mechanisms such as VPNs or proxy servers to deal with.
For the demonstration, Special Agent Bickers brought in a NETGEAR wireless access point and assigned it a SSID of NETGEARWEP. He encrypted the access point with a 128 bit key--made by just keying in random letters and numbers.
Note that normally, you have to find wireless networks before you can crack them. The two wireless scanning tools of choice are Netstumbler for Windows or Kismet for Linux. Since the other WEP cracking tools are mainly Linux-based, most people find it easier to stick with Kismet, so they don't have to switch between Windows and Linux.
Another FBI agent started Kismet and immediately found the NETGEARWEP access point. Just for fun, a third agent used his laptop and ran FakeAP, a program that confuses scanning programs by putting up fake access points.
Attack!
After a target WLAN is found, the next step is to start capturing packets and convert th
I am surprised that wireless A/P dont block a MAC address after X number of attempts
WEP is like gun laws in the US. They only keep the honest people from having guns. What a great society we live in.
Only 'flamers' flame!
Does slashdot hate my posts?
They didn't do a dictionary attack. What they did was use aircrack that uses a statistical method to crack the key. You need lots and lots of packets and they got those using void/deauth and a replay attack. It's all in the article.
Also, you also only need one packet to brute force a key.
So now when the feds are parked out in front of your house waiting for you to leave your apartment, they can leech off your neighbours wifi...
If you're going to cut-and-paste for karma, please CITE YOUR REFERENCES!
w w.tomsnetworking.com/Sections-print-article111.php +%22definite+improvement+over+WEP+in+providing+wir eless+security%22&hl=en&client=firefox-a
The page you snipped this from is cached here:
http://66.102.7.104/search?q=cache:ChC8gBE_LsEJ:w
This doesn't show that WEP is insecure... simply that the key-generation schemes favored by many manufacturers are insecure. Netscape 2.2 was vulnerable to the same type of weakness by using 22 bits of information to build it's 40 bit session key for SSL.
BTW, assuming a similar key generation scheme, this technique could break AES or 3DES, the encryption algorithm is irrelevant here. Why is it that vendors of security products can't figure out security?
I only managed to get to the third page of the useless article (seriously people, put more than 2 paragraphs on a page!)
But so far I have "He encrypted the access point with a 128 bit key--made by just keying in random letters and numbers." which makes me wonder if they actually used a dictionary attack...
Finally loaded the 4th page. Apparently they knocked an authorized user off the AP repeatedly and collected the resulting flood of reauthentication packets, plus used packet replay attacks to get the AP to respond to replayed ARP requests (apparently they are easy to spot in a pcap dump despite encryption). This gave them all the IVs they needed to crack the key.
If I have been able to see further than others, it is because I bought a pair of binoculars.
i read to fast, at first i read "fed wireless network hacked in 3 minutes" ...
"old news" i thought..
What is surprising is that such a l33t cr3w used powerpoint for their presentation :/
On top of WEP encryption, you should also try to filter access to your wireless network using MAC addresses. I do not think a hacker would be able to easily get around that...
;) MAC filtering will only stop the very casual person from gaining access to your network.
OK, just in case you seriously don't know, MAC addresses are not encrypted, so it is dead simple to sniff traffic to find valid MAC addresses and then change the MAC address of the hacking box to the valid MAC address (usually during a time when that machine is not actually connected). I've heard that this is a good way to gain access at pay to play locations like Starbucks
Also keep in mind that MAC filtering only prevents someone from joining the network, you can still sniff at will at the packets.
Interesting post, too bad I used up my mod points earlier today.
Question: what is a suitable length for a random passkey? I always use random strings for stuff like this, but wonder how long they should be.
If God had meant for man to see the sunrise, He would have scheduled it later in the day.
Glad I didn't go through the effort of locking mine down. Who has the last laugh now, Mr. "You gotta lock that thing down"?
Adventure City Tours
1) Install a OpenBSD after plugging in a wireless card that can be used in hostap mode.
2) Install OpenVPN (that has a nice Windows client), and generate server and client certificates. There are howto and scripts for this.
3) Configure the built-in OpenBSD packet filter to only accept connections to/from OpenVPN ports on the wireless NIC.
4) Show war drivers the finger.
So, just about any law you can break with a computer is now fair game. When you go to court just refer to the three minutes it could have taken some nefarious hacker to use your network without your knowledge. Since the likelihood of such an attack is low then I recommend everyone use a dictionary entry to generate keys. It will keep your neighbours off your network and you'll leave yourself with a perfect reasonable doubt defence when sued or prosecuted.
Nah, they have the manufacturers build in a backdoor! Didn't you watch 24 last night? All they needed was the manufacturer ID and they got root access!
