WEP Broken Even Worse

collin.m writes in with news of results out of Darmstadt. Erik Tews and others there have demonstrated how to recover a 104-bit WEP key in under a minute, requiring the capture of fewer than 10% the number of packets the previous best method called for. The paper is here (PDF). Quoting: "We were able to extend Klein's attack and optimize it for usage against WEP. Using our version, it is possible to recover a 104 bit WEP key with probability 50% using just 40,000 captured packets... for 85,000 data packets [the success probability is] about 95%... 40,000 packets can be captured in less than one minute under good condition. The actual computation takes about 3 seconds and 3 MB main memory on a Pentium-M 1.7 GHz..."

Comments

Can ARC4 be used properly at all?

[Myria]

Can ARC4 be used securely at all? Or are WEP's failings its own fault?

On a somewhat related note, I'm annoyed that wireless encryption was implemented in hardware. Nintendo DS's wireless is worthless to me since the encryption system can't be upgraded.

Re:Can ARC4 be used properly at all?

[Lehk228]

disable wireless security and implement real security, such as a RADIUS login. then set up a firewall rule to allow unauthenticated devices to access nintendo's servers

Re:Can ARC4 be used properly at all?

[e_tews]

It is a little bit WEPs fault. I think RC4 can still securely be used. For examle in TKIP or in SSL/TLS the RC4 key generation differs from the algorithm WEP uses, and can still be seen as secure.

Re:Can ARC4 be used properly at all?

[drinkypoo]

disable wireless security and implement real security, such as a RADIUS login. then set up a firewall rule to allow unauthenticated devices to access nintendo's servers

Login authentication does not prevent a man in the middle attack of the breakin sort.

You need end to end encryption, including encrypted login and certificate verification with secure exchange made pre-connection to provide security over a wireless link.

Just another reason why if it's not a PDA or a tablet, you should be using a wire. You can get 100' or more of CAT5E for the price of a 802.11G access point, and an 8 port 10/100 FDX switch with port autonegotiation (auto-crossover, too) is about $20. Good jacks will run you $5 per end. Patch cables are a buck and longer cables are just a few bucks.

Re:Can ARC4 be used properly at all?

[stinerman]

The problems with WEP have nothing to do with RC4. The problem is that the initialization vectors end up being reused because they are only 24 bits. Reusing IVs is a major no-no when dealing with a stream cipher. And to compound that, the implementation allows for a 50% chance to use the same IV after only 5000 packets. (see wikipedia)

RC4 is still just as secure as it was before these WEP attacks.

Re:Can ARC4 be used properly at all?

[qbwiz]

Dragging 300' of cable throughout and around your house to use your laptop anywhere you want: priceless.

Re:Can ARC4 be used properly at all?

[zippthorne]

It's not the wire that's expensive, it's the holes. In fact, those aren't even the expensive bit. It's the properly out-of-the way and invisible that's expensive.

Re:Can ARC4 be used properly at all?

[Belial6]

I agree with you. That is why I really annoys me that in this day and age, builders are still not putting conduit in walls during construction. I understand a 20 year old house not having conduit in the walls. I can even understand a 10 year old house not having conduit, but any house built in the last 5 years should have conduit to every room. We already know that whatever is in the walls today will be inadequate in another 10 years.

Re:Can ARC4 be used properly at all?

[drinkypoo]

It's not the wire that's expensive, it's the holes. In fact, those aren't even the expensive bit. It's the properly out-of-the way and invisible that's expensive.

Unless you live in an apartment, this is not remotely true. Running your own wires is, well, trivial unless you are physically disabled in some significant way.

If you do live in an apartment, it's much harder because walls have to be ripped apart and put back up, or at the very least to do it gynecologist style you have to put medium-sized holes in the walls and fish cables through (all the work done through holes doncha know.)

Of course, if it's all carpeted, you can typically hide at least one four-pair cat5 just past the edge of the carpet around the edges of rooms. This increases run length, but you're unlikely to have any runs over the length limit for ethernet anyway, in an apartment.

Re:Can ARC4 be used properly at all?

[linuxmop]

Wireless encryption is (often) implemented in hardware because encryption is expensive to perform. This is especially true on embedded platforms like the DS.

However, you can apparently upgrade your DS to support WPA with a hacked firmware. It's not clear from the page, but I am fairly sure that it only supports TKIP encryption and not AES since, like WEP, TKIP uses RC4 so does not require a hardware upgrade. It does, however, solve the initialization vector problems of WEP that another poster mentioned; as far as I know, TKIP has not been broken.

Moral? If you're still using WEP, update your drivers and firmware and you may be able to get TKIP WPA and get those pesky neighbors off of your connection.

Re:Can ARC4 be used properly at all?

[Anonymous Coward]

This seems to match what my understanding is.

Basicly, you initialize RC4, and then it generates a nice long stream of encrypted data for you. Its designed for a relatively small number of long streams and keeps the strings from being cracked even if they're quite long.

But WEP takes this algorythm and uses it to make a lot of very small strings (each packet is seperate). Since the initialization of the stream is relatively weak (because it doesn't have to be strong in proper usage), its much easier to crack in this implementation. What they needed to do was A) use an encryption system that was designed for large numbers of small streams, with less spent on keeping the millionth bit of the message from being repeatably cracked and more on keeping the first thousand from being cracked and B) not screw it up even worse.

Re:Can ARC4 be used properly at all?

[Talgrath]

Bull. I set up my entire house with jacks, there's one in my living room, one in my room, one in my kitchen, one in my each of my kid's rooms (three total) and one in the computer room; while I wouldn't say the wires are invisible, you do need to pay attention to see them. Total cost: about $50, plus a few hours of my time. It's honestly not that hard to do either, all you're doing is running wires; of course, you do need to have some knowledge about what the hell you're doing.

Personally, I won't do anything that I want to be secure on a wireless network; they're way too easy to break into and that's my advice to anyone working on a wireless network.

Re:Can ARC4 be used properly at all?

[zippthorne]

If you live in an apartment, it probably doesn't matter that you have wires all over the place. You don't have many rooms, and if you lay things out right, you won't have any wires to trip over.

OTOH, if you live in a house, you don't want ugly blue, gray, whatever wires all over the place uglying up your home and creating trip hazards. Especially if you have more than one floor. No matter what you do, if you're going through walls, it's going to take more than an hour to get what you want. Even if you work at McDonald's, the value of your time exceeds the copper by a significant margin.

Re:Can ARC4 be used properly at all?

[valkraider]

Unless you live in an apartment, this is not remotely true. Running your own wires is, well, trivial unless you are physically disabled in some significant way.

Uhmm, methinks you have not actually done this much... Or at least not in many houses.

Things like lath&plaster, plumbing, strange placement of studs, lack of crawlspaces, windows, carpet, laminates, tile, doors, fireplaces, and foundations - all sorts of stuff really makes it not, well, trivial.

Re:Can ARC4 be used properly at all?

[drinkypoo]

If you live in an apartment, it probably doesn't matter that you have wires all over the place. You don't have many rooms, and if you lay things out right, you won't have any wires to trip over.

Well, I agree with this argument.

OTOH, if you live in a house, you don't want ugly blue, gray, whatever wires all over the place uglying up your home and creating trip hazards.

So part of your argument is that uglying up your apartment is okay? Because the wires don't become invisible in an apartment.

No matter what you do, if you're going through walls, it's going to take more than an hour to get what you want.

And if I have to deal with a bunch of security bullshit, then it's going to take more than an hour to get what I want. I'm still looking for a salient point.

Even if you work at McDonald's, the value of your time exceeds the copper by a significant margin.

And what is the time I spend dealing with wireless security worth? Is that time somehow not worth anything? Is it only an intellectual exercise instead of work because I don't have to climb a ladder? Personally I feel just the opposite. If I have to use my brain in a way that doesn't involve fun in my off time, that's called work. Whereas a little physical labor is just nothing, mostly because I sit on my ass for a living. (Well, I tap keys and twiddle the mouse, too.)

Now if someone simply wants to argue that they're too much of a potzer to work a fish tape (a tape measure works in most home situations, BTW) then I can accept that. Or again, if they're disabled and can't do the work, I can understand. If you'd just rather do the intellectual work and call it play, that's fine. But it takes effort for both situations and at the end of the day only one can be snooped trivially from outside your house if you get it wrong.

Re:Can ARC4 be used properly at all?

[spun]

Thank you! It's not as trivial as the GP makes it sound at all. I had a buddy who drilled through a wall and straight into the mains once. Yeah, that's it, a buddy of mine. Not me. Really, I'd never be that dumb.

Re:Can ARC4 be used properly at all?

[kakos]

Get a clue. The weakness in WEP has everything to do with a vulnerability in RC4 (specifically this one). The vulnerability is due to the fact that there is a weakness in RC4's key scheduling algorithm that allows an attacker to obtain the whole key from only a very few bits that just happen to be in the first 24-bits of the key. Since the IV does repeat, it is easy to obtain packets with the weak key bits. However, if WEP did not use RC4, that vulnerability wouldn't be there and you couldn't break WEP using that attack.

Re:Can ARC4 be used properly at all?

[SkyDude]

Things like lath&plaster, plumbing, strange placement of studs, lack of crawlspaces, windows, carpet, laminates, tile, doors, fireplaces, and foundations - all sorts of stuff really makes it not, well, trivial.

Not to mention that too many home owners are tool challenged.

Re:Can ARC4 be used properly at all?

[Anonymous Coward]

I guess that means CipherSaber-1 is still safe with its 80-bit IV.

Re:Can ARC4 be used properly at all?

[blhack]

I'm imagining myself driving around the lot at work (i work at an auto auction and we have to store/track around 2000 cars a week) with my laptop plugged into HUUUUUGE ethernet cable.

oh, and wasn't this a best buy commercial

Re:Can ARC4 be used properly at all?

[D4rk Fx]

Uhmm... methinks you have never heard of Duct Tape...

Re:Can ARC4 be used properly at all?

[Talgrath]

Or you can do it the easy way; there's no reason the wires have to completely invisible, simply run the wires behind couches and what-not to get to the jacks and you'll have exactly the same effect without needing to punch any holes, though you might punch a few holes in easy to do places. If you are at all capable around the house, you can avoid most of the trouble by simply going through the sheetrock/wood at the right place if it really must come out of the wall (it doesn't).

Re:Can ARC4 be used properly at all?

[networkBoy]

I live in an appt. All my cat 5 runs on the ceiling. The ceiling is white, the cable is white, the staples are white.
People usually don't even notice till I point it out to them ;)
-nB

Re:Can ARC4 be used properly at all?

[Splab]

Once managed to hit a mains with a nail while hanging up a picture, nice n sparky.

Re:Can ARC4 be used properly at all?

[Architect_sasyr]

I'm in an apartment and do the same thing, I run a light coloured cable near the skirting boards on the walls. However, as I am renting the apartment I am not permitted to use staples or conduit. Thus I have a WPA - RADIUS solution implemented to get my laptop away from the cables...

It's great to argue a side of an argument, but some of us are forced to use the tools available to us and can't improve. That said, anyone using WEP deserves to be attacked IMHO (Nintendo fans: buy a wireless card and build your own wireless access point just for it. MAC filtering and a strong WEP key are a better solution than nothing at all.)

My $0.02 AU

Re:Can ARC4 be used properly at all?

[rossz]

You've obviously have never been married.

Re:Can ARC4 be used properly at all?

[Anonymous Coward]

I have a length of Cat5 going from the 10/100 switch in my apartment, up and over doorframes and around baseboards all the way to the living room, under my front door, across the hall, under someone else's front door, into their apartment and in similar fashion all the way to their switch. It's been working great for several years.

Plumbing? Crawlspaces? Fireplaces? FOUNDATIONS??? Oh, man, you've gotta be kidding me...

If you need more than Cat5 and duct tape, you're doing it wrong.

Re:Can ARC4 be used properly at all?

[Anonymous Coward]

> You can get 100' or more of CAT5E

Agreed in concept, but I would advise using CAT6. It is also cheap and will support 10 gigbit Ethernet and beyond, which CAT5E will not.

Re:Can ARC4 be used properly at all?

[sabernet]

Technically, to keep it to spec, you'd need three 100' cables and two repeaters to avoid too much packet loss. And each of those with a power source.

So, "Dragging three 100' ends of cable, two repeaters and a pair of battery packs around your house to use your laptop anywhere you want: hilarious" ;)

Re:Can ARC4 be used properly at all?

[e_tews]

The attack is not related to an reused IV. This attack works fine if 40,000 packets have been collected, even if not a single one uses an IV which had been used previously. Some 802.11 stacks use a monotonic counter for IV generation, which will never repead an IV in less than 2^24 packets. Even if such a counter is used, this attack will work perfectly.

Re:Can ARC4 be used properly at all?

[peragrin]

i know guys who can work wonders through all that stuff.

proper old work electricians can move through all sorts of crap. I know because i work with those guys every day.

Re:Can ARC4 be used properly at all?

[dotgain]

Ethernet max segment length is 100 metres, not feet.

Re:Can ARC4 be used properly at all?

[failedlogic]

About 5 years ago when I worked for sales at a cable company, a mid to large size home builder told me every house he was building would have Cat-5 in every room of the house with a wall jack. He didn't care if the room was the laundry, the basement, the attic (ok, attic I'm exaggerating) but he was serious about it. I think he was one of the first builders in my city to do this. I remember his story and then a few years later the larger builders ensued with similar practices. He did similar pre-wiring with the coax cable as well.

Cabling sucks if you don't have easy access to air returns or the return doesn't go to the right spot. I'm reluctant in any event to use Wi-Lan for anything.

Re:Can ARC4 be used properly at all?

[rsmith-mac]

Unfortunately the hacked firmware pre-dates the DS Lite, so at the very least it would break the backlight settings if not more. This excludes the fact that unlike the DS Fat, the DS Lite is particularly dangerous to flash because bridging the necessary contact pad (to overwrite the first chunk of the firmware) brings a metal object within a millimeter of other components that will short out if touched (the Fat didn't have this problem, the pad was farther away from other electronics).

Re:Can ARC4 be used properly at all?

[Cid Highwind]

The time it takes to set up a wireless LAN securely is worth the same *per unit* as time taken wiring the house with cat5. It's just that setting up WPA on a modern router takes 10 minutes (assuming one has to RTFM, much less if you don't) where wiring every room in the house takes all weekend.

Re:Can ARC4 be used properly at all?

[bkgood]

I had a buddy who drilled through a wall and straight into the mains once.

I take it the keyword there is had?

Re:Can ARC4 be used properly at all?

[Workaphobia]

Agreed. I didn't realize how important this is until I had a discussion with some guys in my networking class, and the consensus was conduit carrying cat6 to a patch panel. This has quickly risen to the number one feature I will look at when I reach the point in my life when I'll be buying a house - probably above indoor plumbing and having a roof.

Re:Can ARC4 be used properly at all?

[sabernet]

Crap, you're right. Misread that un'

Re:Can ARC4 be used properly at all?

[Anonymous Coward]

I'm surprised that no one has yet brought up the power of ACLs.

ACLs, Access Control Lists, or MAC filters as newbs call them, act as a good line of defense against any kind of attack.

If their MAC isn't on the list, then they aren't allowed to even pull an IP address.

This, coupled with non-broadcasting, and some form of encryption, can solve most anyone's needs to keep the bad guys out and the good guys in.

Re:Can ARC4 be used properly at all?

[woolio]

I had a buddy who drilled through a wall and straight into the mains once.

Your use of past tense is all the more curious.

Re:Can ARC4 be used properly at all?

[linzeal]

The last house I lived in I had RJ-42 jacks in every room, it took 2 days to snake the cable from the upstairs to the downstairs. Wireless for me is good for outside and not much else. I guess if you live in an apartment you really can't but what geek here can't go get a 500' spool and wire their house in a weekend?

Re:Can ARC4 be used properly at all?

[init100]

I am fairly sure that it only supports TKIP encryption and not AES since, like WEP, TKIP uses RC4

Actually, TKIP does not use RC4, since TKIP isn't an encryption system, but rather a protocol to switch keys every once in a while (TKIP = Temporal Key Integrity Protocol). Note that WPA2 which uses AES for encryption also employs TKIP.

Re:Can ARC4 be used properly at all?

[dagamer34]

MAC addresses can easily be spoofed. Get a clue, pal.

Re:Can ARC4 be used properly at all?

[Scoth]

My problem is I tend to be a wanderer. I might be surfing the web in my computer room, boot up the laptop and go sit on the couch for awhile and surf while watching the news or something, then go into the bedroom and play a few webgames while my fiancee works on homework, then maybe go sit on the back deck in the evening and get a little extra work done. Short of really long cables, or lots of plugging/unplugging, going wired isn't really practical. Of course, I guess that's what WPA and other better wireless security setups are for, although ideally I'd set up my DD-WRT with the wireless on a different segment. I'll get to it sooner or later. I've mostly made do with frequently rotated and never repeated wep keys, although that was going on the assumption of needing to capture tons of packets to crack it. This new thing throws that a bit out of whack...

Re:Can ARC4 be used properly at all?

[ockegheim]

Sadly that is a very good point. After I get married, this fine desktop will probably be going wireless. Luckily when I want to play Warcraft, she'll probably be out, and I can get out my CAT5 cable.

Re:Can ARC4 be used properly at all?

[zenslug]

Just another reason why if it's not a PDA or a tablet, you should be using a wire.

For some reason I am not that paranoid that I have to use wire in my own house. Sure it is *possible* that someone could point a directional antenna at my place and pick up my wifi connection, then snoop in. It is also highly *improbable* and not worth the inconvenience, IMO.

I don't live in an apartment complex, though, or in high-density housing, so the neighbors will be lucky if they can attach to my network.

Re:Can ARC4 be used properly at all?

[Belial6]

The bad news is you are unlikely to find it. The only reason that my house had it, was that I did a complete renovation where I removed all of the sheetrock, AND I planned to live there. Builders don't bother, and few people will cut into every wall of their house. Of the few build it yourself homes out there, most people don't think ahead enough to worry about what cable they will need in 5 years.

The good news is that Sheetrock is easy to do. If you don't mind fairly major DIY projects, it wouldn't be that hard to tear open a wall, add conduit, and put the wall back. If you plan carefully, you will likely only need to cut into one wall for every two rooms.

Re:Can ARC4 be used properly at all?

