Slashdot Mirror
Researchers Crack WPA Wi-Fi Encryption
narramissic writes "Researchers Erik Tews and Martin Beck 'have just opened the box on a whole new hacker playground, says Dragos Ruiu, organizer of the PacSec conference. At the conference, Tews will show how he was able to partially crack WPA encryption in order to read data being sent from a router to a laptop. To do this, Tews and Beck found a way to break the Temporal Key Integrity Protocol (TKIP) key, used by WPA, in a relatively short amount of time: 12 to 15 minutes. They have not, however, managed to crack the encryption keys used to secure data that goes from the PC to the router in this particular attack. 'Its just the starting point,' said Ruiu."
Cat5
All your AP are belong to us.
You have no chance to survive make your time.
What's up with the 'story' tag? Perhaps we should also tag this 'words'?
Is AES not the more secure of the two? From everything I have read, AES is the preffered option over TKIP.
I use WEP!
[FUCK BETA]
OMG! We need routers w/ better encryption. Buy router company and encryption company stocks! Everyone run out to Best Buy and get a new router.
Or, it just might be a real problem. /crumples tinfoil hat and pouts.
Just WPA. WEP was already hideously broken but now WPA should also be considered broken. WPA2 is still safe.
Although, if you really have data you're concerned about keeping safe, you should (a) use a wired network, (b) use IPSEC, or (c) both.
People are never as simple as their stereotypes. This applies equally to Christians, Muslims, and Emacs-lovers.
or is anything worth protecting worth using CAT5 on?
Most banks and government institutions don't use WIFI because of the security vulnerabilities. Granted CAT5 doesn't have have security to access (like wifi tkip/aes key), but it is physically secure, which is at the same level of security as the physical machines themselves.
I find WIFI performance and coverage to be dodgy at best. It's an absolute pain to support.
If I remember reading right, a few years ago, TKIP client encryption was always able to be broken. The catch was that you had to capture the packets with the handshake between the access point and the client. This could be done by breaking the signal and capturing the ensuing reconnect. AES fixed this problem.
I think this may have been if you wanted to actually decrypt the data between the two though and that meant having the WPA key, which these guys have broken. Before this, as the article states, the only thing was a dictionary attack. So, I wonder if you combine the two, can you intercept data and successfully look at it.
import system.cool.Sig;
Does anyone seriously treat any wireless transmission as if it was secure? If anyone who cares to listen can easily pick up everything being sent from your computer it's only a matter of time and CPU power before they can read it.
Yes I know, the article mentions they actually found a more efficient method of cracking WPA than a simple brute force attack, and that is a flaw in WPA not wireless security. Although while they may come up with new encryption methods I still don't trust wireless for much more than browsing slashdot or searching google. If I need to do anything that involves sensitive information like ordering something online I can wait to go to a wired desktop.
So, the headlines blare "WPA is cracked!!!!", but the researchers themselves say they haven't cracked the keys used to encrypt the data and all they have is a "starting point".
So, how is WPA cracked and useless, again??
I suppose maybe we'll see at the PacSec conference.
Now it looks like someone can steal my porn downloads. How rude.
I just upgraded my toaster to linux and put it on my wireless network!
In the USA, we like stuff watered down, like beer, television, and freedom.
Use WPA 2, AES, create private network, MAC address lock on, turn off SNMP, if your router allows it: Reduce transmission strength (Mine is reduced to 10%). Some Windows laptops cannot use WPA2 or AES due to obsolete Wi-Fi card, change the card in the laptop to fix the problem.
As a serious question, the ignorant wanting to be enlightened: Why don't wireless access points just use some well-known and tested public key encryption? What problem is being solved by WEP/WPA/etc which simply broadcasting (or for the paranoid: copying over with a USB key) a regular old public key wouldn't cover?