Maybe 10% of the population are aware of WEP's weaknesses, but would the other 90% understand what/where/how to conifugre WPA on an AP or gateway? I'm not quite sure that Joe home user should be so worried about his WEP key. Most home users don't have any security policy or strategy (ie. millions of exploited Windows machines sitting directly on the internet), and most businesses have a poor network security policy. As a consultant for a large networking manufacturer, I am amazed at the lengths corporations will go to in securing their wireless network, meanwhile you can walk into unsecured parts of the building and just plug in (no 802.1x), or they have a substandard VPN or internet gateway solution. Maybe it would make more sense for our government to do seminars on security practices for computing(including wireless networking) versus demonstrating a 4 year+ old IV weakness vulnerability?
I was throwing you the 48, but you made me switch to the 132.
DECAFC0FFEEBADBADBADBADBAD
How dare they! The feds have no right to break into someone's wireless network, no matter how simple the password! I want to see the FBI taken down for this! <continues ranting about "the feds">...
I'm sure we'll hear many comments along those lines from Slashdotters who are no doubt using a wireless connection that they've broken into...
This is why I always get a little nervous seeing wireless routers stuck to the ceilings of some offices. Given the average security of most offices with wired networks, the outlook for un-wired networks isn't good, IMO.
Pulling cable is a PITA, but it is a layer of physical security that shouldn't be dismissed too soon.
-- Microsoft is the most expensive commodity operating system and office suite vendor in the marketplace.
Or you could use someone's handy-dandy Random Password Generator and come up with something you'll actually remember.
</shameless plug>
You have two hands and one brain, so always code twice as much as you think!
Establishing plausible deniability for an upcoming information leak scandal.
Bull. They just walked around looking under keyboards.
If you aren't part of the solution, there is good money to be made prolonging the problem
6) Tinfoil. And LOTS of it.
Random password generator? On a website? And it's not logging my IP and the password it has generated for me? I would have to be paid to believe this
Seriously, how secure is that?
is one of the 600,426,974,379,824,381,952 ways to spell \/14grA
dictionary-attack that, G-man!
Sorry about replying to myself, but here's a better link for explaining how this attack works.
'SBEMAIL!' is better than a goat!!
So, since nobody has mentioned it, I'll actually break my normal ./ silence and point this out.
The attacks they're using were developed by KoreK and released last summer. Then Christophe Devine re-implemented the attacks in Aircrack.
The FBI had nothing to do with development of this, they're just advertising that they're script kiddies. On top of that, the methods they used to for packet generation so they had something to capture were freaking LAME. Anybody with any form of wireless IDS would see this a mile away (oh yeah, they couldn't even write their own deauth tool...they had to be skript kiddies again and use void11...).
I wasn't AT the talk, any maybe the Tom's Networking guy didn't properly convey the message, but I feel that credit should go to the folks who deserve it, not script kiddies who got some face time at a conference.
-d
Seriously, when each packet is encrypted with a different key, it seems like this would become a lot more difficult.
A lot of APs and hubs are coming with it now.
Then I felt dismayed.
It really is a shame when the prevailing "geek" attitude towards agencies like the FBI is mistrust and fear, not confidence and respect.
I find it refreshing.
The founders of our government were quite aware that the greatest threat to freedom was the very government intended to secure and maintain it. That governments are run by people, that people are fallible, and that the power of government tempts them to sieze still more power- to simplify their jobs, to enhance thier own lives, or just for the fun of it.
They knew that some people and some institutions would be corrupted, did their best to put roadblocks in the way of corruption to slow the process down, and to warn their successors (us) to be on watch, so we could catch the inevatable slippages and correct them.
An attitude of healthy suspicion combined with grudging respect and occasional heartfelt praise is precicely right, when it comes to agencies such as the FBI. Healthy suspicion because agents - singly, in groups, or institutionally - have gotten out-of-hand repeatedly. Grudging respect (which must be earned but is honest when it is), because the government and its agencies houseclean from time to time, the agency mostly stays on track, and many of its agents are honest, hard-working, and often heroic, doing their best to identify, protect us from, and bring to justice some truly evil people. Occasional heartfelt praise - when they earn it (which they often do), spending their sweat, smarts, and blood to make the rest of us safer.
The reason I find "the 'geek' attitude" refreshing is that it show that a new generation - no, a large social group that crosses several generations - have "gotten it". Like most powerful tools, law-enforcement and investigative agencies can do significant when used properly, and even greater harm when misused or broken. Eternal vigilance is needed to keep them in good repair and on the right job. Now we have yet another generation that understands the need for this vigilance and is standing guard.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
The other is the PowerPoint guru :-P
WTF am I doing replying to an AC at 5 A.M on a Friday night?
I always click on the printer-friendly format. That usually gives you the article and pictures on one continuous page.