[Belial6]

That is a perfect example of what I consider a bad builder. One that is putting in things that are designed to make people THINK they are getting quality, when they really are not. I could care less about Cat-5 and coax, if you just put in a conduit. That builder has already created a situation where the wiring is out dated. Gigabit wants Cat-6. If he had put in conduit, every one of his houses could be rewired by the homeowner with very little fuss. But since the builder didn't care if the house was maintainable, he just slapped in some wire, and sprinted that he did it as a bullet point on the sales sheet. Part of the problem though is that the buyers ooohhh and ahhhh about the cat-5, and don't even think about what they are going to do in a few years.

Re:Can ARC4 be used properly at all?

[Khanstant]

Using a better desktop system with a delicious keyboard and mouse: However much your desktop costs.

Re:Can ARC4 be used properly at all?

[Rakishi]

Just another reason why if it's not a PDA or a tablet, you should be using a wire.

Or using WPA or VPN which amazingly enough I already have with any non-shitty firewall or access point. Then I don't need to worry about tripping on a cable or moving it out of the way when I vacuum. So no it's not another reason unless you're an idiot.

If someone wants my data badly enough to use a unknown to almost everyone super/quantum computer to crack my long pass-phrase then they've already broken into my house and installed undetectable hardware snooping devices (you known since that actually has a chance of working and all).

Re:Can ARC4 be used properly at all?

[si618]

A friend of mine almost did the same thing too, only he was _really_ lucky and just drilled a little into the plastic around the wire.

As other people have mentioned, without conduit, home networking and the like can be a little tricky...this 'friend' of mine was trying to piggy back onto the RF cable running from lounge room to roof (only partial crawlspace available), and the electrician in his (or her) infinite wisdom had placed the RF jack on the inside wall instead of the outside wall, and just drilled a small hole in the timber wall to feed the cable through...needless to say this made piggy backing my..errr my friends Cat6 a nightmare, and required cutting a hole in the dry-wall (hence the narrow miss with the power line) to hand-feed the cable through the drill-hole.

Even after all that hassle my friend is still happy he went with cable over wireless, even on his shitty xbox NIC he gets around 6.5->7MB/s.

Re:Can ARC4 be used properly at all?

[COMON$]

features are nice to theorize about in class, but application and the real world will hit you hard. When you have a budget and you have to choose between running your precious conduit so the next owner wont have to spend an extra day installing, or having that theater room or (insert amenity here) I am sure I know what you will pick.

Sigh, I miss the purist days of my BS in CS program where everything I would work with was up to IEEE spec, co-workers were seasoned professionals, and users weren't issues with security. Cherish those moments good sir....cherish them.

Re:Can ARC4 be used properly at all?

[yahooadam]

Unless you live with a women ....

Re:Can ARC4 be used properly at all?

[ddoctor]

Drilling through walls? Is it really that much of a hassle to gaffa tape CAT5 to the floor? Sheesh! If you really want wireless security, use WEP, restrict MAC addresses, and run a VPN.

Re:Can ARC4 be used properly at all?

[Anonymous Coward]

It was obvious to me, a seasoned encryption specialist, that when he said "just as secure as it was before these WEP attacks", that he did mean just as secure, or broken, or otherwise. ,

And it was just as obvious to me, a seasoned reader of the English language, that he also said "The problems with WEP have nothing to do with RC4."

Re:Can ARC4 be used properly at all?

[The One and Only]

That requires wiring, which is difficult in, for instance, a rental place. It also prevents you from using your laptop in bed/on the back porch/in the kitchen/on the floor next to your seemingly malfunctioning cable modem/on the balcony/on the toilet.

Re:Can ARC4 be used properly at all?

[SirTalon42]

If someone breaks your encryption key, your MAC filtering (no one calls them ACLs except maybe ACs that have no clue) will be useless since they then have at least one allowed MAC (most likely many more). MAC filtering is just to keep someone from accidentally connecting, not to keep someone that has half a clue out.

Re:Can ARC4 be used properly at all?

[Chmcginn]

Well, I'm pretty sure I can, cause I worked my way through college working for a residential electrician, and I've done quite a bit of work on my house. But one of my relatives managed to sprain his ankle trying to pull cable through his attic to set up a home network. The point is that the GP said it was trivial for anyone who wasn't disabled... and that's patently untrue.

Re:Can ARC4 be used properly at all?

[threephaseboy]

You can run gigabit over plain old CAT5.

Re:Can ARC4 be used properly at all?

[kd5ujz]

It is not that hard to do without destroying the sheetrock. If you have existing cable, you can attatch a string to the end, pull it up/down into the ceiling/crawlspace, tape on the new cable in the attic/basement, and pull it back down with the string. If you do not have existing cable, you can use paddle bits and bit extenders to get through any cross studs in the wall, then fiberglass rods to fish down through the cross studs. Sometimes you get lucky and there are not any cross studs.

Re:Can ARC4 be used properly at all?

[kd5ujz]

That is what a stud finder is for. You can locate any kind of copper/steel ( water/gas mains included) so that you dont get a suprise when you go all out with a sawzall.

Re:Can ARC4 be used properly at all?

[kd5ujz]

And as a bonus, you can find studs with them ( forgot to preview).

Re:Can ARC4 be used properly at all?

[thealsir]

Common Slashdot Format(TM)

1. Story posted about $SECURITY_PROTOCOL being broken on $BROKEN_DATE at $SEVERITY
2. Comments ensue recommending ridiculously complex/impractical solutions (in typical slashdot lore) getting modded up
3. Comments ensue about how ridiculous and complex those impractical solutions are, getting modded down/up on a 50/50 basis
4. Actual common-to-do, easy to implement solutions, like the WPA2 in linksys routers, are not discussed or modded
5. Extreme architecture biases/overall naivete about NO security implementation being completely secure is prevalent in a lot of comments
6. Sometimes, people come in to right these fallacies in the free market way, by posting.

Put short, wires are not a solution, no encryption protocol is flawless, the risks/rewards of wireless should be known and the technology should be used accordingly. But improvements in protocol and advancements in technology, especially relatively easy to implement ones, should be emphasized.

Re:Can ARC4 be used properly at all?

[Joviex]

Uh, yeah and 300' of cable is only 91.44 meters. r-tarded math FTW.

Re:Can ARC4 be used properly at all?

[Anonymous Coward]

Ive never met someone so pasionate about conduits..

Marry me

Re:Can ARC4 be used properly at all?

[kickdown]

> Login authentication does not prevent a man in the middle
> attack of the breakin sort.

It can, if you use a mutual authentication method, like EAP-TTLS,
EAP-TLS or PEAP for your RADIUS login.

> You need end to end encryption, including encrypted login
> and certificate verification with secure exchange made
> pre-connection to provide security over a wireless link.

Correct, but all of this can be delivered with RADIUS and 802.1x
authentication. MITM can be prevented. Just be sure to not use
non-mutual authentication schemes like EAP-MD5. Those are
susceptible to MITM attacks.

BTW, check www.eduroam.org for a secure WLAN auth system that
scales to a world-wide scale.

Cya.

Re:Can ARC4 be used properly at all?

[paganizer]

To probably 99%+/- of U.S. Citizens, if they have any idea of how big a meter is, they think "about a yard", so "about 300 feet" is a pretty darn good answer.
I'm a Traveller gearhead, so I learned metrics at an early age. If not for the game, I would only know:
about how much 2 liters is.
100 KPH is not very fast.
a ounce is 28.3 grams (something we ALL learned in the 70's)
There are around 35 ounces in a kilogram (something some of us learned in the 70's) ...and thats about it.

Re:Can ARC4 be used properly at all?

[Andrew Kismet]

A meter's length is three foot three,
it's longer than a yard, you see.

Re:Can ARC4 be used properly at all?

[Anonymous Coward]

You can get 100' or more of CAT5E Is it bad if "CAT5E" made me think of the .cx TLD? :)

Re:Can ARC4 be used properly at all?

[Builder]

How much less could you care ?

Re:Can ARC4 be used properly at all?

[lukas84]

Yes, you can, and maybe it will work.

Cat5e on the other hand fully, officially works with Gbit Ethernet. And at least here in switzerland, i have seen anyone wiring plain old cat5 (without the e) on the last 5 years.

Re:Can ARC4 be used properly at all?

[cyclomedia]

I cat5-ed our house a couple years back (victorian terrace, believe me these buildings have no spare gaps between floors/walls/anywhere very efficient use of 3d space!). It just so happened however that we were in the process of gutting (back to bricks and beams) half the rooms including the kitchen and bathroom and also putting in better loft access (where the phone lines now come in and meet the main switch). I just lobbed in cat5 while we were at it mostly. And whilst there's still no "conduit" as such everything meets in 2/3 particular places and to rewire it you'd just have to secure your new wire to the old and pull from the other end. probably.

i could insert the horror story about finally finding out that the top floor had one electric cable to it all these years and not a proper ring main. the top floor being the one that had housed the office and music studio, bet that wire got warm.

Re:Can ARC4 be used properly at all?

[Talgrath]

You've obviously have never been married. Actually, I am married; my wife was quite fine with it as it was convenient for her too and I use it for work-related purposes.

Re:Can ARC4 be used properly at all?

[Tsagadai]

Sadly that is a very good point. After I get married, this fine desktop will probably be going wireless. Luckily when I want to play Warcraft, she'll probably be out, and I can get out my CAT5 cable.

Giggity

Re:Can ARC4 be used properly at all?

[Anonymous Coward]

You don't understand, you should use the duct tape on the wife.

Re:Can ARC4 be used properly at all?

[Anonymous Coward]

Can you break the SSL, TLS, SSH protocols when you receive a lot of packets like wepcrack does it?

Re:Can ARC4 be used properly at all?

[glesga_kiss]

what geek here can't go get a 500' spool and wire their house in a weekend?

One who rents his apartment/home? One advantage about WiFi is that it can be "installed" in a home with almost zero effort and no damage to the building.

Personally, I own my flat and I've wired it for ethernet years ago. But the laptop I'm currently typing on is using WiFi. If I used ethernet, my VMware images would drop their network connections between rooms. WiFi ensures continuous connection as you go from room to room.

Re:Can ARC4 be used properly at all?

[evilbessie]

Um no, gigabit networks need Cat-5E not necessarily Cat-6, most Cat-5 is actually Cat-5E these days anyway, although I would still check you are using Cat-5E if you need gigabit.

Re:Can ARC4 be used properly at all?

[stsp]

disable wireless security and implement real security, such as a RADIUS login. then set up a firewall rule to allow unauthenticated devices to access nintendo's servers

The problem is that online gaiming with a DS is peer to peer. Nintendo's servers only match players.

Re:Can ARC4 be used properly at all?

[elgatozorbas]

Depends on what you want: it is possible to build your house completely future-proof, but this will come at a cost. One should take into account the probability that the upgrade will needed and the cost to do so.

When my dad built his house 30 years ago, he made a star configuration of leftover pieces of microphone cable he could lay hand on. This cable was meant for professional microphones with internal tube amplifiers and had 2 power wires and 4 signal wires, all this in a strong braided shield. A colossus. And because he just put it into the cement behind the walls, it is completely not upgradeable Initially these wires were intended for telephony, 15 years ago I used them to make serial links across the house. For the past 10 years they have been part of an ethernet. 100Mbps is not possible on all runs, but it cost us virtually nothing (keep in mind this cable was not at all intended for those frequencies).

My point is that if you install anything remotely standardised, like cat5e (or now cat6), for 90% of households (just a made-up figure) this will do for the rest of their lives, while the cost is much lower than installing tubing. The other 10% may want to think more about it.

Re:Can ARC4 be used properly at all?

[Anonymous Coward]

That is what a stud finder is for. You can locate any kind of copper/steel ( water/gas mains included) so that you dont get a suprise when you go all out with a sawzall. Most of the time you can manage quite well without this tool. Cables and Pipes should run horizontally or vertically. if you take an outlet as a guide anywhere on that wall directly above below or left and right of it are potentially dangerous, if you must unscrew the face plate and see where the cables exit. for studs a few knocks on the wall should indicate where it is hollow.

Ok this isnt universally true sometimes you will find cables ran around door frames.

Once you find a property with weird cable runs then you need a stud finder and I would check and test every outlet. Cowboy electrics should be assumed to be unsafe.

Re:Can ARC4 be used properly at all?

[thealsir]

I use all of those, mind, but I realize for common use that tunneling those over a wireless connection would be too much maintenance for all the people using the router.

Re:Can ARC4 be used properly at all?

[Anonymous Coward]

The house I'm living in at the moment is ~95 years old. So if you are building a house to last, will most of the standardized stuff today be useful in 90 years time?

The tubing is definately the better option unless you intend to rebuild your house every 30 years or so.

Re:Can ARC4 be used properly at all?

[Anonymous Coward]

I guess you don't have carpets or mind that it looks ugly.

Re:Can ARC4 be used properly at all?

[secolactico]

The problem is that online gaiming with a DS is peer to peer. Nintendo's servers only match players.

I find that hard to believe, since most consumer wireless AP are also NAT devices. Even Nintendo's own wifi adapter uses windows' connection sharing.

I believe that most DS (and Wii) are not routed directly to the internet without NAT.

Re:Can ARC4 be used properly at all?

[stsp]

I find that hard to believe, since most consumer wireless AP are also NAT devices. Even Nintendo's own wifi adapter uses windows' connection sharing.

The traffic between players is completely UDP, so they can do NAT traversal. TCP is only used to connect to Nintendo's servers. Check for yourself with tcpdump if you still don't believe me.

Re:Can ARC4 be used properly at all?

[CastrTroy]

100 km/h (the proper way to write it) is pretty fast for most cars. It's the speed limit on most 4-or-more lane expressways in Canada, although that doesn't stop most people from driving at 120-140 km/h.

Re:Can ARC4 be used properly at all?

[canuck57]

disable wireless security and implement real security, such as a RADIUS login. then set up a firewall rule to allow unauthenticated devices to access nintendo's servers

I think you were trying to be funny, not insightful.

Like I have recommended for years, VPN/IPSec over wireless is the only way. WEP, WPA are all weak by comparison. Turn on WEP, let the next door neighbor hack it just to find it firewalled only allowing IPSec. Wreaks their day.

Re:Can ARC4 be used properly at all?

[fbjon]

Meh, you pansies. When I was an exchange student, we had a spider net of Cat5 running outside the dorm from window to window, drooping down in between and hanging in the wind, and we liked it that way!

Re:Can ARC4 be used properly at all?

[bill_mcgonigle]

You need end to end encryption, including encrypted login and certificate verification with secure exchange made pre-connection to provide security over a wireless link.

Yeah, if you want real security. Most people just want to make access inconvenient. I typically setup a captive portal with a shared password and let people get to the Internet if they have it. Folks who want to get on the LAN can just VPN in like they do from home.

That solves most problems cheaply. You'd be surprised how hard it is for the average user to even type in a 128-bit WEP key in Windows, since it's a huge double-entry 'password' field. Damn stupid UI...

Re:Can ARC4 be used properly at all?

[sgtrock]

Well, what kind of conduit are we talking about? Conduit designed for electrical wiring is a poor choice. It has far too small a diameter, for one. The metal is a bitch to terminate, too.

OTOH, if you're talking about 3" or 4" PVC with a simple cap on each end, I'm willing to listen. Just make sure that it's clearly marked as CONDUIT or it'll get used as a sewer pipe by some enterprising plumber! :)

Re:Can ARC4 be used properly at all?

[sg3235]

Unfortunately, this geek can't wire his house in a weekend. I have a two story house with no attic and no way to run wires up to the second floor without tearing out the walls and/or floor. I wired most of my house when it was under construction. Unfortunately, that was before CAT5E was prevalent and so I only have CAT5.

Re:Can ARC4 be used properly at all?

[Abcd1234]

I continue to be amazed that some company hasn't produced a simple bridging tool to make it easy to flash the light. A plastic stick, sized to fit perfectly in the access hole on the back of the lite, with a little metal pad attached to the end and *only* to the end, would make flashing pretty easy.

Hmm... sounds like an interesting new project for when my phat replacement arrives...

Re:Can ARC4 be used properly at all?

[evilviper]

Gigabit wants Cat-6.

1) No it doesn't.
2) There's no thing as Cat-6.

Re:Can ARC4 be used properly at all?

[josath]

I am 99% sure the above link is completely fake.

1. The supposed upgrade file only contains 300 bytes of data. The rest is all zeros. I HIGHLY doubt someone could implement WPA in under 300 bytes. In addition, that's not counting the header on the file, so in reality there's probably zero data.

2. In DS games, all wifi code is implemented in eachh game. NOT the firmware. In order to add WPA support, you would have to patch the games themselves, not the firmware.

Trust slashdot to repost months-old hoaxes...

Re:Can ARC4 be used properly at all?

[drinkypoo]

The time it takes to set up a wireless LAN securely is worth the same *per unit* as time taken wiring the house with cat5.

The time it takes to set up a secure wireless LAN is ongoing, because you have to continue to detect (or otherwise be informed of) security vulnerabilities as they are discovered and address them. The wire doesn't sprout new vulnerabilities.

Re:Can ARC4 be used properly at all?

[WillyMF1]

If you're still using WEP, update your drivers and firmware and you may be able to get TKIP WPA and get those pesky neighbors off of your connection.

I bet your the most popular guy at your blockparty!

Re:Can ARC4 be used properly at all?

[Belial6]

For those that do use this, "smurf tubing" is pretty standard. It is flexible, so it is easy to run. It is plastic, so terminators are unnecessary. It is bright blue, so it is easy to identify. They sell it at most hardware stores.

Re:Can ARC4 be used properly at all?

[networkBoy]

Don't know the rules in your country, but in the states (CA at least) you can use staples, nails, whatever. The appartment can not bill you for "reasonable" wear and tear after a certain number of years (5 IIRC).
-nB

Re:Can ARC4 be used properly at all?

[hobbesx]

Exactly- nobody that's pro-conduit here seems to have mentioned the cost of conduit per foot, especially when compared with the cost of cat-5e. I can buy a 1000' box of cat-5e riser for $80.00 at a big-box hardware store ($60 if you don't need runs rising more than one floor).

Two inch electrical conduit is more accurately measured in the dollars per foot, rather than pennies. A good low-voltage wiring guy can string a whole house in an afternoon if it's still open- conduit is not so simple, especially if your house has multiple floors.

Save your conduit money for places where it will actually make a difference. I've got two lengths of it for projector video cable, where a standard can come and go in a year or two. Otherwise, just think of all that empty space between studs and joists as the big conduit it is...

Re:Can ARC4 be used properly at all?

[griffjon]

This reminds me of the advantages of living in an ass-old house; not necessarily from the re-wiring side, but from the forethought in building side. Built-in restrooms? There's a closet on the other side of the wetwall with open access to the plumbing, which means that every time you need to do something to the tub, it doesn't involve busting out the tile and then re-tiling at the end.

What happened to building that is intentionally easy to maintain, as opposed to intentionally hard? (My parents had to replace their tub at their house - not only was the piping not in a sane location, it was embedded 6' into the house slab (which had, unsurprisingly, cracked, taking the pipe with it).

Re:Can ARC4 be used properly at all?

[bWareiWare.co.uk]

Cat-6 exists and is required for 1000BASE-TX.

This led to the total commercial dominance of 1000BASE-T because it will run over any good Cat-5 (or 5e or 6). However as they are both Gigabit Ethernet it lead to the confusion above.

10000BASE-T does require Cat-6 (or 6a, or 7) cables and so the point of eventual redundancy will always be valid.

You will probably get more future proofing with fiber - but as always staining on the bleeding edge will bleed you dry.

Re:Can ARC4 be used properly at all?

[Bat Country]

Might I just ask why in hell you would need to encrypt your activities on a Nintendo DS?

Are you afraid that the CIA mind-moles will steal information about how bad you suck at Warioware?

If you're running Linux or something on a DS, software encryption on both ends of the wireless connection should be sufficient to address any weaknesses in WEP.

Re:Can ARC4 be used properly at all?

[ColdWetDog]

a ounce is 28.3 grams (something we ALL learned in the 70's)

28.3 oz?? Really? Man o man, I thought it was just 28 grams.... To think of what I've been cheated out of all those years (note the past tense). I thought the 0.3 grams was the baggie.

Re:Can ARC4 be used properly at all?

[secolactico]

Sorry, I didn't mean to dis-believe you :-) I just did a quick Google search and looks like you are right. I don't know much about NAT traversal, but from what I've read, Wii and DS use STUN (or a variant thereof) opening several sequential UDP ports in order to use the state maintained by the firewalls/NAT devices. I guess WFC is only used to negotiate this, then.

There are several forums with people complaining that their universities are blocking this somehow.

Can anybody with more "inside" knowledge of how Nintendo's wifi works shed more light on this?

Re:Can ARC4 be used properly at all?

[greed]

Older stud finders didn't detect metal... they only detected material that was right up against the wallboard. The one I have with a deepscan mode can't distinguish between the stud you want to drill into and the mains cable you don't... or drain... or gas pipe.

If you have one of those, get a new one with live AC and metal detection.

Re:Can ARC4 be used properly at all?

[name*censored*]

It's really not difficult to put a whitelist on your router to only allow certain MAC addresses (to stop warchalkers), and WPA/WPA2 (to stop snoopers). These are both options on every access point and wireless router I've dealt with. Besides, most peoples' desktops use wires (much cheaper and less fuss, given that the jacks are included onboard on almost all modern motherboards), and wireless is for laptops/portables (where you aren't likely to do any of your super-secret important work, for reasons of obvious security) - so if it bothers you that much, just switch your access point off or on standby when you aren't using it.

Re:Can ARC4 be used properly at all?

[WebCowboy]

I could care less about Cat-5 and coax, if you just put in a conduit. That builder has already created a situation where the wiring is out dated. Gigabit wants Cat-6.

My house is wired for Cat-5e--that was the very latest thing out when I had it done. I upgraded my home LAN to gigabit merely by replacing the switch and the NIC in the older PC that was still 100BT. As the speed attests to (better than wireless-N in ideal conditions in actual tests), you most certainly CAN use gigabit without Cat6. Not bad for six-year-old wiring, and there is still a lot of life left for Gigabit.

If he had put in conduit, every one of his houses could be rewired by the homeowner with very little fuss.

Conduit is certainly a good way to do things, though in reality it can still be a monumental task to pull cable through conduits embedded into walls, floors and ceilings, especially if it has to make many bends...and in residential construction is WILL have to make s few bends. For example, you have to route it around HVAC ducts, water supply and DWV pipes and electrical wiring. Furthermore you might find you cannot run conduit of usable size through studs of load-bearing walls or in floor joists (and you cannot drill holes of any kind through any part of an engineered truss) as this will violate building codes and cause structural weakness.

So, unless you can snake cable through a 1" O.D. conduit full of bends with any sort of ease then you are looking at not only the cost of the conduit itself and its installation, you are looking at doubling up load-bearing studs and joists, or widening walls by a couple of inches. This is very expensive and houses are expensive enough as it is. It's akin to butting in a built-in vacuum system--it'll cost in the thousands and you only have a small number of strategically placed outlets (not in every room, etc). Builders do not use conduit except in commercial or very high-end residential because it adds a substantial amount to the cost, is not as flexible during construction and is a hidden feature that doesn't add to resale value for a typical buyer.

Part of the problem though is that the buyers ooohhh and ahhhh about the cat-5, and don't even think about what they are going to do in a few years.

If you have an unfinished basement or crawlspace or attic area--and I'd say most houses have one of those, then you can use a fishtape (like a measuring tape but stiffer) and drill a hole into the inside of a wall and fish the cable into the wall with a comparable effort to pulling through a convoluted conduit (maybe less). You then clamp cables to the floor joists, ceiling joists, etc. and route back to your panel. This was done in my house to six rooms in one weekend (not working on it full days either). The basement was easier yet becasue it was not finished at the time. If you wire with the latest cable now, by the time you MUST get something else you'll be renovating anyways. And, unless you are a pro and have very high-end needs, a gigabit-ethernet network over Cat5e still has a very long shelf life--it provides more than enough bandwidth for residential HDTV, IP telephony and other media.

Re:Can ARC4 be used properly at all?

[evilviper]

Cat-6 exists

Completely my mistake. I guess I had mentally incremented the digit for some reason.

You will probably get more future proofing with fiber - but as always staining on the bleeding edge will bleed you dry.

I expect the issue is a bit more technical. It's not easy to appropriately run fiber through the tight turns needed for (current methods of) home wiring.

Re:Can ARC4 be used properly at all?

[sgtrock]

If it's that easy to install and use, why is everyone saying that it's a huge cost factor? It should be trivial compared to what's required to actually pull cable through it.

Re:Can ARC4 be used properly at all?

[Debug0x2a]

7. ??? 8. Profit! Anyhow, I've always thought of encryption and mac filtering more as a deterrent. If someone wants into my network so badly that they are willing to camp my house, find and spoof one of our mac addresses, and then crack the WEP key, most likely they wouldn't have much of an issue breaking in either. Obviously, WEP is even less of a deterrent now that it can be cracked in the time it takes to 'stop and look at a map' so security methods such as WPA2 should be looked into next. Not wiring.

Re:Can ARC4 be used properly at all?

[Belial6]

I am not suggesting that the conduit needs to run all the way back to a media/server closet. A one foot conduit that runs from the outlet to the basement, or one that runs up into the attic, would be just fine. Most homeowners don't have a problem climbing up into the attic, or going into the basement. It is when they need to start drilling through wood, dealing with running cable past insulation, and the worst... trying to get past the fire stop in the middle of the wall. As you said, drilling through certain parts of the house could violate codes. Having a tube in the attic or basement that reaches to a wall plate would make a big job for most homeowners into a minor one.

Yes, Cat5e does likely have a very long shelf life, but 10 years ago, people would not have thought to run cat-5 to every room. That also does not necessarily meet the needs of many rooms anyway. What about IR extenders, Audio and Coax. The point is that while we think that Cat5e will work just fine for the next decade, history has shown this to be an unlikely scenario. It sound a lot like what we hear every time hard drives take a size jump. People start saying "You'll never fill that up.", and every time they are wrong.

I don't know about you, but most people do not renovate their house every 10 years. Most people don't even repaint the interior every 10 years. It is probably more like every 30 years.

I still believe that the cost 20 feet (for basement) to 200 feet (for attic) conduit is not that expensive, and shows the difference between a builder that makes houses designed to stand 30 years compared to designers that design houses to stand for 100+ years.

Re:Can ARC4 be used properly at all?

[Belial6]

Pick your choice...

1) Short term gain.
2) Thinking that each conduit must run all the way back to a server/media closet instead of the 12" to a basement, or 8' to the attic which makes 98% of the install job trivial.
3) Not understanding that one conduit serves both sides of the wall.
4) The belief that we have reached the pinnacle of wiring, so no future changes will ever be needed.
5) Fear of change.
6) Over engineering.
7) ???

Honestly, the "it's too expensive" excuse really doesn't hold water. A couple of years ago, I had the sheetrock down on a home I was renovating. For the 1400sf house, the cost of running conduit to every single room, including the living room, dinning room, bathroom, laundry room, and 2 to the kitchen, I spent less than $200. When I was done with the house, pulling cable, and phone to the rooms that I wanted it in was trivial. Now, if you have a 5000sf house, the cost might be triple that, but given how much homes cost, I don't think worrying about $600 for proper wiring is a good use of your time. Besides, the "just run all the wire you will ever need" route, isn't likely to save you money anyway. Compare the 100' of conduit compared the the 5,000' of cable. I don't think conduit can really be called 'more expensive'.

Re:Can ARC4 be used properly at all?

[MarkCollette]

We've had 10Mb/s wired for several decades now, which will arguably only be bested by 802.11n wireless within a year. True, 802.11a/g were better on paper, but with interference, not really. And even with 802.11n, the vast majority of users won't notice a difference for day-to-day audio or video streaming, or Internet usage.

So yes, it's better to have conduits, but you can probably get several decades of pretty good usage out of just laying the best copper wiring you can get.

Unfortunately, not a single place that I've seen built in the past few years has either...

Re:Can ARC4 be used properly at all?

[Anonymous Coward]

Gigabit wants Cat-6

Wrong. 5e works just fine.

Re:Can ARC4 be used properly at all?

[Lehk228]

a radius login would still be better than WEP/WPA

especially since you don't TELL the clients that they cannot connect because they have not logged in.

Re:Can ARC4 be used properly at all?

[stsp]

Sorry, I didn't mean to dis-believe you :-)

Of course you should be skeptical about what you hear on slashdot!

I wasn't meaning to say that you have to believe me (which would be quite arrogant indeed), I was meaning to say that you can see the truth for yourself with tcpdump (which is much better than just believing some random bloke on slashdot :-)

Who even still users WEP?

[RedElf]

Hasn't most everyone moved to WPA-PSK by now?

Re:Who even still users WEP?

[bobcat7677]

To answer your question in a word: "No"

I could give examples but it seems like a waste of keystrokes in this instance.

Re:Who even still users WEP?

[Knara]

No. Even a cursory glance at your laptop next time you are in a commercial parking lot will tell you that (or at an apartment complex).

Re:Who even still users WEP?

[Eugenia Loli]

There ARE people out there who are FORCED to use WEP because they use it with older devices that don't support anything else. It would be very expensive replacing all these specific/mobile devices just so they can use a new encryption.

Re:Who even still users WEP?

[drinkypoo]

AFAIK I have precisely zero pieces of 802.11 equipment with WPA support. I have a broadcom PCI 802.11G adapter, it MIGHT have it. NONE of my 802.11b hardware does. The laptop I use, which work owns, does have WPA support, but nothing I have will speak WPA to it anyway. If I need security I use VPN and firewall all other traffic.

Re:Who even still users WEP?

[ukatoton]

2 words: Legacy Hardware I have 2 computers in my house with cards that don't support WPA. If I were to set my router to run with WPA, then my sister would not be able to connect to the network. If i told her the security implications, she wouldn't understand nor care. Upgrading the network would mean me footing the bill for new wireless cards unless I can convince my dad that there is a real reason to upgrade to better security. However, this is unlikely.

Re:Who even still users WEP?

[Nom du Keyboard]

Not those of us still with 802.11b routers that work just fine, already run faster than our cable connection, and give us no reason to pay for every lower-case letter update that comes along. Maybe when 'n' is ratified, certified, and gone through it's first couple price drops it will be worth upgrading.

Re:Who even still users WEP?

[Eugenia Loli]

Exactly. And then there are lots of PDAs and similar devices that don't have upgradable WIFI cards. Unfortunately, WEP won't go away so fast.

Re:Who even still users WEP?

[aschlemm]

Some of my neighbors use WEP or no encryption at all. In scanning all WIFI networks in range of my laptop from my home, my WIFI network is the only one using WPA-PSK. I'm in the burbs but I've noticed more networks using WPA in urban areas but it's not even close to 100% yet.

Re:Who even still users WEP?

[Southpaw018]

Unfortunately, Nintendo has outright refused to support WPA on the DS. Those who use the DS online regularly must either fall back to WPA or resort to completely unsecured communication. Or change their router's settings every single time they want to play online.

Nintendo's response to this is, last I checked, "well, disable WEP and then turn off your computer," which is obviously ridiculous.

Re:Who even still users WEP?

[jrumney]

All my pieces of wifi equipment but one support WPA-PSK, but it only takes one piece of equipment to tie me to WEP.

Re:Who even still users WEP?

[Anonymous Coward]

802.11b routers that work just fine, already run faster than our cable connection What??!?! Are you still using ARCnet or something?

My god man, if you're using 802.11b because it's faster than a wired connection then you have some serious hardware issues to begin with.

Re:Who even still users WEP?

[COMON$]

Technically you are never forced. There are wonderful tools that can keep you safe even if you are on a wide open network. OpenVPN comes to mind, or for the less technically minded there are many many many, easy to set up vpn clients out there for free use.

Re:Who even still users WEP?

[RyuuzakiTetsuya]

no, my goddamn Nintendo DS doesn't do WPA.

!@*_!@#_!@*#!(_@#!_(@#

I'm half tempted to lock down my wireless and just buy the usb dongle and use my laptop for Nintendo DS Wifi.

Re:Who even still users WEP?

[Southpaw018]

Wooops. Cut-pasted too fast, switched WPA and WEP around the second time I mentioned them.

Re:Who even still users WEP?

[StikyPad]

> Who even still users WEP?

I have precisely zero pieces of 802.11 equipment with WPA support

So.. your answer is "people who don't upgrade." Not to sound discriminatory, but I'm pretty sure he wasn't including you in the question, much the way when I say "Who doesn't run a firewall?" I'm not including people who still use C64s. Talk to us again when all your hardware supports WPA, but you still use WEP anyway.

Re:Who even still users WEP?

[RedElf]

I live in an expensive condo complex and haven't seen a WEP network in the premise for a very long time, hence my original post.

Re:Who even still users WEP?

[zippthorne]

It's faster than his Internet connection, which apparently is a cable modem. No need to go significantly faster than the main bottleneck. Especially if the LAN is mostly used to share the WAN anyway.

Re:Who even still users WEP?

[Nom du Keyboard]

What??!?! Are you still using ARCnet or something?

I'm using a cable connetion that the Comcast claims is 6Mbs down, not that I ever see it, and 400Kbs up. 802.11b is a raw 11Mbs max, and with a solid connection I see about half of that. The best actual cable performance I've seen lately (dslreports) is 2522Kbs down, which doesn't tax 802.11b. Why pay for 'g' at 54Mbs maximum when the connection to the rest of the world won't see a bit of that?

Have you figured out now that the only thing I'm using wireless for is connect a computer to my cable connection, which is located in a different place in my house with no wire between them?

Re:Who even still users WEP?

[alanoneil]

"cable" here most likely refers to the internet provider used. That is, even "old" 802.11b hardware at 11mb/s half-duplex can easily saturate a standard home broadband connection at 1.5mb/s. Most home networks aren't for sharing files, but rather "the web" and maybe an odd printer here and there.

Re:Who even still users WEP?

[Masami Eiri]

Last I checked, the fastest available cable internet solution (in the US) is 8 Mbps. 802.11b runs at 11 Mbps. 11 - 8 = 3. The wireless runs 3 Mbps faster.

Re:Who even still users WEP?

[Anonymous Coward]

Why did you throw 'expensive' in there? Trying to brag? It shouldn't have an real bearing on WEP vs WPA.

Re:Who even still users WEP?

[drinkypoo]

So.. your answer is "people who don't upgrade." Not to sound discriminatory, but I'm pretty sure he wasn't including you in the question, much the way when I say "Who doesn't run a firewall?" I'm not including people who still use C64s. Talk to us again when all your hardware supports WPA, but you still use WEP anyway.

Well, that was an incredibly arrogant response from someone who refuses to examine reality.

How many environments are you familiar with in which everything is always upgraded all at the same time, in which all of the hardware works the first time, and in which you never become dependent on a legacy product for any length of time?

Here in the really real world, we often have reasons to utilize legacy hardware. What if I've got one of those $1500 bar code scanner boxes and it doesn't support WPA and there's no upgrade to provide it? Am I going to spend $1600 for this year's model with two more buttons and WPA support? Or am I going to keep using this device as long as I think I can get away with it? What if I don't have budget to buy a replacement? What if it's not even my decision?

Like I said, here in the real world, we often have to use suboptimal equipment. And I assure you that huge numbers of corporations, including those amongst the fortune whatever, are still using wifi gear with no WPA support on a daily basis.

Re:Who even still users WEP?

[RalphSleigh]

Where I am sitting there are 2x WPA (one is mine), 3x WEP and 1 unsecured, so no.

Re:Who even still users WEP?

[313373_bot]

Maybe the OP meant cable modem connection?

Re:Who even still users WEP?

[Zadaz]

I live in downtown San Francisco. If I put my laptop in my kitchen window I can pick up 46 wireless networks.

2 of them are WPA-PSK (including mine)
12 of the are unsecured.
The rest are WEP.

7 of the WEP encrypted ones are the DSL router/wireless access point that AT&T hands out. As far as I can tell this piece of hardware can't be configured in any way, can't even change your WEP key.

Re:Who even still users WEP?

[valkraider]

"precisely zero"
I do not think that means what you think it means.
laptop + broadcom 802.11G adapter != precisely zero

Re:Who even still users WEP?

[wolrahnaes]

Check more often. I have 10mbit both at my apartment and at my office, on two different ISPs. The ISP serving my apartment will be offering 20mbit come fall. A few cable providers, particularly in FiOS areas, are offering 15+ already.