So what this is telling us is the Feds are really just script kiddies?
No.
What this tells us is that the Feds are showing people just how TRIVIAL and FAST it is for script kiddies and crooks to break into WLANs. And give you pointers on keeping the petty crooks out (and drastically cut crime and reduce the load on the FBI).
Surely you didn't expect them to give you a demo of how THEY do it and how to keep THEM out, did you? B-)
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
128 bits. Roll one 8-sided die 51 times (discarding the least-significant bit of the last roll).
.50c. I'm fairly certain you could find cheaper prices. I estimate the total cost of this hardware randomizer at $20 if done on the cheap.
To speed up the process, get one of those
clear boxes they use to make sure people take the right number of pills per day. Get one with more than 22 boxes. (4 times a day for a week = 28, fairly common)
Put dice in boxes. Put a sheet of something solid on the door side. Shake. Invert. voila, random byte strings. w/ 28 boxes you have 84 random bits. Repeat twice for your 152 bit key, dropping the last 16 bits.
chessex.com has a variety of dice - you can can order single d8s for
Someone will probably complain about the non-cryptographic quality randomness of this process. But you only need cryptographic quality randomness when you're going to use it very repeatedly and someone can attack the similarity between them. Since the nonrandomness isn't known to anyone outside and you probably aren't generating a massive number of keys you're fairly safe. To increase security, buy dice from multiple manufacturers and occasionally switch around the lots.
(every 4 d8 values converts to 3 hex values. If you're converting by hand, you could alternately use a pair of dice for a hex value, generating only 56 bits per shake but only needing a table of 16 values to convert by hand to hex. You could also use 4 sided dice for this equally well, since you're only using 4 bits per pair.)
Looking for freelance Actionscript (Flash/Flex) or ColdFusion work and/or freelance developers. Email me, put Slashdot
I'm the author of the article.
1. Where in the article does it say the FBI developed the attacks? Did you RTFA?
2. For the IDS comment, I did state that it is NOT a stealthy attack. Not stealthy = IDS will pick it up.
3. You weren't at the talk, and it shows. They did give credit (a LOT of credit) to KoreK and Devine, but I didn't put it in the article. So you can blame me for it.
t2h4e1r0e4a1r0e5XXXXXXXXXXi7d1e6s1t1o9e0v5e9r1y5s7 t6o0r9y5y6o1u
did you leave out some x's?? i get that it should be
txhxrxexexsx
which is 2 characters too long for your string (assuming the phrase "there are three sides to every story - yours, theirs and the truth")...
or maybe it's
mxaxnxyxsx
damn i need to find something better to do with my time...
Sure, you could md5 some random string... if you didn't want to remember it.
Or you could use someone's handy-dandy Random Password Generator and come up with something you'll actually remember.
When it comes to passwords that tend to be set and forget for a while or only entered once for the lifetime of any given password, I would prefer to take advantage of the full key space.
For passwords that require daily entering by myself, I prefer 9-11 character random alphanumerics. At the moment I'm using about 5 different ones like this and remember them all.
I guess it depends on what you're protecting and how paranoid you are.
*Homer looks outside and sees a van*
Flowers
By
Irene
If the "$5 lamp timer" idea to shut down the router during off-hours doesn't work for you (eg. you need wired connections to stay up), a script to enable/disable the wl_net_mode setting on the http://192.168.1.xxx/Wireless_Basic.asp page of a Linksys WRT54GS would seem pretty doable. Put an enable/disable entry into a cron schedule and you've closed the window for hackers somewhat.
Cooking a script up like this (with POST and HTTP Basic Authentication for login) wouldn't be very hard, but does anyone know of Linksys scripts that might already be usable?
Note that even if WEP is trivial to crack it serves a purpose: The same purpose as a lock on a screen door or window.
It doesn't keep out a burglar.
It DOES make it clear that your INTENT was to keep him out, and that if he breaks in his INTENT was to break in.
This is a very important legal point if/when you, or law enforcement, bring action against him.
Similarly, the computing community has generally interpreted permission settings (on files and the like) as an expression of intent, generally honoring them even if they have the ability to bypass them.
This transfers directly to wireless access points: Some people deliberately leave their APs open, to let others use them as a community resource. Generally this is done by leaving them at the default settings. While there may be confusion about it if an AP is in this state, there is NO confusion about the intent if WEP is enabled.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
On my Netgear wireless router, I have the ability to enable MAC address filtering. If the wireless connection isn't coming from my MAC address, then the attacker can't use my router. Right? I live in an apartment complex and I had just set up my router. Within a week, I noticed someone sharing my router for some goatse action. I enabled my MAC filtering but not WEP and I haven't seen Mr goatse again. Could he come back though somehow? Also, if I don't enable WEP, an attacker could monitor my web usage without necessarily using my internet connection? Thanks for any answers.