Re:Who even still users WEP?

[Psych0_Jack]

So why are you paying for internet again? Or do you just run bittorrent off a different network each day. Actually thats a really good idea for staying anonymous, using a different access point every day.

Re:Who even still users WEP?

[eclectro]

unless I can convince my dad that there is a real reason to upgrade to better security.

Is your sister cute? Does she have pictures of herself on her computer?

Re:Who even still users WEP?

[pedrop357]

I get 10 down/1 up in Las Vegas and I usually see full speed.

The data rate of 802.11b might be 11mbps, but the throughput is most certainly not. With no security, I got around 6.5mbps. Turning WEP or WPA on brought this down into the mid 5s. I've never ever gotten 7 or more mbps throughput with my 802.11b equipment.

For the record, my current access point (Cisco 1242AG) nets me around 26mbps throughput (with 100% quality and strength) on the a/g sides when copying large files across my network.

Re:Who even still users WEP?

[SkyDude]

Hasn't most everyone moved to WPA-PSK by now?

Slashdot types have, but then again, there are many systems out there that didn't even have WEP turned on. They plugged it in, turned on their PC and that was the last time they had anything to do with wireless networking.

I know because I have used my neighbor's connection. I am such a scumbag........

Re:Who even still users WEP?

[azrider]

There are several wireless bridges available which will support WPA (I just checked the Linksys site). One of these would allow you to still use WPA to a device with an ethernet port. Just a thought...

Re:Who even still users WEP?

[JWW]

Hell, out of 5 wireless networks I can "see" from my house, two have no encryption on whatsoever.

I mean, no matter how bad WEP is, you'll never be able to hack into a WEP network as fast as you can an open one.

It may be where I live, but around town there are open networks virtually EVERYWHERE.

Re:Who even still users WEP?

[Technician]

No. Even a cursory glance at your laptop next time you are in a commercial parking lot will tell you that (or at an apartment complex).

No. We use some prety antique hardware (laptop with embedded 11b no WPA). We are fairly remote so the number of potential attackers is pretty slim. To discourage them, DHCP is truned on. The DHCP range is blocked from the gateway by access control. To get a leachable connection, you will need to spoof a MAC address, use a fixed IP address, and hope we are not online at the moment. A conflict will be noticed.

We don't need a hack proof wireless. We just need to be more difficult than our neighbors.

Re:Who even still users WEP?

[blhack]

so you're saying that AT&T decided to sponsor a huge free wifi network in san francisco!?

Re:Who even still users WEP?

[vux984]

Not me! What's holding me back?

Linux.

Every time I've tried to use WPA my Linux laptop can't access the network (currently Dapper Drake). I've tried the wpasupplicant stuff a few times now, but without success, and the troubleshooting involves mucking with config files, breaking what gui support there is, etc.

The lack of good GUI support is an issue, I don't want to drop to the command line, and manually edit configuration files for wireless networking. I switch networks too often to have any desire to 'fiddle' each time. I want OS X or XPs or even Ubuntu's (when using WEP or open wifi) pick a network, enter your password (if needed) and go.

So in my case, I'll go WPA when Ubuntu's GUI support exists and works. Any word on whether 'fawn' is there yet??

Re:Who even still users WEP?

[nutshell42]

Well, from a legal POV the plausible deniability an unsecured WLAN offers is quite tempting.

As long as you secure your computers and data (and if you're not charged by the GB), it's really useful to be able to tell the judge that it was teH h4X0rZz when the RIAA rings at your door.

Re:Who even still users WEP?

[Anonymous Coward]

You ever heard of "evil twin" problem with hot spots? Someone could just snort all of personal data, if you are buying something or sending personal information at that time. With this breaking of the WEP in a few seconds why in world you want that? But you just surfing for p0rn or something that doesn't need your personal information then you could use these "borrowed" sites for surfing and that person who is the "evil twin" will have viewing that data... especially if you were viewing p0rn;)

Re:Who even still users WEP?

[springbox]

I wish I could, but it would mean rebuying interface cards for all of our computers except one, a new AP (seems to be increasingly hard to find plain APs these days and we need two to cover the entire house), and our DSes only support WEP.

Re:Who even still users WEP?

[Technician]

Or change their router's settings every single time they want to play online.

Stack routere.. Use the WEP router at the cable box. If it's hacked.. your other machines are behind another NAT router. If possible, set up MAC filters to just one. It helps detect unauthorised connections. A second duplicate (spoofed) client would cause a conflict. If you have trouble connecting, you know to check via hard connection or wireless traffic lights that someone has connected. An unreliable connection should help discourage them. (turn off wireless when not in use)

Re:Who even still users WEP?

[mashade]

15mbit down / 2mbit up on Cox outside of Washington DC (Northern VA)

Maybe I'm spoiled...

Re:Who even still users WEP?

[Vegeta99]

in a terminal, sudo apt-get install network-manager

save your work

ctrl-alt-backspace

log back in
voila.

Re:Who even still users WEP?

[AusIV]

But I'm guessing the 32 WEP encrypted networks get very little traffic considering that there are 12 unsecured ones. Most people who hop on other people's wireless networks are looking for a quick/free internet connection, and they'd much sooner use an unsecured network than spend time (even just a minute) hacking through somebody's WEP key.

Certainly, if there is any explicit reason your network would be attractive to hijackers, or if you're really worried about network security for whatever reason you shouldn't be using WEP, but if you're just trying to keep the neighbors from using your bandwidth, the key is to be more secure than the next network.

Re:Who even still users WEP?

[eXFeLoN]

I'm still trying to figure out why you need such encryption on your Nintendo? I mean is you Mario save game that friggin' important?

Re:Who even still users WEP?

[Sancho]

Cool, just need to find that ethernet port on my phone.

Re:Who even still users WEP?

[Sancho]

Does that dongle do more than just create a network for your DS to connect to? Seems like you'd have the exact same problem.

Re:Who even still users WEP?

[RyuuzakiTetsuya]

yeah, but i can disconnect the dongle when I'm done and I'm pretty sure the range isn't nearly as good as the wifi router i've got with nice relatively higher gain antennas.

Re:Who even still users WEP?

[Sancho]

Fair point. That may really be a decent solution for me, too (even with WEP, my DS just can't connect to my router for some reason).

Now I just need a Windows box to power the damned dongle.

Re:Who even still users WEP?

[recursiv]

Hi. My name is Tom. I post on Slashdot, and my wireless router is unencrypted.

It's because I just don't care.

Re:Who even still users WEP?

[Anonymous Coward]

Is your sister hot? Cos I could convince her. Just gimme 7 minutes alone with her. Preferably in a dark place. Like a closet. I'll "connect" to her.

Re:Who even still users WEP?

[David_W]

seems to be increasingly hard to find plain APs these days

Yeah, I've noticed that too... but is that really an issue? I have a router but don't use the WAN port. Seems to work just like an AP then.

Re:Who even still users WEP?

[ZDRuX]

You still live with your parents?!.. Hahaha, you're such a lo.. Wait a minute, so do I!.. fuck.

Re:Who even still users WEP?

[vux984]

Thanks, but...

"You already have the latest version of network-manager installed."

Or some equivalent message, is the apt-get result.

Trust me, I *did* read the ubuntu WPA HOW-TOs. ;)

Network manager has no place to choose WEP vs WPA, just a drop down combo for the ssid, a box to choose ascii or hex, and the password box. Choosing ASCII or HEX made no difference.

For all I know its the wireless box, I had to go with WEP-Open, because WEP-Shared didn't work with the Ubuntu unit either. Its some 2wire dealie with telus branded firmware.

I claimed possession of the laptop in my post for simplicity, but in truth, that laptop is my mom's and this troublesome w-lan is at their place. I REALLY don't want to break what functionality the GUI component does have, which according to the How-tos is what will happen if I start futzing directly with the configuration files. My mom can cope with moving networks in the GUI but not the command line.

At home, I actually am running WPA, but then I don't have Linux on a wireless unit (yet).

cheers

Re:Who even still users WEP?

[dotgain]

No, but it'll have some bearing on the number of WAPs, perhaps?

Re:Who even still users WEP?

[RyuuzakiTetsuya]

Try a 64 bit key.

After finding that out, and realizing that if anyone on my block was sophisticated enough to figure out how to break WEP, they pretty much deserve access to my router, I gave up.

Re:Who even still users WEP?

[dotgain]

Don't you think that if a wireless device only supported WEP, it might also not support installation of software like OpenVPN as well?

Re:Who even still users WEP?

[Sancho]

Yeah. WEP is good for preventing the casual user from joining your network, and the casual snooper from sniffing (something that simple MAC filtering won't do). I don't think it's worth giving up, if you can't use WPA. WEP is at least something.

My DS doesn't even connect without security, so I'm not sure what the problem is. Probably a router incompatibility (using DD-WRT on a Linksys)

Re:Who even still users WEP?

[dotgain]

Ohh snap!

Re:Who even still users WEP?

[dotgain]

Congratulations!

You've missed the point several by orders of magnitude more than I have ever seen on /. before! In fact, if the point were to travel at the speed of light it probably won't hit you until we're talking about WPA+PSK being broken in minutes.

Re:Who even still users WEP?

[Anonymous Coward]

Its not so much that you need to have encryption on your DS, but that in order to use your DS your home network must not be protected by anything more than WEP, if you do so that leaves the REST of your network relatively unsecured.

Re:Who even still users WEP?

[jZnat]

The obvious enterprise solution that comes to mind would be to put your DS and anything else that can't do WPA/2 on a VLAN that's firewalled from the rest of the network. Of course, this might involve a bit of cash spending if you don't have a router that can do this...

Re:Who even still users WEP?

[jZnat]

I've got one of those AT&T routers (2wire), and it is configurable, but I already had a good wireless router before I got AT&T, so I just have a tiny Cat-5 cable I slapped together that connects my old router to a port in the 2wire one (which has its wireless disabled) and DMZ that. Better security that way. ;)

Re:Who even still users WEP?

[jZnat]

I know this isn't the ideal situation, but you can configure wpa_supplicant for the networks you have that use WPA and co., as well as unsecured networks, and I believe you can have it autojoin a network if none of the preferred networks are available.

Also, wpa_supplicant has a GUI (called wpa_gui, imagine that) that you should check out (aptitude install wpagui).

Re:Who even still users WEP?

[MobyDisk]

The Nintendo DS only supports WEP.

Re:Who even still users WEP?

[UnknownSoldier]

Let me know when I can get WPA support for my Powerbook G3 w/ OS 10.3.x

Some of us put our old spare computers to use.

Re:Who even still users WEP?

[SoonerPet]

Yeah you're out of the loop. Here in OKC Cox offers 12Mbit cable connections. Of course my ATT DSL is still stuck at 6Mbit but it's still better.

Re:Who even still users WEP?

[adolf]

No, sir. Nobody would ever suggest that you replace your fleet of $1.5k bar code readers just because someone has finally found WEP to be trivially easy to break. It's your network; open it to the world at your own peril.

Instead, I offer this suggestion: Stop using the old scanners, and go back to whatever system you were using before you decided that wireless bar code readers were Teh Way to Maximum Synergistic Productivity through Leveraged Asset Management and Total Quality Control. Use that old system for a few weeks.

After that, reevaluate whether the additional $1.6k for WPA-supporting scanners is in order. If it's still too expensive, you don't need it.

Hope this helps...

Re:Who even still users WEP?

[COMON$]

Depends on the wireless device. One could argue that if you could not put a VPN client on the device or have up to date wireless, it is not worth getting out to the internet. I could be wrong though. But a quick google search pulled up VPN clients for Windows CE and Palm devices. That would cut out quite a few WEP only items. Some people are not aware there is a Hotfix for windows XP SP 2 that allows use of WPA2.

Then you have a good argument of; if you data is really that important, why don't you upgrade? I work with a lot of clients and hundreds of wireless setups (just started working with draft-n). Off the top of my head I cannot think of any scenario where I would be forced to use WEP. In my mind WEP only tells people you don't want them joining your network. It doesn't protect you. Anyone who would be capable of doing malicious things would not be deterred by WEP.

Re:Who even still users WEP?

[Anonymous Coward]

Duh! If you want to connect to your ENCRYPTED wireless network, you need your DS to be able to support said ENCRYPTION. It has nothing to do with your mario save games and everything to do with connecting to a wireless network with wireless encryption.

Re:Who even still users WEP?

[nexex]

My wireless is unencrypted, enjoy.

Re:Who even still users WEP?

[billgates]

/etc/default/wpasupplicant

ENABLED=0

Re:Who even still users WEP?

[The One and Only]

People in the ghetto don't have wireless networks, and if they do, they're not smart enough to secure them?

Re:Who even still users WEP?

[Anonymous Coward]

I'm using WPA with my Intel 2200bg, with Feisty Fawn's (built in now by default) network-manager-gnome

Re:Who even still users WEP?

[dcam]

Hi Tom and thanks for joining us here are idiots anonymous.

I think Bob wants to share with us too.

Bob: Hi my name is Bob and I have an open relay. I know it's bad but I kinda like seeing the lights blinking on my switch as spammers relay email through my mail server.

Re:Who even still users WEP?

[Anonymous Coward]

Um, no.
Nintendo makes a neat little USB dongle that solves this.
And yes it is secure in that it only talks to DSes and Wiis

Re:Who even still users WEP?

[newt0311]

personally, I use an openVPN setup myself to route all wireless traffic. As long as the keys are kept safe, the encryption is nearly unbreakable.

Re:Who even still users WEP?

[plover]

A corporation with 10,000 WEP-only devices deployed to 2,000 field locations would love to switch to WPA, but that's not always immediately possible for financial reasons. Let's say that one device costs $2,000 dollars to replace (custom hardware,) and each field location requires the upgrade of perhaps a dozen old access points, each one costing say $500 plus the average installation labor of about $1,000 each. So that's $20 million for device costs, plus another $36 million to secure the access points. I don't care how big your company is, you don't tap $56 million from the budget without some serious planning.

When a corporation initially buys equipment, they go for whatever is available and makes sense at the time, and they plan for an expected lifetime of the equipment. When those access points were installed, WPA wasn't on the horizon and security wasn't a top issue, and they may have budgeted for an expected lifetime of 15 years. Just as the rollout of all this infrastructure is finishing up, some researcher announces WEP is cracked. Think about the manager who has to go back to the board of directors asking for an extra $56 million to replace all that brand new equipment because the encryption now has the wrong three letters. Even if the board doesn't fire the manager on the spot for being short-sighted, money for the replacement project is not going to come quickly, I tell you that.

As long as it's not 100% replaced, you're flapping in the breeze. Your only answer is to secure the network behind the access points (a good idea in any case,) secure the device's applications as best as you can, and hold your breath until the money arrives and the old gear is replaced.

It may be the cost of doing business, but it's still pretty high in some cases.

Re:Who even still users WEP?

[reub2000]

WEP is at least something.

Closing the door to your room is something. But anyone can turn your doorknob and enter. I wouldn't trust WEP for anything of any importance at this point.

Re:Who even still users WEP?

[PlasticArmyMan]

Yes because hardcore spammers go wardriving.

Re:Who even still users WEP?

[Apple Acolyte]

My old clamshell firewire iBook running 10.3.9 has WPA support. Are you sure your Airport drivers are up to date?

Re:Who even still users WEP?

[Tsagadai]

Wireless communication has been around in ghettos since it was invented. Why I often hear people shouting at each other when I walk past ghettos.

Re:Who even still users WEP?

[dcam]

---> point

                        0
                      -|-
                        |
you --> / \

I'm suggesting that running an open AP is a dumb as running an open relay.

Re:Who even still users WEP?

[ukatoton]

Well, I'm only 17, and I believe at this age it's fairly common to live with your parents. What'd your excuse?

Re:Who even still users WEP?

[FunkyELF]

I run fairly modern hardware and I don't use a firewall.

I haven't ran a firewall since I got a router.

What does a firewall give you that a router doesn't do by default?

Re:Who even still users WEP?

[recursiv]

Well, if you run an open relay, you'll get put on all blacklists shortly. Then you won't be able to send anyone email.

If you run an open AP, (I actually have a MAC whitelist, but anyway) as far as I can tell, everything continues to work fine. I fail to see the connection.

Re:Who even still users WEP?

[Sancho]

Yes, but there are a lot more people in the world that know how to turn doorknobs than who know how to crack WEP.

It's not secure, but that doesn't mean that it doesn't filter people out.

Re:Who even still users WEP?

[Anonymous Coward]

My solution when setting net access for my friends DS (and PSP) was on top of MAC filtering + WEP + setting wireless power to mimimum was telling my friend to only plug in the USB dongle (that acts as an access point) when she actually needed to use it.

I don't think this is a particuarly good solution though.

Re:Who even still users WEP?

[Anonymous Coward]

No. We use some prety antique hardware (laptop with embedded 11b no WPA). We are fairly remote so the number of potential attackers is pretty slim. To discourage them, DHCP is truned on. The DHCP range is blocked from the gateway by access control. To get a leachable connection, you will need to spoof a MAC address, use a fixed IP address, and hope we are not online at the moment. A conflict will be noticed.

We don't need a hack proof wireless. We just need to be more difficult than our neighbors. I agree with you 100% I do something similar with my network to discourage would be leeches. but umm... Why have DHCP turned on? Isn't it better to have DHCP turned off and then used non standard IPs, you know, anything other then 192.168.1.1 for the router and so on. Then the would be attacker would not have the gateway IP either, or the active ip range, or DNS servers.

Oh and one thing you did not mention, it's trivial, but it's also a good idea to not use SSID broadcasting, to further dissuade people.

Re:Who even still users WEP?

[UnknownSoldier]

My Powerbook G3 doesn't have airport, hence the problem. :-(

Re:Who even still users WEP?

[P3NIS_CLEAVER]

I have a cheap linksys and WPA-PSK does not seem to work properly, so I fall back to WEP

Re:Who even still users WEP?

[ZDRuX]

I`m only 25, and since we just bought a brand new house, my parents cannot afford to pay for it alone :)

Re:Who even still users WEP?

[dcam]

If you run an open AP, (I actually have a MAC whitelist, but anyway)

So you don't run an open AP. Duh.

The point is running an Open AP is a stupid thing to do, unless you really know what you are doing. And by that I mean firewall it off from the rest of your network, and provide a VPN gateway to the rest of the network.

Re:Who even still users WEP?

[Vegeta99]

The "Networking" control panel that you're opening isn't network-manager. I made the same mistake!

In order to configure Network Manager, there should be an icon in your "notification area" whereever you put it. By default, it should already have your network connection in it, but there should be another similar icon, that when you left click on says "Enable Networking" and "Enable Wireless". When you LEFT click on it, it should give you the option to choose the wired network, or a list of detected SSIDs. When you click the SSID you want, it will ask you for the key, and should already know what kind of encryption to use.

Re:Who even still users WEP?

[Anonymous Coward]

Did you find VPN clients for the Nintendo DS?

Re:Who even still users WEP?

[Anonymous Coward]

You might just try it. I was absolutely sure that WEP was the best my G3 iBook could do. I recently resurrected it from the logic board problem (after being "dead" for a year) and figured I'd have to switch my WPA network back to WEP if I wanted to get it online. Much to my surprise, it connected just fine with the right WPA key. Running 10.3.9. I never knew it could do that!

(yeah, I'm 3 days late, sosumi)

Still the illusion that it's "safe"

[athloi]

Code up a windows binary for this exploit, and everyone will move to WPA-PSK much faster!

So what...

[gatkinso]

....well, not really.

But many home users run their access point completely open and never have a problem. WEP still will make an attacker have to actually break in - negating their excuses of "well it *was* wide open , so..."

Of course, this vulenrability applies to those would wish to/need to secure their networks.

Re:So what...

[QuantumG]

Yeah man. I don't know why people don't encrypt their telephone lines, or put alarm systems on their power box. It's their own fault if people use their phoneline to make calls or leech power.

Re:So what...

[totally bogus dude]

Both of these examples requires trespassing and possibly tampering with private property (typically belonging to the telco or power company). I suspect there's also explicit laws against it.

Accessing an access point which advertises its presence and does not ask for a password or anything is pretty different to this, especially given that a lot of people deliberately leave their AP open with the intention that other people can use it for internet access if they wish to. If I see a completely open AP, I assume it's been configured that way deliberately and have no qualms with using it.

Re:So what...

[QuantumG]

Dumb++

If someone doesn't give you explicit permission to use their wireless access point, you should not be surprised when you get dragged off for accessing a wireless access point without permission.

Sheesh.

Re:So what...

[totally bogus dude]

No doubt you're correct from a legal perspective, but this is one of those laws I choose to ignore; it doesn't "feel" wrong. Obviously that won't stand up in court, but I'm not too worried that someone who doesn't know how to put crappy WEP security (or even MAC filtering) on their AP will try to take someone for court for using their AP. It's unlikely they're even aware of the possibility that other people might be able to use it, or else they would have discovered how easy it is to put some basic level of "security" on it.

I am of course assuming that one isn't using the open access point to break the law -- whether by trying to hack other systems or downloading copyrighted material. I also wouldn't feel comfortable downloading high (or even moderate) amounts of data on someone else's connection, because you never know what kind of data allowance their internet connection has. But for casual web surfing, sure.

From a legal standpoint, it would be interesting to see if simply associating with an open access point can somehow be considered an offence of any kind. I can't really see that it would be. Accessing the internet via their connection could be considered theft of service, and accessing PCs connected to the AP which aren't yours to access is obviously illegal, so doing anything useful with an open access point is most likely illegal in some way.

What about using their open AP to connect two devices of your own together? They're already transmitting the radio waves into your house/office/car/whatever without your explicit permission, so what's wrong with sending some back?

Re:So what...

[QuantumG]

The AP is a computer.. you're accessing it without permission. That's a crime in most countries with computer crimes.

Anyway, I find it more interesting why you feel this isn't wrong.

I mean, if someone left their car unlocked (yes, this is Slashdot) and you took it for a little drive, then put it back exactly where you found it, would that be ok? You haven't caused anyone any harm.. and they left it unlocked, after all.

It's a great question.. it strikes to the very heart of what we feel about property.

Re:So what...

[totally bogus dude]

Taking a car for a little drive uses petrol and causes wear and tear. There's also the possibility of having an accident, which would cause even more wear and tear. You also (probably) don't know when the owner of the car is coming back, so you can't be sure you're not inconveniencing them. There's also privacy issues - people tend to leave their "stuff" in their cars, and one of the things that sucks about having your car stolen or broken into is knowing random people have been going through your things. Maybe it's just me, but I think many people tend to think of their car as something of a sanctuary, like our homes.

Accessing the AP itself doesn't matter from this perspective: while you are potentially using more electricity and maybe even decreasing the available bandwidth, these things are insignificant enough for me to ignore altogether (particularly in the case of casual web browsing). Assuming you're not actually "breaking into" the computers & devices they have connected to the AP, the only potential inconvenience to people is the fact that you're using their internet link.

There's three potential problems here: firstly, if you do something naughty, they might get the blame for it. That's a whole different scenario, so I'll ignore that. Secondly, congestion on the link may be problematic for them; which is why I'd limit myself to casual web browsing, not downloading. (I'd also try to determine what kind of link they have [I am a geek, after all], and avoid borrowing slow links, both for politeness and for my own sanity.) Thirdly, if they pay-by-the-byte then your usage of the link may directly cost them money. That's a problem, but ignorance is bliss for one's conscience.

In all cases, casual web browsing is very unlikely to cause any problems. This, combined with the ease of setting up *any* sort of protection (no matter how trivial to crack) to indicate that the access point is private, is what makes me feel it isn't wrong.

Incidentally, most insurance companies won't pay out if you didn't lock the doors on your car; even though locks in and of themselves are pretty ineffective against someone who really wants to "borrow" your car, I think this sets a (admittedly non-legal) precedence for taking some basic action to indicate to people that you don't want them to use your car. This might be where the feeling of "wrongness" (or lack thereof) comes from.

Re:So what...

[QuantumG]

I really can't help but feel that you're quibbling details here. The amount of fuel and wear and tear that you make on a car on a 5 minute joy ride is just as insignificant as the bandwidth and electricity you use by accessing someone's AP. There's lots and lots of situations where you can definitely know that someone will not need their car in the next 5 minutes. It seems the only reason you've seriously put forward for why taking someone's car for a 5 minute joy ride is the "violation" they will feel if they find out. I don't think I'm out of line to suggest that a lot of people would feel a similar violation if they found out you were using their AP without their permission.

So.. it seems to me.. that the difference between light usage of someone else's car such that it doesn't prevent them from using their car and light usage of someone else's wireless access point such that it doesn't prevent them from using it is that they are less likely to find out about you using their AP than they are likely to find out about you borrowing their car.

Which leads me to ask.. what if you were guarenteed that they would find out.. would you still use their AP without their permission? And, when they confronted you about it, what would you say? "It's your own fault for leaving it unlocked" perhaps?

Re:So what...

[totally bogus dude]

I think I was quibbling details, too: your car analogy must have distracted me.

Like most things, car analogies don't really apply -- but perhaps an internet analogy does apply. Leaving an access point completely open is, to me, equivalent to someone setting up an HTTP server on the public internet, and having it respond to normal, unauthenticated HTTP requests with a web page. Now, you can argue that accessing their web server without having their explicit permission to do so is in fact "unauthorised access" to their computer system; which is technically 100% correct. I think it's safe to say that anyone trying to take legal action against someone for accessing their publically available web server would not have a strong case.

A lot of this applies directly to an open access point: the default configuration of most web servers is such that they will accept anonymous requests. If you don't want to make it publically available, you need to learn the basics of the software in order to enable some level of authentication.

So, if someone sets up a web server to accept requests from anonymous users (equiv to an open AP); then puts up a poster with its IP address or DNS name in a public area (equiv to an AP broadcasting its beacon where I can receive it); then it's fair game. Not to mention the fact that for an AP to be useful for internet access, it must respond to my device's DHCP queries for network configuration information with a valid IP address, an IP address of an internet-connected host which is willing to relay traffic for the IP it just suggested I use, and functioning DNS servers. If someone has all this set up, then by all means, this is as good as an explicit invitation to use their AP and internet connection as I see fit.

And, if it was guaranteed they would find out: I would have no qualms about using it. If they don't like it, they should damn well secure it. And they should be happy that it's Mr Joe Web Surfer who alerts them to the fact that their internet connection is trivially accessible by anyone in their vicinity, and not Joe Hacker who uses the opportunity to plant keyloggers on their computer so they can steal their credit card info (or just turns their PC into a zombie for their spam net).

It doesn't matter that most of the things needed for the above (advertising the AP, DHCP settings, etc.) are set up automatically by the device. The only excuse for having a completely open access point these days is that the instruction manual that came with the device made no mention of any of the forms of wireless security, nor why you would want them. In that case, if they incur damages they might have a case against the manufacturer of their AP, for selling them equipment without proper documentation as to its proper use. If you didn't read the instruction manual, then too bad. You should've.

Re:So what...

[QuantumG]

I agree with you that an unsecured AP is exactly the same as an open HTTP port.

Thing is, I think an unsecured vehicle is exactly the same too.

The difference is.. it is socially acceptable to connect to an open HTTP port. It isn't socially acceptable to "borrow" someone's car. An open AP? It's considered by most people to be unacceptable to use someone's unsecured AP.. but a lot of people still do it.

That's all it is. There's some things we're happy to allow others to have access to.. and expect them to have access to. There's some things we're not happy to.

Truth is.. I have a web server running on my Linux box. I've given the ip (which changes often) to a few people over the years and, of course, I access it myself. So when I look in my logs and see worms trying to do ISS sploits on my machine and other random ip scanning people, I *do* get annoyed, but it's not something I would kick someone's ass for.. but don't fuck with my car.

Re:So what...

[gatkinso]

Some people actually do both of thos things.

My point is, a lock is a lock - be it made from tin foil or titanium... you still have to break it to get in. This elevates the intruders action from simple trespassing to breaking and entering.

Back in the courtroom

[Nom du Keyboard]

Your Honor, I was using WEP on my Linksys when the RIAA claimed their agents, Media Sentry, claimed that my IP address was involved in illegal filesharing. I was taking the best precautions my poor little 802.11b router can handle. Allow me to now introduce a paper here explaining how my system can be broken by the average desktop computer in less than a minute.

Case Dismissed!

Re:Back in the courtroom

[TheGratefulNet]

its modded as funny BUT its a VERY valid defense, I would think (ianal).

there is significant doubt as to who the user of a wireless lan really is.

in fact, it now makes sense to DOWNGRADE wireless AP's due to this...

(and then just run ssh on top of it, for sessions that truly need privacy).

Re:Back in the courtroom

[Anonymous Coward]

Plausible deniability is a good thing.

I've always wondered how I could get plausible deniability and I think I just found it. WEP secured wireless.

Any attorney worth $.02 can show it is not only possible, but probable that the WEP encryption was broken and "others" leeched my internet connection from me. Which, BTW, is just fine by me. Since I live by myself, it would be hard to point the finger elsewhere without wireless in there somewhere.

Re:Back in the courtroom

[kramulous]

Agreed .... was modded as funny but makes a valid point ... especially to my non-legal mind.

Re:Back in the courtroom

[burris]

Except in a civil suit the standard of evidence is merely "preponderance of evidence" and not "beyond reasonable doubt."

Re:Back in the courtroom

[QuantumG]

Shame about the file fragments (or whole files) they'll find on your harddrive.. which the court will compell you to produce to a forensic expert. You're better off planting a worm infection on your computer.. then claim you were part of a botnet.

Re:Back in the courtroom

[topical_surfactant]

WEP use in a heavily populated area plus a "clean" hard disk examined by a forensics expert ought to be enough to tip the scales in favor of the defendant, even in a civil trial. At least I hope, from this non-lawyer point of view.

Re:Back in the courtroom

[dissy]

Shame about the file fragments (or whole files) they'll find on your harddrive.. which the court will compell you to produce to a forensic expert. You're better off planting a worm infection on your computer.. then claim you were part of a botnet.

Totally valid point. One of the main reasons you should stay under the radar and not get a finger pointed at you if at all possible.

While excuses such as 'someone was on my wireless' are totally valid, the court will indeed check your systems, and once they find the files in question, add one purgery charge if you attempted to use that wireless excuse.

Alot more care needs to be taken to hide ALL of your downloads of that nature. Warez, music, video, everything.

Encrypted disks will be found, and now it's up to a judge to choose between your excuse why you can't show the court whats in it, and the FUD the procecuter will throw out.

Hiding your data on removable media (disk or otherwise) or even hidden systems, still seems like it would rely on luck of them not being found (Remember, in the USA, its quite possible for a raid first, sue later, depending on the source of the files. Alot more likely in massive busts than simple riaa/mpaa auto-lawsuits thou.)

Even your work infection idea isnt too good in all cases. "Yes your honor, we believe the computer was infected and part of a botnet.. so those files were put there by some hacker. The defendant just found them and played the music and watched the videos.. er, i mean the hacker somehow loaded them to the video player cache.. er, i mean the hacker must have gotten into his set top box and streamed media there too..."

Most patterns of usage of those types of files will not match what a botnet/trojan would do with them.

Making this type of attack public is Great for ppl who really didn't commit a crime and their wireless was used by someone else to do it. One less seeming item of proof to use aginst them.

But for the people really breaking the law and trying to lie about it after getting caught, you will need aLOT more planning to go into your excuse(s), and enough mucking with your system to hide things that it will not be convienent at all to use your pirated booty.

Of course that call is up to you.
But if you are breaking the current laws, don't expect this one thing alone to help you out much if at all if you get caught.

Re:Back in the courtroom

[QuantumG]

I actually think I'd be more happy going to court and saying some things on the record that should be said:

You're fuckin' kiding me right? Everyone does this. Today they're suing me, tomorrow they could be suing you, your honour.

Re:Back in the courtroom

[blueskies]

Maybe your encryption method should create fake partition tables showing only 250 GBs formated on your 500GB disk.

How thorough are they going to be looking at your drive? If the partition table comes up as 250GBs, and the system disk looks normal, they wouldn't be looking very much further. Even if they clone the drive, they rest of the encrypted disk will just look like noise.

Re:Back in the courtroom

[Technician]

Case Dismissed!

Here is the bill from your lawyer... After all the outcome is after they took an image of your hard drive and fought the case and found this isn't the hard drive we are looking for and they tried to find out who in the last year may have brough over a computer such as parrents, children, siblings, girlfriends, boyfriends....

The Case Dismissed is still expensive.

Re:Back in the courtroom

[Torvaun]

It seems to me the easiest way to do this is with a dual-boot computer. Say one partition running Windows XP with NTFS, the other one running Linux with Reiser or ext3. When someone decides that you've been breaking the law, just extend your Windows Partition over the full drive. Windows doesn't accept that partitions without recognizable file systems exist, so it will happily format the Linux partition and convert the file structure to NTFS for you. Give them your computer, they'll find no trace of illegal data/software. It's a pain to rebuild afterwards, but it's better than having a stack of evidence.

Re:Back in the courtroom

[egypt_jimbob]

they'll find no trace of illegal data/software. Wrong. They won't find whole files but they will almost certainly find traces. Leftover pieces of files are detectable for a shockingly long time after they have been deleted (or after the drive has been formatted). Ask the FBI; perverts with all manner of clever evidence-destroying ideas have been trying to hide they're kiddie porn stash from forensics experts for many years with little success.

Re:Back in the courtroom

[Matey-O]

Wrong. One of the standard steps in a forensic examination is checking for physical capacity vs. reported capacity. They WILL get from 0,0,0 to X,X,X where X = full recordable capacity of the drive.

Re:Back in the courtroom

[Torvaun]

I'm going to go out on a limb, and assume that the RIAA is not as good as the FBI at finding files. I would consider it to be a nontrivial matter to try to pull mp3s from a formatted partition previously using an esoteric file system. If you like, you could run some secure deletion utilities on the dead partition prior to turning the partition into just another part of C:. The whole point to this is that there is nothing obviously missing. People, forensics experts included, will see what they expect to. If all the obvious evidence points to 'This is the wrong guy,' the natural course is to look for a different guy. Toss in the preponderance of evidence suggesting that the RIAA doesn't know a filesharing fiend from a deceased septuagenarian, and you've got yourself a successful case.

Re:Back in the courtroom

[egypt_jimbob]

The RIAA has deep pockets and can afford to hire professional forensics people. I'm not saying that the idea has no chance of success. I'm just saying that you shouldn't be surprised if it doesn't work.

Also, "secure deletion" utilities are pretty much useless on journaled filesystems like reiserfs.

Re:Back in the courtroom

[Torvaun]

My apologies, file systems are not my specialty. I'm sure there's some file system that is both vulnerable to being deleted, and is obscure enough to fool teams of forensic experts into thinking it's random crap after the format. This seemed less expensive than my original plan of 'do everything off an external drive, and apply belt sander if necessary.' Also less likely to put dangerous stuff in the lungs.

Re:Back in the courtroom

[Ashe Tyrael]

Theoretically, they can. However, I'm sure I recall a story, posted to this very organ, where it was found that the RIAA's "expert" of choice had about as much talent at his task as your average begonia has in the area of advanced particle physics.

I'm not saying that will always be the case, however.

Re:Back in the courtroom

[blueskies]

What is wrong?

That encrypted data stored in areas not defined in the partition table will look like noise? It's ok if they discover that only half the drive is partitioned. They have to prove that there is illegal content on the drive. So know not only do they have to make they case that you were facilitating copyright infringment but also they have to convince people that the Works are hidden on your drive even though they can't recover them. Even if they can certify that the rest of the disk is encrypted, they still have to make the case that their Works are in that section.

Does this still depend on weak IVs?

[Zarhan]

For some reason I can't get the paper to load, but anyway, does this still depend on weak initialization vectors?

I know that the original attack did depend on that, and most software and basestations have since been configured to avoid those weak IVs. I know that some stuff (like Nokia's basestations) are still weak agains the original attack (at least when tested with Kismet), however, against Cisco Aironets and almost any newer hardware I haven't been able to see this weakness in action when trying out if it really works...

(Terabeam uses the term "WEPPlus" about this - see http://www.terabeam.com/solutions/whitepapers/wep- plus.php )

Anyway, if this is just extension of the original attack, then it still requires those weak IVs to exist.

Or is it something completely new?

Re:Does this still depend on weak IVs?

[tbo]

For some reason I can't get the paper to load, but anyway, does this still depend on weak initialization vectors?