Don't trust me? Download the source and run it yourself. Or use the Javascript. Or ride the camel.
You have two hands and one brain, so always code twice as much as you think!
Here at work (an R&D facility for a major electronics company) we have opened up our WLAN for anyone to use and dropped WEP completely. Instead we use VPN's. This enables the following:
1. Any customer/vendor can get easy net access
2. Anyone in our local area can get free Internet access and feel good about our company. The range isn't that far, but for geeks in a pinch, it's there for them.
We don't advertise this feature but it is definitely done for these reasons.
I strongly recommend other companies to just dump WEP or any other authentication system and open up their access points.
I'm suprised you're not using shielded VGA cables to prevent direct snooping of your screen, Steven.
Linux: Free if your time is worthless.
A locksmith was able to pick a locked front door in a residential neiborhood in just under 3 minutes.
However, the FBI has superior entry method that involves breaking the door down in just under 8 seconds.
Others are mentioning COINTELPRO, or Hoover's reign of terror, or Waco, and on and on. No need for me to cover that territory, which any well-informed citizen knows. There's always Wikipedia if you need to bone up on the cheap.
No, I wish to call attention to your language. Therein lies your problem: your language shortcuts thought. Do you realize you write less like a citizen than a subject?
Agencies like the FBI, you write.
Government agencies, law enforcement agencies, you mean. Please stop and think about that.
"Agencies like the FBI"--which would include, of course, the CIA, the NSA, the DEA, the BATF, for starters--are nothing more than arms of power. It is that power to which we must turn, thoughtfully, and ask our questions. We cannot say de facto that an enforcement agency is worthy of "confidence and respect," as you would have it, unless we first examine whose laws and whose agenda these agencies are enforcing.
To take but one high-profile example: the war on drugs. This irrational prohibition has stocked our prisons with the poor, but failed demonstrably by creating more crime in illegal drugs; yet it is blindly enforced by those before whom you would have us genuflect. What choice have they, after all? Yet, fortunately, we have a choice: we can think, they cannot. We can withhold automatic "confidence and respect," as we should, since a brutal and destructive prohibition depends on patsies and collaborators.
The founders of our nation viewed overweening power with deep suspicion, and they anticipated the glamor of irrational obedience--the impulses of mob-like majorities, of good little yes-men. Examine their writings, and behold their constitutional framework: it is in sum a work of almost beautiful paranoia, conceived by men who looked on history as realists. They designed the nation to survive not terrorists or criminals but the surrender of thought by its own inhabitants.
I always ask people to turn their WEP keys off anyways.. nothing like creating scarcity out of the plenty of wi-fi networks out there.
Look, your computer ought to be secure at the TCP/IP level. If you're depending on WEP link security, you're probably hosed anyways. And you'll almost surely be hacked by the teeming swarms of infected computers on the net long before you get trouble from a neighbor, a drive-by script kiddie, or now the FBI. Unless you're a paranoid freak and you're sure they're really out to get you. The roving script-kiddies that is.
Worried about bandwidth? If you and your neighbors cooperated instead of hording bandwidth from each other, you'd have more to go around. Heck, you could multi-home your laptop and get multiplexed bandwidth. That's more, not less.
Now turn off those keys and rename your home wi-fi network "public"!
Maybe in this case, where you can download the source etc, his suspicion was unnecessary, but the reason why people ever get in security problems is exactly by _not_ thinking like him. Especially in this case: I would NEVER let my password leak out in such a foolish way as letting it be generated by an (unchecked) on-line source. Best way to let someone else know your password before you even do.
Flip a penny 128 times. Does the same thing, and nobody will think you're a D&D player.
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
WEP & WPA are mostly just encryption layers (maybe some authentication as well). After the encryption is cracked then you can watch all the traffic being transmitted to and from the access point. Wireless cards are still network cards, so they still use MAC addresses to determine which card responds to which packets. If the MAC address wasn't transmitted then the access point couldn't block people by it. AFAIK, the MAC address is encrypted with the rest of the packet, but the process of cracking WEP encryption is passive, so someone could just crack it and packet sniff to find out the MAC addresses that are allowed.
If that's true (which I am uncertain), then this is the ultimate example of "turnabout is fair play." As everyone knows COINTELPRO then set its sights on Martin Luther King, the Black Panthers, and American leftist and civil rights advocacy organizations. Apparently they even covertly funneled aid to the Klan and other similar groups later on under the condition that they limit their activities to COINTELPRO targets.
Either way, it was an ugly business, and a part of American history that everyone would do well to remember, especially as America begins its slide into fascism post-September 11th.
Qu'on me donne six lignes écrites de la main du plus honnête homme, j'y trouverai de quoi le faire pendre.