According to the article, the attack does not require weak IVs. They haven't actually tested against WEPplus, but expect the attack to still work against it. In other words, WEP in all its forms is now nothing more than an electronic "No trespassing sign" and 3-foot fence.

Re:Does this still depend on weak IVs?

[ookabooka]

Does aircrack-ptw work against WEPplus?

This has not been tested due to lack of equipment supporting WEPplus. Since WEPplus only avoids the weak IVs of the original FMS attack, we foresee no problems in applying the attack against WEPplus
So you probably still aren't secure.

Re:Does this still depend on weak IVs?

[e_tews]

Hi This is attack is not based on the original WEP attack anymore and doesn't know the concept of weak IVs. I think WEPPlus won't have any noticeable impact on the successrate of the attack. If you managed to load the paper, have a look at the plot of the successrate of the paper. The graph labeld linux iv keylimit 1000000 should be more or less exactly the successrate the attack should have in an WEPPlus environment. This rate doesn't differ much from the optimal rate.

Re:Does this still depend on weak IVs?

[Khyber]

"In other words, WEP in all its forms is now nothing more than an electronic "No trespassing sign" and 3-foot fence." Thank god, now the RIAA has very little tactical advantage left.

Re:Does this still depend on weak IVs?

[Abcd1234]

And like a no trespass sign and a 3-foot fence, for most people, it's good enough. Of course, for a business, they'll want something more secure, but for a home AP, *most* people have little to worry about, since your average WiFi thief is a naive 22-year-old with a laptop who is unwilling to pay for broadband and has no idea how to crack WEP (or even knows what that means).

WEP is as WEP does

[svvampy]

Even the acronym is broken. Isn't WEP one of the contributors to the bollocksy promotion of extra bits for security instead of a better model?

What about 64 and 128 bit?

[andy55]

This may be a dumb question, but why does TFA only refer to 40 and 104 bit WEP when the more common variants seem to be 64 and 128 bits?

Re:What about 64 and 128 bit?

[!ramirez]

Because there's a 24-bit IV, or initialization vector, that is not strictly considered part of the keyspace.

Re:What about 64 and 128 bit?

[jrumney]

I don't know the full details of why, but not all those bits actually get used. I have seen them referred to as "64 bit (40 bit effective)" and "128 bit (104 bit effective) encryption". The hex keys contain 64/128 bits, but the encryption algorithm uses a 40/104 bit key derived from that.

Re:What about 64 and 128 bit?

[Galaga88]

Not a stupid question, a good question.

WEP uses a 24 bit initialization vector, and the rest is left for the actual key. So 40 bit = 64 bit - 24 bit IV. Same for 128 = 104. People just use the terms interchangably (for better or for worse).

Re:What about 64 and 128 bit?

[Anonymous Coward]

Because the 64 and 128 bit numbers are after the Initialization Vectors have been added. The actual passwords are 40 and 104 bits respectively.

Re:What about 64 and 128 bit?

[StryfeX]

Because WEP adds 14 bits to the 40 bit key to get 64 bits, and 24 bits to the 104 bit key to get 128 bits.

I'm sure someone can offer more info, but that's what I remember off the top of my head as I'm leaving work.

--Stryfe

Re:What about 64 and 128 bit?

[dotgain]

The only info I can add is that 64-40=24. ;)

Re:What about 64 and 128 bit?

[StryfeX]

And that goes to show you kids. Don't do drugs.

On another note, I feel like a tool. Ah well, yay for fuzzy math!

--Stryfe

Don't worry about it

[WindBourne]

Just upgrade ALL of your wireless hardware to avoid this. Or you could simply wire up your place and have secure communications at a faster speed and lower price.

Re:Don't worry about it

[Anonymous Coward]

Wireless security on my home network doesn't concern me nearly as much as security on the wire coming in from the internet.

My housemate just had $3000 taken from her bank account my thieves courtesy of spyware on her computer. Not much my fancy iptables skills can do about that. Though if she'd asked me to fix up her PC to stop infections in the first place, I'd have done it for a couple of beers.

Re:Don't worry about it

[Anonymous Coward]

And the nintendo DS uses a wired connection how?

Can you point me to the upgrade for the DS that enables WPA?

Re:Don't worry about it

[stratjakt]

What is hacking your Nintendo DS going to accomplish?

Set up a seperate, locked down via MAC, AP for your DS.

No problem for me

[NotFamous]

I use 56-bit WEP and I've never had.... ATTN: YOU HAVE WON THE IRISH LOTTERY PLEASE respons immediately to... ...so I don't see why it is a big deal?

Simple, cheap, easy solution

[DogDude]

Cat 5 cable. It's cheaper, faster, more reliable, and more secure.

Re:Simple, cheap, easy solution

[Gothmolly]

Wireless is NOT cheaper than cable. A wireless card for my PC was $29. To run wire, crimp the ends, drill through the floor, and install an outlet box would be more than that, just in parts. Scale it up to a few people in the house, and throw in an occasional laptop, and the cost of wiring becomes ridiculous.

Re:Simple, cheap, easy solution

[Anonymous Coward]

just run the cables under rugs like every reasonable person does

btw were you smoking crack when you wrote that post?

Re:Simple, cheap, easy solution

[Nom du Keyboard]

Cat 5 cable. It's cheaper, faster, more reliable, and more secure.

Faster, yes.
More reliable, likely.
More secure, ceratinly.
Cheaper? ABSOLUTELY NOT! Pulling cables through the walls, and underground to a detatched building, was several times the cost of the router and access point, let alone the convenience when other family members bring their laptops and PDAs over.

Re:Simple, cheap, easy solution

[camperdave]

Let's see:
Wireless Router: $80
Wireless Total Price: $80

CAT5 Cable 500ft box: $75
12 port patch panel (with support bracket): $60
12* RJ45 Keystone jack ($6 each): $72
12* Wall Plate ($4 each): $48
12* Electrical box ($4 each (assumed)): $48
16 port Ethernet switch: $90
CAT5 Total Price*: $393

Cheaper my eye!

Re:Simple, cheap, easy solution

[tonywong]

Wireless Total Price: $80
CAT5 Total Price*: $393

Having your network compromised and your identity stolen: Priceless

Re:Simple, cheap, easy solution

[Anonymous Coward]

12 people on CAT5 cable on the network = each person @ 1/12th (1 / 12) the network's speed capability.

12 people on Wireless network = each person @ 1/4096th (1 / (2 ^ 12)) the network's speed capability.

If you need 12 people on your network at one time, wireless is not the answer. If it's only you and maybe your mum/dad at home, then maybe.

Re:Simple, cheap, easy solution

[Builder]

You have left out too costs, costs for cosmetic retouching where you have run the cable, and cost of asprin to dull the headache from your wife whinging at you non-stop for 3 days about when you're going to be done.

Re:Simple, cheap, easy solution

[Builder]

Too costs? WTF are too costs? I meant TOOL costs obviously :D

Re:Simple, cheap, easy solution

[Anonymous Coward]

Where the hell are you paying $6 each for keystone jacks and $4 for wall plates? Hotel minibar?

Re:Simple, cheap, easy solution

[camperdave]

I got all my prices off of tigerdirect.ca, homedepot.ca, rona.ca, and canadiantire.ca, and rounded them to the nearest dollar (Canadian). You can pay upwards of $9 each for keystone jacks if you don't know where to shop. Having said that, I'm willing to concede that some of the prices may be on the high side, but I think my point's been made. Proper CAT5 installations are not cheap.

Re:Simple, cheap, easy solution

[camperdave]

You have left out tool costs, costs for cosmetic retouching where you have run the cable, and cost of asprin to dull the headache from your wife whinging at you non-stop for 3 days about when you're going to be done.

Yeah. That's what the asterisk after the CAT5 Total cost line was for. I had meant to put a footnote saying that the cost did not include punchdown tools, power drill, drill bits, step ladder, etc but somehow that slipped my mind.

Re:Simple, cheap, easy solution

[Builder]

And flowers. And dinner. Because it's going to cost at least that to make the wife happy again :D

Nice try but...

[MarkByers]

WPA can also be broken, and unlike WEP, you only need to sniff one packet. Tools to crack a WPA key are freely downloadable.

Re:Nice try but...

[AbRASiON]

Perhaps so but if your password is not a standard dictionary word and exceeds around 12 or more digits, it's pretty much secure for life.

Re:Nice try but...

[wolrahnaes]

WPA "cracks" are all just brute force, which you could also do with WEP and any other encryption algorithm. It just takes fucking forever (assuming the user chose a key that was more than just a dictionary word). These WEP attacks are actually flaws in the design of the system which allow you to crack a key many times faster than brute force.

Rainbow tables, dictionaries, and the like are all just variations on brute force. They accelerate the process, but either way you're not actually breaking the encryption but instead using a crapload of processor power to try one key after another until you hit the right one.

Saying WPA is insecure because there is a brute force tool for it is like saying the a lock is insecure because I could go and start trying combinations. 1-1-1....1-1-2....1-1-3.........

Re:Nice try but...

[Magada]

Well if it's a three-digit lock, it IS insecure, buddy. If it's a 4 or 5 digit lock with no try/time limiter and you can hear the pins drop with just a standard-issue bubble mike taped to the door, it IS insecure - because it does not take "practically forever" or "gov't-level resources" to crack, but only a couple minutes.

No cypher is proven unbreakable (with the exception of one-time pads) - all have varying strengths, defined as "it takes $ludicrous_amount_of_time_and_processing_power to retrieve plaintext".
  Get off your hobby horse - implementation matters in the real world.

Re:Nice try but...

[wolrahnaes]

I chose 3 digits because that seems to be the standard on ordinary combination locks that you'd find attached to a toolbox or locker. Of course those aren't unbreakable, but brute forcing one would take much longer than other methods of getting to whatever the lock is protecting, so they're considered sufficient.

Obviously in the case of WPA or WPA2 in PSK mode, if the user chooses some stupid password that's either uselessly short or a dictionary word it can be broken rather quickly, but that doesn't mean the algorithm is flawed. All it means is that the user is an idiot (granted, it should be assumed that users are idiots, but I don't see any real solutions to this problem). WPA2 supports 256 bit keys, so the number of possibilities are a really really big number that I don't feel like typing out. Last time I checked, the WPA brute force tools can test 30-60 keys per second. Even if you could test at one million times that speed, it would take 6.11551377 × 10^58 millenia to check through the entire key space. If every single atom in the planet had that computing power and was actively trying to break your one key, it would still take 20,431,661.7 millenia to cover the entire key space.

For all practical purposes, 256 bit encryption like what WPA2 uses is unbreakable. Flaws in the algorithm and badly chosen keys are the only weaknesses. At this point, there are no known flaws in the algorithm, so a decently secure key (same rules as a good password, make it long and vary the character types) is all you need. For home users just wanting to keep out neighbors and/or wardrivers, it's more than enough. For businesses, making sure the key doesn't get out from loose-lipped users is more important and using WPA2 Enterprise mode where each user has their own login information solves that problem for all intents and purposes.

Hell, in theory, 104 bit WEP should have been more than enough for home users. It was just badly designed and implemented so that a fast reliable crack became possible to develop.

Today on duh news.

[kinglink]

WEP insecure! Coming up at 6PM Bill Gates still really really rich.

Breaking News

[PhunkySchtuff]

Hardly... WEP is known to be thoroughly broken - it doesn't really matter that now it's even more broken than before - the fact remains that it's no good.
WPA has been around for something like 2½ years now, and it is a travesty if the wireless chipset you're using doesn't support it.

The simple solution is continue to use WPA, like you should have been doing for years...

Re:Breaking News

[Anonymous Coward]

But maybe we can get funding for a study to continue breaking it!

Re:Breaking News

[Aqualung812]

Sure, I know I replace all of the computers where I work every 18 months... Trying living in the real world with a budget, pal. 2 1/2 years...seesh!

Securing a wireless router and using the NDS...

[MS-06FZ]

disable wireless security and implement real security, such as a RADIUS login. then set up a firewall rule to allow unauthenticated devices to access nintendo's servers Not too shabby. Question for ya, though: Does all the traffic for those NDS games go through the Nintendo servers, or is it routed straight to the other players? Sending packets directly playerplayer would be faster but it would also make it harder to deal with NAT and firewalls, I suppose...

And can you actually make a wireless router accept both secured and unsecured connections (or WPA and WEP connections) at the same time? So, for instance, the laptops of the house would all use WPA and the NDS would use WEP?

Re:Securing a wireless router and using the NDS...

[weg]

So, for instance, the laptops of the house would all use WPA and the NDS would use WEP?

That wouldn't really increase the overall security of the network. If somebody wanted to break in, he'd just crack the WEP encryption..

Re:Securing a wireless router and using the NDS...

[MS-06FZ]

So, for instance, the laptops of the house would all use WPA and the NDS would use WEP?

That wouldn't really increase the overall security of the network. If somebody wanted to break in, he'd just crack the WEP encryption.. I am aware of that flaw. However, I'm attempting to make the best of a bad situation - a perfect solution is not possible.

The idea is that by having the NDS and only the NDS use WEP, the opportunities for sniffing WEP packets will be limited to those times when someone's accessing the network with an NDS - as opposed to when one of our unwired computers is on (and presumably doing some net activity, either in the foreground or background), which is pretty much all the time. So if someone wanted to break in, they'd need to find out when I play Mario Kart, and do it then. Still quite feasible, but the vast majority of wireless network traffic in the household would not be using WEP, and most of the time there'd just be no WEP traffic to monitor, no WEP packets to request resend of, etc.

And then, also, there's the maintenance issues of that setup: if I monitor the activity over the WEP from time to time and want to update the key or block out WEP for a while, or do something else to shake off freeloaders - only the NDS would be affected. The laptops and such would go on happily using WPA, which is at least reasonably secure.

So, again, my question is not "is this setup secure?", it's "is this setup possible?" Or would the separate control of access methods require a separate set of hardware?

Re:Securing a wireless router and using the NDS...

[AlphaPB]

And can you actually make a wireless router accept both secured and unsecured connections (or WPA and WEP connections) at the same time? So, for instance, the laptops of the house would all use WPA and the NDS would use WEP?

Yes. The v24 beta version of dd-wrt allows multiple SSIDs with different security settings. However, there are some issues with isolating traffic to each SSID using virtual LANs. Besides that, there seem to be some strange issues with the beta versions. That being said, I'm going to try out v24 with a DS tomorrow.

Here's some relevant dd-wrt forum threads:

Create second wireless ssid with different security settings
v24 Virtual SSIDs, Nintendo DS, and AP Isolation

Re:Securing a wireless router and using the NDS...

[Lehk228]

you disable all wireless security and implement your own network login, security and encryption and if you want, use shared secret keys for your own machines so there is no chance of Man in the middle attacks even if someone at the macine does something stupid (such as allowing an unrecognized certificate to be used when it shouldn't be unrecognized)

by trusting your security to any of the wireless standards you are limiting yourself to the capabilities of simple wireless routers and limiting your compatability.

Re:Securing a wireless router and using the NDS...

[nonsequitor]

I believe with openwrt you can put 2 vlans on the wireless interface. On the first vlan you would configure WEP and the second WPA. Thats the nice thing about a linux router, you can set it up however you want.

I don't think you would have much luck using the manufacturer firmware for the project.

Re:Securing a wireless router and using the NDS...

[MS-06FZ]

Yeah, I figured the solution would be from one of the replacement firmwares - before I posted I dug around a bit on the DD-WRT site looking for information on this kind of functionality - I couldn't even find "WEP" when doing a search of their wiki...

Does it matter?

[Anonymous Coward]

WPA-PSK is only slightly more secure than WEP. Best wifi security is to not use it.

Remember, wired is the networkng technology of the future.

Might be bad news for home linux users...

[Medievalist]

Linux wireless support is OK for connecting to large corporate networks with RADIUS and 802.1x with enterprise-class WPA. I routinely do it with Ubuntu, Fedora, and Red Hat linux; it even works with Network Manager. Well, most of the time with Network Manager... Recent versions of Network Manager... And it always works with a painstakingly hand-crafted custom-compiled WPA supplicant, even on Fedora, you just have to bleed some neurons out of your ears figuring it out the first time.

But for home networks, I've only found WEP to work really well. Trying to get "personal" WPA PSK working from a linux laptop to a commercial broadband router like a linksys or FIOS box is brutally painful, even with decades of experience, and if you have Network Manager flailing around hijacking your wifi hardware every few minutes it's even worse. If you wanted a rock-solid, high-bandwidth wireless connection with enough encryption to convince casual wardrivers to use the neighbor's connection instead of yours, you just ran WEP-128 on your dd-wrt box, and happily connected up with Network Manager or iwconfig... but if the next version of the stumbler's going to crack your WEP nearly instantaneously the weak deterrent effect of WEP just went out the window!

Re:Might be bad news for home linux users...

[CatOne]

This is a Linux limitation, not a system limitation. OS X has supported WPA Personal for > 2 years, and WPA 2 Personal for at least 1.5 years on all systems.

Seems if you want a secure system you should stay away from a Linux laptop at home. But that's not really anything new. If you want a system that sleeps/wakes out of the box without tweaks a Mac would work nicely for that as well.

Re:Might be bad news for home linux users...

[matts-reign]

I found it to be incredibly easy to use WPA supplicant on my home network. I simply put the key in, and joined my SSID. 30 seconds on something i'd never done before. I'm sure if I had a desktop env. like KDE running, it would have taken care of things too.

Re:Might be bad news for home linux users...

[ruserious]

Say what? I've been using WPA with PSK since Dapper with the default network-manager packages from the repos. No custom anything. I have an intel ipw2200 in my notebook, and a (branded) zyxel 660hw router. I click on the GUI choose a network, enter my WEP or WPA key, and it just works. It was that way on Dapper, and it's still that way on Edgy.

If you want to work around network-manager in "esoteric" situations (I sometimes have to if there is no DHCP), you can simply

sudo /etc/dbus-1/event.d/25NetworkManager stop
ifconfig.....

And later, when you're done and go back to your home network, you restart network-manager likewise. It's easily scripted.

Re:Might be bad news for home linux users...

[landattack]

I have been using WPA-PSK at home on the *nix machines I have. wpa_supplicant works wonders with the Atheros card and for the Ralink RT2500 I just use iwpriv to setup the interface to use WPA-PSK in /etc/network/interfaces.

Re:Might be bad news for home linux users...

[Anonymous Coward]

Netcraft confirms BSD is dying of AIDS

Re:Might be bad news for home linux users...

[Anonymous Coward]

Some of us don't have time to mess with Linux on machines used in day to day life and like the idea of a laptop that works "out-of-the-box". Don't worry, I'm sure you're going to get better and realize this soon.

Now, I'm going to close my iBook and go have sex with my hot girlfriend.

Re:Might be bad news for home linux users...

[Anonymous Coward]

Real Mac users don't use Macs for the image. Real Mac users didn't just buy their Macs last week at Hot Topic. We've been here on the Mac platform since 1984 and believe me, we hate the recent influx of switcheurs almost as much as we don't give a damn about PC users.

Re:Might be bad news for home linux users...

[Anonymous Coward]

Seems if you want a secure system you should stay away from a Linux laptop at home. But that's not really anything new. If you want a system that sleeps/wakes out of the box without tweaks a Mac would work nicely for that as well. WTF does that have to do with wireless support? While on the topic of wireless and security, read this...

Re:Might be bad news for home linux users...

[CatOne]

Ah, yeah, hacked with a 3rd party driver. Never seen THAT one before.

Re:Might be bad news for home linux users...

[watermel0n]

I use WPA2-PSK AES on Linux (OpenSuSE 10.2) and it works perfectly. I had to play with the wireless card a little bit but after I found a working driver it was easy to configure it to use WPA2. My laptop uses ndiswrapper but one of my desktop systems has a native driver for the wireless card.

Nintendo DS can do WPA (apparently)

[SonnyJimATC]

There's someone working on a firmware patch (or some such), but it looks dubious to me and also requires a specific flashcart: http://geekboy.ca/wifi/?cat=2/ Also it's probably possible for DSLinux (http://www.dslinux.org/) to support WPA and wpa_supplicant has been ported but it requires some more work on the driver before it'll function properly. Trouble is none of the current dev's are really au fait with WPA, so any help is gratefully accepted.

If you can only use WEP, then VPN or SSH tunnel

[speculatrix]

If you have no choice but to use WEP, then you should strongly consider using a VPN between clients and the connected network!

In a corporate environment where it's hard to control who knows the passwords, do NOT bridge the wireless network to your secure cabled network but put it on a DMZ and allow limited services out to the internet, and even fewer into the corporate wired lan.

Re:If you can only use WEP, then VPN or SSH tunnel

[ardor]

In theory, VPN is a good idea.
But setting up one is one of the most difficult things known to man.

Re:If you can only use WEP, then VPN or SSH tunnel

[Knara]

And isn't an option with many embedded devices.

Re:If you can only use WEP, then VPN or SSH tunnel

[speculatrix]

[smug git mode] ssh tunnelling works just fine with my Sharp Zaurus [/smug git mode]

Re:If you can only use WEP, then VPN or SSH tunnel

[onemorechip]

Especially cross-platform, between Windows and Linux boxes, for example. The best documentation I could find on this topic was here. But there will certainly be questions beyond what's covered there (Use L2TP? I chose not to. Firewall configuration? For Linux 2.6.x, you need to set up iptables to accept and mark incoming ESP packets, so that the decrypted packet will be accepted after Openswan routes it back through the firewall.) Tricky stuff.

Once I set it up for Windows and Linux, though, adding a Macbook to the network was a piece of cake by comparison, although OS X uses Racoon instead of Openswan, so I had to do even more research, and write a custom startup script.

Corporate Greed

[Lead Butthead]

My understanding is that it should be easy enough to implement WPA on older (.11a/b) hardware, but companies much rather sell end user new hardware (.11g etc.) than spending development time to upgrade old hardware (that does not generate additional revenue.) This is evident in that Apple's old AirPort (.11b) does support WPA but other venders' (that would include YOU, Linksys) old .11a/b products do not.

Re:Corporate Greed

[Anti_Climax]

Prism Based 802.11b adapters (sold under Lucent, Orinoco, Conexant, 2wire, Dell, ZCom and several other names) support WPA with a proper driver. I'm not sure if it's the full AES WPA or if it's just TKIP. TKIP may be subject to a similar attack as mentioned by a previous poster. It is my understanding that unless the adapter was built with a fair amount of extra capability, WPA AES is not an option.

Re:Corporate Greed

[poopdeville]

TKIP may be subject to a similar attack as mentioned by a previous poster.

It is in principle, but not in practice. Think of WPA TKIP as a strengthened WEP. They both even use the same encryption schemes. But the vulnerability that affects WEP isn't present in WPA TKIP because TKIP is designed to change keys every 10,000 or so packets. Since you need about two orders of magnitude as many unique IV's to crack this encryption scheme in a reasonable amount of time, you're safe.

10 minutes, 1 minute... no big deal

[geekinaseat]

This isn't really news. It's pretty smart that they have managed to crack WEP with so few IVs (it usually takes about 200,000 for 64bit and just under a million for 128bit) but in reality this doesn't change (or expose) WEPs inherent vuneribilities at all, for example I am currently doing my dissertation on wireless security and in tests WEP64 on average can be cracked in about 3 minutes and WEP128 in about 10 minutes so getting this down to a minute doesn't really change the fact that a hacker could capture enough packets simply by hanging around and drinking a coffee using the "old" tools.

An interesting sidenote is that the amount of time a hacker needs to be near a target WLAN for WPA-PSK is measured in seconds making it much more insecure if it has a weak passphrase than WEP is even now with crack times under a minute.

Please if you want a secure home wireless network choose WPA-PSK and make the passphrase as long and as abstract as possible, nothing else is safe -and if you have the cash... buy a radius server

Re:10 minutes, 1 minute... no big deal

[geekinaseat]

Oh and by the way WPA2 is just as vunerable with a weak key.

Use "password" as you passphrase and you will have me "in your garden stealin ur passwordz"

and you would deserve it

Re:10 minutes, 1 minute... no big deal

[Sancho]

I imagine that those 9 minutes are important to a person who is trying to be sneaky. Sitting in a parking lot with your laptop is fairly conspicuous. Assuming you just want quick access (and aren't trying to do something like download large media torrents from someone else's connection), 10 minutes may actually dwarf the amount of time you actually need to be online.

If you're cracking from your house or from somewhere where it isn't suspicious for you to have your laptop sitting out for 10 minutes, maybe it's not as big a deal, but that's still 9 minutes you COULD have been doing something useful.

Re:10 minutes, 1 minute... no big deal

[Rick17JJ]

For my computers at home, I used the "Perfect Password Generator" that is on the grc.com web page to generate the longest most random possible WPA password. Each time I visit that web page a different a password is generated. I then placed the password on a USB key and transfered the password to both of my computers and the wireless router. I then cut and pasted the password instead of trying to type the huge password. For the extra paranoid, slicing and dicing and mixing up the long password that is generated could also done as an extra precaution, although the password did come from a secure website at a security oriented web page.

Perfect Passwords

Re:10 minutes, 1 minute... no big deal

[e_tews]

Sorry, but this is really a new attack which doesn't need a million IVs anymore for 128 bit wep. Instead a number of 40,000 to 60,000 is most times sufficient to calculate the secret key.

Re:10 minutes, 1 minute... no big deal

[Anonymous Coward]

Sitting in a parking lot with your laptop is fairly conspicuous.

No it isn't.

Re:10 minutes, 1 minute... no big deal

[dfgchgfxrjtdhgh.jjhv]

http://grcsucks.com/

Re:10 minutes, 1 minute... no big deal

[evilviper]

getting this down to a minute doesn't really change the fact that a hacker could capture enough packets simply by hanging around and drinking a coffee using the "old" tools.

Yes, yes it does.

Many vendors, from the very first sign of WEP's weakness ~7 years ago, worked-around this by having their APs change the key every X minutes to negate the possibility of anyone gaining access. Any faster method, which potentially allows someone to sneak in before the key change, makes this common workaround moot, and WEP completely and totally unworkable.

Re:10 minutes, 1 minute... no big deal

[geekinaseat]

True, certain circumstances a hacker will want to crack the WEP key there and then and instantly perform whatever devious tricks he has planned. Often however the attack can be done in three parts:

1. Packet sniffing: Where the hacker would have a wireless packet sniffer such as airodump or kismet on his PDA safely out of site in his pocket.. or in the old days when it used to take a lot longer.. in a baggie dropped in a nearby bush for collection a day or so later.
2. Take said PDA home... run aircrack and get the key
3. Return ready with nasty tricks and your laptop all set up with the correct key to become authenticated on the target WLAN

I know this method fails when dynamic WEP keys are used but it is still an example of how a wireless network can be hacked with very little suspicion -whether it takes 10 minutes or 1 minute.

Re:10 minutes, 1 minute... no big deal

[geekinaseat]

True, dynamically changing keys could really make cracking a WEP key very dependant on speed for an attack to be successful. But the I suppose that depends on how long the hacker needs to be connected (and the time interval of the key change). I'd still argue that 99.9% of WLANS implementing WEP are still just as vunerable as they were before this new attack was released.

The most obvoius solution.

[Randseed]

The most obvious solution is to have each machine that connects over wireless use a VPN. Everything coming in over anything other than the VPN is discarded.

Since this is Slashdot, I request a community service: Come up with a script/whatever where this is simple.

Re:The most obvoius solution.

[Brandybuck]

I am in the situation where I have to use WEP. I would love to use VPN, but I have no idea how. What little networking knowledge I possess tells me that the other side of the connection has to be using VPN as well. If I can't run a dedicated VPN proxy server, then how the heck do I use VPN? How do I use VPN to get my email? Checkin code to SVN servers? Talk with boss over IM? Read Slashdot on my lunch break?

I'm missing a key part of the puzzle here...

Re:The most obvoius solution.

[Anonymous Coward]

An easy way to do this is on your router, with OpenWRT or equivilant. You can run OpenVPN on there, and have iptables drop any packets not sent to the router's WAN jack or VPN port, or by the router itself. It's a geeky thing to do, and you have to know what you're doing, but that's how I would do it...

Re:The most obvoius solution.

[AnyoneEB]

He means a VPN between your laptop/other wireless clients and the router/wired section of your network. That way everything wireless is encrypted, but the VPN stays within your local network. It does seem a bit ridiculous to use a VPN at that range, but it does seem to be a pretty good way to handle the wireless encryption problem.

April fools still?

[Anonymous Coward]

Can anyone confirm any of this? I find it interesting that while the paper was published today, it was received on April 1st.

See: http://eprint.iacr.org/2007/120

Re:April fools still?

[e_tews]

It is not an april fool. It is correct that the paper was Submitted on April 1., and later updated on April 3.. If you still think this is an april fool, you can download and run the tool on some captured data, and see how it works.

Another way to do the same thing

[jd]

If the cards don't do WPA, then cheat. Most wireless-capable routers that don't support WPA -do- support IPSec, as do most laptops and other portable devices. Sure, you're not doing hardware encryption then, but the speed of most modern processors vastly outpaces most wireless connections - you can afford the cycles on an IPSec tunnel to the router. In theory, this is better than WPA, as IPSec is a more mature standard with a lot more people looking at the design.

Re:Another way to do the same thing

[cheater512]

Great idea!

Uh....How do I do that on my PDA with a 415mhz processor?

Need a new laptop card

[Windcatcher]

The built-in wireless card in my laptop is the only thing keeping me tied to WEP (my Palm uses BT so that's not an issue there). It's one of those weird combo mini-PCI cards that also drives the dial-up modem (HP zt1100 series laptop). If I could find a combo card that supported wireless G and WPA I'd upgrade in a heartbeat. I've searched the net for one, but it seems like mini-PCI cards are in this amorphous, murky world where it's impossible to locate manufacturers and specs.

Oh yes, its "simply" an "easily scripted" task!

[Medievalist]

That is indeed what I do as soon as I run into anything "esoteric" (that is, anything that a mac or windows PC can handle effortlessly but which chokes my linux machines HARD).

I just drop to a command line, superuser myself (sudo is too much typing, so I re-enable su on my unbuntu boxen and macs, it's pretty easy), kill network manager, iwlist to get the network, cut and paste the fiddly bits into an iwconfig line, swear repeatedly because each wireless driver has idiosyncrasies that need pampering (try using a hex key that looks like an alpha key - BEADFEEDBEADFEEDFEEDBEADBF for example - some drivers will let you use a special 0x prefix, others just don't seem to be able to cope), use bash command line editing to fix as appropriate to the particular hardware I'm using, then bring up a DHCP client (of course, I have to figure out which client this distribution uses since they have totally different command line syntax) to get the interface useable, and then go back into X where I can use a browser.

Sure, it's simple. My dad, an octogenarian rocket scientist (retired), can do it in less than a week if he also has a windows PC handy so that he can look up things in Google! I can do it myself in mere minutes! And using su for this instead of sudo has the side effect of not leaving WPA keys in the history of an unprivileged account, incidentally.

But you know, it's really annoying to watch the people around me just click and go with their Windows and Mac laptops. I guess nobody should use a linux computer wirelessly unless they not only have leet skillz, but also lots of time to spend typing things and memorizing connectivity tricks? Why are we bothering with GUIs, then? Linux wireless works perfectly in some subset of configurations (that happily includes most corporate and Starbucks-type rigs) but, in my personal experience, does not come close to mac or windows wireless.

Ever try to connect to an Intel Pro-Wireless 802.11a AP with linux on a Dell laptop? Turn off Network Manager and prepare to spend some time dicking around. In windows, it's a couple of clicks and type the key... done.

Conduit

[xquercus]

The only real conduit one needs in a house are a crawlspace and an attic.

Re:Conduit

[Belial6]

Wrong. You need a conduit that goes from the attic, down the wall to where a data jack should come out. This should have a face plate on it, so that the home owner can find it.

Re:Conduit

[adolf]

Having rewired my share of ancient wood frame American homes, I'd like to assert that there is no need: It is generally quite possible, and often rather easy, to run all manner of cabling inside of the walls of an existing home without using any conduit at all.

Oh, sure - it's convenient to have thoughtfully-placed, vacant, large-diameter conduit running all over the place like some byzantine aqueduct, but it's also terrifyingly expensive to install.

And since it's not needed, most folks just don't do it. Feel free to build your own house however you see fit, but mine will have dual RG-6 coax and three Cat5e (or maybe Cat6) to each room, and maybe 70V speaker lines to some common areas, all home-run to patch panels as appropriate, and none of it will be in conduit unless required by local code.

This cabling topology will survive just fine until the next infrastructure shift happens, which doesn't appear to be any time soon. And when it does happen, it'll be easy (trivial, in most sensibly-designed structures) to add whatever is needed.

Re:Conduit

[COMON$]

Oh come on, mod this guy up!

A: Friggin hilarious

B:He is right

C:Get of your lazy asses and realize back in our day when we were wiring all your High Schools, we used fiberglass insulation for toilet paper and we liked it!

Re:Conduit

[COMON$]

Or you could run http://rapidrun.com/ and be ok until you push too much juice down the line.

Re:Conduit

[adolf]

No.

RapidRun is a cabling system designed to primarily to cost extra. For the applications I listed, it sucks ass, adding expense and mess (cables are no longer neatly cut to length at a patch panel, but instead must have coiled slack hidden somewhere, plus I get to pay a flunky and his marketing department to do the terminations for me instead of just doing it myself).

It looks marginally useful for running VGA signals through conduit, but that's literally all it's good for. And since I'm all about NOT USING FUCKING CONDUIT, then I guess that wouldn't apply to me, either.

It is plain to me that you are unfamiliar with both the problems and the solutions. Naff off.

Re:Conduit

[xquercus]

In particular, when working from a crawl space, interior framed walls have a natural conduit -- in between the studs. New construction is going to have horizontal fire stops but they are a minor issue and only a concern when dropping in from above. When it comes time to replace old wiring with the newest latest and greatest, use the old wiring as a pull string. Vinyl tape makes replacing tapes simple.

Conduit is too restrictive. If conduit were available in my house, I would only use it when it was convenient anyway. With CAT5, coax for the cable modem, and RG8, RG8x, LMR400, Belden 9913, and one short run of 3/4" copper grounding braid (for amateur radio) running through the house, a spade bit and a DeWalt drill are much handier. Everything can be run exactly where it needs to be run and not just where conduit happened to be installed years ago.

Re:Conduit

[FunkyELF]

I've wired 3 houses before and this is somewhat true.
You start running into problems when the wall you want the jack on has insulation in it or it is at the edge of a vaulted ceiling.

Re:Conduit

[CheeseTroll]

A little practice with fish tape doesn't hurt, either.

Wiring my 108-year-old house with Cat5 was pretty simple, BUT:
1. Forget about pulling anything up through exterior walls, thanks to the insulation. My house also has an extra-thick foundation that gets in the way, but I doubt that's a common problem.

2. I know plenty of people with new homes where adding wiring is a PITA simply because their basements are finished off. Bye-bye easy access to the joists and wall cavities on the upper floor.

Re:Conduit

[Abcd1234]

Or if you want to traverse floors in old homes with firebreaks.

Re:Conduit

[COMON$]

Yikes man, un-bunch the panties.

First, was just a suggestion. Second, You don't need conduit. Third, I have not run it myself just breezed by it one day when considering wiring options, but it seems that if one wanted to they could create a custom patch panel for the material.

Personally I am looking for something similar, I do agree that right now the specs arent that great. I don't mind running cable through walls. But if I could run one cable rather than 3 that would be a plus for me. I wouldn't say a company would design a product with the primary purpose of making it more expensive either.

So in short, before you jerk the knee next time, think that maybe just maybe someone might have been making a suggestion and not attacking your honor.

Re:Conduit

[ivan256]

It's easier to fish wire between the empty space between studs from above or below than it is to pull wire through a conduit. This is true even if the walls are filled with insulation (though it's slightly obnoxious if the insulation is poly-foam). If you have dead space either above or below any floor you're all set and don't need any conduit.

Blank face plates are ugly. I'd rather have plaster I can cut through if I need to than an ugly, dust collecting face plate I may never use. Additionally, the conduit is only useful if it goes where you want it to. If you're running the wire in the walls you can have it go anywhere.

Re:Conduit

[adolf]

I gave up on honor years ago.

It's not a knee-jerk response, it's just the only valid thing I could come up with as a retort for the suggestion of such an atrociously bad wiring system.

It is not suitable for nice-and-neat installations, as the cables are all PRE TERMINATED AND OF FIXED LENGTH. Proper, neat-and-tidy cabling installations do NOT involve bundles of coiled slack at ALL. But RapidRun, with its pre-terminated cables, requires it. So the cables will (hopefully!) all be ordered at least dozen feet too long, and all that extra wire will need to go somewhere, and that somewhere will be a messy clusterfuck. (In a conventional patch panel installation, cable lengths are customized and precise, cut-to-fit on a wire-by-wire basis, and can be the antithesis of a clusterfuck.)

It is this pre-terminated nature which also makes it impossible to use with patch panels. Sure, one could always cut the connectors off and fuck around with attaching their cabling to patch panels, but then one could always avoid the product to begin with. I mean: It's those connectors which solely differentiate RapidRun as a unique product. To remove them would be to piss even more money into the wind and ruin the singular advantage that the product claims to offer.

Furthermore, those connectors are not impedance-patched, and there are two of them per run. This makes for measurably lousy performance compared proper connectors designed for the specific task at hand.

I said it before, here it is again: It looks like a decent system for pulling VGA cables through conduit, but that's about it.

Fact is, it's rather easy to install RJ-45 connectors onto Cat5. It is also fairly trivial to install F, RCA, or BNC connectors onto RG-6 coax using a compression tool. And by using generic, commoditized cabling and connectors instead of RapidRun, material expenses drop by an order of magnitude. Labor does goes up a bit with generic cabling, but due to terminations more so than multiple parallel runs (which can usually all be pulled at the same time). And the end result is a better-performing, better-looking, more flexible solution which, I dare say, costs less.

In conclusion: If you still think you're not a complete fuckhead for suggesting RapidRun, then let's just forget all about new-fangled cabling for a second. Imagine you're building a new house. And imagine that your plumber is using flexible pipes (like PEX, say). Imagine that these pipes only come in even increments of 25 feet, and that the length cannot be modified. And that, somewhere in your basement, there's a particularly frightening corner where all the extra length of plumbing lives, coiled up with zip-ties. And that every now and then, it drips a little bit, but you're not really sure where or why...

Now imagine that you paid extra for this.

Still not convinced?

Imagine that your electrician did the same thing instead of pulling Romex or BX and cutting to proper length, leaving huge loops of high-voltage cabling in various places. Imagine that the HVAC installer would use pre-terminated flexible duct to save time, and just leave the excess hang around sucking up furnace efficiency.

All of these situations are, of course, insane, unacceptable, and unrealistic. So why should anyone accept such a lousy and lazy installation technique when it comes to networking and AV cabling?

Re:Conduit

[COMON$]

I gave up on honor years ago.

LOL, you a sys admin somewhere?

Hmmm,you make interesting points, unnecessarily aggressive but interesting nonetheless. Then again your ID is 'adolf' so what should I expect. I was under the impression with rapid run (once again just reviewed the website) that there was a generic module on the end to swap out connectors. So as long as you stayed in Spec that you would be OK. I personally like to terminate things myself, use a crimper, run cat-5 and whatnot. Recently have been running into troubles with home theater systems and the sheer number of cables running to and from point a to B. makes an awful mess. So it just looked like an interesting concept that would solve a set of issues. Thanks for your input, it is noted. I will work on changing my username to fuckhead but I think that I already saw that name around here somewhere :)

Got a little carried away, eh?

[ruserious]

> That is indeed what I do as soon as I run into anything "esoteric" (that is, anything > that a mac or windows PC can handle effortlessly but which chokes my linux machines > HARD). Effortlessly? Like I said the only cases for me are when DHCP is off, which I don't see often - and how effortless can your "octogenarian rocket scientist" dad configure Windows or Mac for static IP with custom Gateway, custom DNS-Server? Yeah, that's what I thought. But I do get your point. Of course those cases should be solvable in the GUI as well, and from what I hear that's where things are going (yes, yes, linux is lagging behind in this regard). But my comment was in response to claims that "it doesn't work at all" and "network-manager keeps preventing me from doing this and that". I never claimed this was newbie-proof solution. Or that it shouldn't be improved upon. > Linux wireless works perfectly in some subset of configurations (that happily > includes most corporate and Starbucks-type rigs) but, in my personal experience, does > not come close to mac or windows wireless. Ack. (Though, I admit I did enjoy reading your over the top comment. ;))

Broken Even Worse?!

[Seumas]

Slashdot editors suck at grammar. Obviously, the words they were looking for was supposed to be more brokener.

Re:Broken Even Worse?!

[onemorechip]

Q: How much more broken can it be? A: None. None more broken.

Nope. It's the combination of ARC4 and WEP

[Joce640k]

Either one on it's own can be secure. It's the combination of ARC4 and WEP that makes this bad.

Doest it matter?

[nurb432]

For the most part who cares? So somone piggybacks on you.. Is that really such a big deal?

Either you are at home and are sharing some internet with a neighbor by accdient, or you are a company that has everything else locked down enough it doesn't matter anyway.

if you have to be *really* secure you dont use wireless in the first place.

Re:Doest it matter?

[Shados]

It kindda matters... Many, many places have all or most broadband ISPs metering bandwidth and charging when you go over your limit (like cellphone plans), someone could use your connection as a file server and have the RIAA knock at your door (you'd most likely get off without a scratch, but its still a pain even if you're found innocent), they can slow down the hell out of you by running 5 bit torrents, or worse, use your local network (most people have better things to do than protecting themselves against people on the local network, but this kindda kills it).

It is kind of a big deal. The worse part is the false sense of security: most people see that their router is "secured" and think its safe and good.

Re:Doest it matter?

[nurb432]

I operate under the assumption that my network is never secure, so i have to protect my data in other ways.

Also, I don't get charged for bandwidth at home and dont mind sharing.

Can someone verify this for me?

[Anonymous Coward]

If I'm running on an unencrypted wireless network, but the little lock-symbol appears on my browser, then even if someone is listening in, they can't recover any passwords/cc-numbers I enter into web-sites, correct?

Encrypted disks Was:Back in the courtroom

[Ecks]

Encrypted disks will be found, and now it's up to a judge to choose between your excuse why you can't show the court whats in it, and the FUD the procecuter will throw out.

Why does the existance of an encrypted disk allow the Judge/Jury to presume that you are guilty? I think that an encrypted disk tells them nothing. Assuming one: that you are using something decent like CFS or TrueCrypt and two: that you're smart enough to use it for all of your illicit material you've completely denied the prosecutor any evidence that you committed a crime.

prosecutor to computer expert:You can see from these log entries that the defendant made use of the Bittorrent program on his computer on these occasions....

defense to computer expert:did you find any illicit files on the defendant's computer.... No. Are there any legitimate uses of the Bittorrent network say for example to download the Linux operating system from the Fedora Project?

Re:Encrypted disks Was:Back in the courtroom

[dotgain]

Why does the existance of an encrypted disk allow the Judge/Jury to presume that you are guilty? I think that an encrypted disk tells them nothing.

Nobody said the encrypted disk is a presumption of guilt. It's just that it in most courts, you either turn over the keys to allow the encrypted volume to be investigated, or be presumed guilty. This is likely what the OP meant by "your excuse why you can't show the court whats in it". If the defendant handed over the keys then the entire purpose of the encrypted FS would be defeated. If he refused to he'd be presumed guilty. Basically all he could say is "My dog ate it."

Re:Encrypted disks Was:Back in the courtroom

[ColaMan]

A truecrypt volume allows you to have two layers, each one accessible via different passwords.

So, you give The Man the password to your tax return spreadsheet, letters to friends, etc.

Re:Encrypted disks Was:Back in the courtroom

[Mr2001]

If the defendant handed over the keys then the entire purpose of the encrypted FS would be defeated. Not if he's using a good encryption system. TrueCrypt, for example, lets you create hidden subvolumes, which can't even be detected unless you know the password. Situations like this, where someone notices that you have an encrypted partition and forces you to turn over the key, are exactly what that feature was designed for.

You give them the main key, and they find a partition containing some porn, financial records, or whatever. The partition size is correct; they can read every sector of it. The free space will appear to be filled with random bytes, but that's a standard feature of TrueCrypt whenever it creates a new volume. Meanwhile, your real secret data is hiding right under their noses - those random bytes are actually encrypted data, but without the key, no one can tell the difference.

Re:Encrypted disks Was:Back in the courtroom

[dpilot]

Dang it! Now you've let the secret out.

Really, this is security by obscurity, and as fast as people keep touting the "TrueCrypt 2-layer" advantage forensics experts will develop techniques to identify and locate "missing space" on a drive and start requesting the second key - in court. If you really want to hide the stuff, use steganography, not a hidden volume.

Re:Encrypted disks Was:Back in the courtroom

[ColaMan]

Good luck to them.

I'm not an encryption/stenography expert, so I have to trust others. But reading the description of TrueCrypt's hidden volume indicates that it's pretty hard to tell if anything's there without the key.

Free/slack space calculations are not an issue - the main volume will happily trash the hidden one if you overfill it. You can prevent this only if you know the passwords to both volumes.

Re:Encrypted disks Was:Back in the courtroom

[Anonymous Coward]

How does that free space thing actually work? If you tried to completely fill the "free space" would it error before the space was full or would it overwrite the hidden encrypted data?

Re:Encrypted disks Was:Back in the courtroom

[Mr2001]

How does that free space thing actually work? If you tried to completely fill the "free space" would it error before the space was full or would it overwrite the hidden encrypted data? If you mounted the volume using only the main password, TrueCrypt would be unaware that there's a hidden volume, and it'd happily let you overwrite the hidden encrypted data. So if you turn over the main key to someone, they won't be able to read or detect your hidden data, but they will be able to destroy it - either accidentally or intentionally, based on the (unprovable) suspicion that you might have a hidden volume.

Optionally, you can mount it using both passwords, and in that case it'll recognize the hidden volume and prevent that space from being overwritten. You'd get a device-level write error when you tried to write to the end of the main volume.

Re:Encrypted disks Was:Back in the courtroom

[Anonymous Coward]

Thanks.

Re:Encrypted disks Was:Back in the courtroom

[Mr2001]

If you really want to hide the stuff, use steganography, not a hidden volume. Hidden volumes are steganography, and there is no "missing space". From Wikipedia's article:

Concealing data within encrypted data. The data to be concealed is first encrypted before being used to overwrite part of a much larger block of encrypted data. This technique works most effectively where the decrypted version of data being overwritten has no special meaning or use: some cryptosystems, especially those designed for filesystems, add random looking padding bytes at the end of a ciphertext so that its size can't be used to figure out what size the plaintext was. Examples of software that use this technique include FreeOTFE and TrueCrypt. AFAIK there are only three ways to detect the presence of a hidden volume:

1. Covertly make a copy of the encrypted drive, then come back after a few days, force the owner to give up the main key, and check whether the contents of the free space have changed during that time. If some part was filled with random bytes before, and it's different now but still random, you can conclude that there's a hidden partition in that space. However, this only works if the hidden volume has been modified during that time, and this attack can be defeated by patching TrueCrypt to periodically fill randomly selected parts of every mounted volume's free space with new random data.
   
2. Come up with a way to distinguish the output of TrueCrypt's RNG from the ciphertext produced by the various encryption algorithms it uses. Good luck! Even if you manage to do that, this attack can still be defeated by patching TrueCrypt to encrypt the random data it uses to initialize new volumes (if it doesn't already).
   
3. Brute force the hidden volume's key. This is your best bet.
   

Re:In Russian ...

[Anonymous Coward]

I'm collecting 7 beacons per second, it's aprox. 3 valid IVs each 10 seconds.
I need many days and months to collect 800,000 IVs!!! It's bad milk!!!

I want to speedup it, i want inject 50,000 packets/s to receive 50,000 beacons/s
but the device can't inject packets. I hate to obtain 7 beacons/s.

Why? Why? Why of this awful cracking? :P

Many sites are WPA2 and no WEP. I'm hating it a lot.

My ultimate action is to go to my car with my laptop and drive randomly for hijacking.
I'm sure that there are many WEP ESSIDs. I'm a suicide hijacker.

Re:In Russian ...

[qbwiz]

No, you're doing it all wrong, this is a glider:

oxo
oox
xxx

I'm not sure what yours was.

Re:Can someone verify this for me? https

[Anonymous Coward]

correct.
but also look at URL to see that it is https and not http

if it says http (Bank of America for example) then it is not secure despite what bank of america claims on its lie filled site.

only trust https

Mac Filtering !

[up2ng]

Enough already, just use mac filtering and only let in what is needed.

Re:Mac Filtering !

[Anonymous Coward]

From Wireless LAN security hall of shame:

"MAC filtering: This is like handing a security guard a pad of paper with a list of names. Then when someone comes up to the door and wants entry, the security guard looks at the person's name tag and compares it to his list of names and determines whether to open the door or not. Do you see a problem here? All someone needs to do is watch an authorized person go in and forge a name tag with that person's name. The comparison to a wireless LAN here is that the name tag is the MAC address. The MAC address is just a 12 digit long HEX number that can be viewed in clear text with a sniffer. A sniffer to a hacker is like a hammer to a carpenter except the sniffer is free. Once the MAC address is seen in the clear, it takes about 10 seconds to cut-paste a legitimate MAC address in to the wireless Ethernet adapter settings and the whole scheme is defeated. MAC filtering is absolutely worthless since it is one of the easiest schemes to attack. The shocking thing is that so many large organizations still waste the time to implement these things. The bottom line is, MAC filtering takes the most effort to manage with zero ROI (return on investment) in terms of security gain."

Re:Mac Filtering !

[Anonymous Coward]

I can't use Mac filtering, you insensitive clod! I run Mac OS X! Just shows how insensitive you Windows users are, filtering everyone else out...

Re:Can someone verify this for me? https

[kiddygrinder]

Actually you can still do a man in the middle attack but i think it's pretty obvious, ie a popup warns you that the cert is from an untrusted party or something.

Re:In Russian ...

[renegadesx]

You cant break WEP in Russia, in Russia WEP breaks YOU

Easily spoofed.

[codergeek42]

This will help, sure, and be quite a detriment (since hackers will then need to figure out one more detail before being able to own your wireless network); but the fact remains that thanks to things like macchanger and other utilities, a MAC address can be very easily spoofed.

Plus, once an attacker has enough packets, he or she can divulge the necessary MAC address from those packet headers, so it's not really as great an aide as many claim...

Encryption, like DRM,

[cadeon]

Is dead.

With our current MO towards encryption, there is always a way to break it- it's just a matter of computing power, and that's a metric that's ever-increasing. It's no longer sufficent to think a method is strong simply because of the amount of power it takes to break it- because that power will be available to the public next week.

We need to rethink encryption as a whole, or rethink what information we transmit electronically.

Nintendo DS is a security problem

[lanner]

As others have mentioned, the Nintendo DS only supports WEP, and that is a serious problem. Mostly, it's serious because most consumer wireless access points will only support a single type of encryption at a time.

I have two physical WAPs, one just for DS, and one for everything else. It's a problem. Nintedo needs to take some flack before they are going to realize that they screwed up.

There probably isn't anything that can be done to fix their product.

Wifi Security in home without WEP

[Anonymous Coward]

Encryption is only one of the keys to home wifi security.

Encryption can be cracked but if the leecher does not get a signal, (s)he can not get any packets to decrypt:

Limit the power of the signal so it does not go far beyond the walls of your home.

P.S. Mod this AC insightful

hmm.

[weierstrass]

you are actually right, there are 35.27 oz in a kilo.
but where i come from it's as if there were 36.
why?
because 9 ounces is a 'nine bar', and a 9 bar is quarter of a kilo.
it's the point at which you start to get 'wholesale' prices (for weed) and also the changeover from imperial to metric.
the discrepancy may be partly explained by the fact that an ounce of weed is usually exactly 28 grams.
all this in the uk, where our measurements are fucked up anyway, half the country use imperial and the other half metric (for non-drugs related measurements).

Re:hmm.

[paganizer]

Really? the discounts used to start at 1/4 lb , or 4 oz in the old St. Louis area markets. Not MUCH of a discount, granted. You had to hit the 1 lb / 16 oz mark for that.
Never heard of a 9 bar; a older friend of mine used to talk about "lids" without thinking it was funny.
um. this is all hypothetical. or parody. or something like that.

Meanwhile, back in the real world...

[Grashnak]

Most people who actually bother to secure their wireless use WEP as a very basic precaution. They aren't really concerned that someone is going to spend time trying to break into their system, they're just discouraging casual visitors. If someone really really wants to break into my extremely boring home network, I'm sure they could, but they're more likely to use the two unsecured networks I can detect from my living room. Frankly, its just not worth the effort for me to go to extremes to protect my network when the likelihood of a real attack is so small.

Live CD

[nonos]

Any Linux live CD distribution wich uses this new method released ?

Yeah, I do that...

[Medievalist]

Seriously, Dad uses an old iMac to keep his books, a windoze XP box the IRS provides him with gratis (he volunteers at the senior center to help old folks who can't figure out their taxes) and the Ubuntu box I built for him to get his email. He has no problems operating any of these systems despite his age and physical infirmities; he's a pretty smart guy.

I've seen him use his windows laptop to connect to an encrypted wireless network. He's had no training with RF since he was a radio repairman in the Korean War, doesn't know 802.11 from a V8, but he just waltzed right in there, nobody had to do anything but tell him the key. I eventually gave up trying to connect to the same network with one of my linux laptops after a half hour and rebooted into windows... and I got right in too! Since I am much more familiar with linux than I am with windows, this was frustrating and annoying.

Anyway, I'm glad you enjoyed the rant.

Thanks for the info - what distrib?

[Medievalist]

Do you use a packaged distribution, or do you custom-compile your drivers and/or kernel?

Thanks for the info!

[Medievalist]

Do you have any problems with OpenSuSE stepping on your drivers during routine updates, or does everything survive OK? Are you using 802.1x by any chance?

I haven't used SuSE for several years. Maybe I should revisit! I've been pretty dissatisfied with Fedora, so I'm running Ubuntu a lot these days.

Re:Thanks for the info!

[watermel0n]

I use SuSE since version 6.2. I rally satisfied with it. My machines are little bit old so all the hardware supported by the default install except the nvidia video card. There is a YAST repository for nVidia drivers and it updated without problem. None of the updates messed up anything.
I never tried using 802.1x.