-- 'The' Lord and Master Bitman On High, Master Of All
We should be allowed to employ various encryption schemes IMO, rather than whatever ones come out of the box. Hows this for a possible workaround: a vpn host device hooked up to the WAN port of the wireless router, or VPN hosting built into the router's firmware. That way all the clients get to keep thier hardware the way it is, with a little added hassle when connecting. Does that work?
arpspoof
So, given that my key gets rotated every 5 min, am I safe from their attack that takes 10-15? Now, assuming that the crack time scales with the resources thrown at it, it would seem that this isn't a safe bet.
One thing that did interest me was this:
A new wireless standard known as WPA2 is considered safe from the attack developed by Tews and Beck
For how long?
We're all hypocrites. We all have hidden parts, it's the contrast between them that make us more a hypocrite than others
Anyone know how large the government's IT workforce is? Couldn't find it myself. I'm guessing it's massive, many times larger than the top several IT companies combined. In my town, the Department of Agriculture pays more for programmers than most private IT companies. (Hence the Mooo) Kinda scary actually.
Meh, that's nothing, I use DOUBLE ROT13. Learn 2 secure your data you n00b!
Check out my blog!
Cordless phones have to be some of the most insecure communication devices out there but people still think nothing of using them for 'secure' transactions.
When my mom got her first cordless phone she was concerned about giving out things like credit card info to companies using the cordless phone. She got a revelation with my answer of "Just use the corded phone for those."
We also had Cat5 run when we had some electrical work done. We use the corded connections for 99% of what we do. Wireless is there for the very rare time when we want to use one of the notebooks in an area without a network jack. And in no way do I consider the connection secure regardless of any encryption put in place.
Wireless isn't all that great. I'm not about to do my online banking at a Starbucks or any other place when I'm literally broadcasting my communication to anyone willing to sniff for it. That's just silly.
...pixels?
DRM: Terminator crops for your mind!
Any source on this other than a news article? I Googled it and couldn't come up with anything. It would be nice to have some technical information: as much as a news source is great, wouldn't it be nice to RTFA and RTFPaper? I guess otherwise we'll just have to wait a week for the conference.
Comment removed based on user account deletion
Is it possible to have a public wi-fi network that encrypts the traffic between the access point and the user without requiring anyone to type in a password? WEP for example requires typing in a password, so it's useless for public networks because everyone would have the same password.
Everyone but everyone goes for Cat6! It's not only rated at higher speed, it looks cooler too.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Comment removed based on user account deletion
The verbage here is misleading. WPA does not imply TKIP and TKIP does not imply WPA. WPA/WPA2 are merely handshaking protocols between STAs used to decide on authentication and encryption suites. The choice of cipher suite is totally orthogonal, because both WPA and WPA2 are designed to be extensible.
When WPA was first introduced, TKIP was the only non-WEP cipher suite available. But in the present day, you can just as easily use CCMP with WPA. Notably, you can also use TKIP with WPA2.
Hey Microsoft,
It's about time you issued a patch on the XBox 360 to support WPA2. I had to downgrade my network to WPA when I got my XBox 360.
Thanks!
Just VPN to my home site and use internal resources. If you're in a public place wireless or wired won't matter since you don't control anything.
Why make it complicated?
I set my router to not broadcast and to only allow specific MAC addresses access. I also have the WPA passkey very complex and set to its max length, 128 characters I believe. So I have things pretty locked down. I'm not a wireless expert by any stretch so I'm wondering if these settings mitigate somewhat the hack described here.
If WPA is Cracked then is WPA2 Mad?
This is slashdot, does this play well with x10?
My web browser's pop-up blocker plays well with x10. I didn't know they were still around.
over 9000.
DRM: Terminator crops for your mind!
Comment removed based on user account deletion
And if you live in Australia it is *ILLEGAL* for you to run your own cat5 in dry wall. You need to have a special licence that not even electricians have.
Welcome to the REAL nanny country!
46137
You'd be surprised how many times I've walked around the corner to the local cafe to get me a nice coffee and see folks doing their banking,using their CC,etc on the cafe free wifi.
Just because you've broken WPA doesn't mean you've broken HTTPS.
I set up a wireless connection to my XP gaming machine when I got a new house and fios last year. Using the Access Point/Fios modem that Verizon gave me I tried to configure WPA2 for my first time, but my download speeds were severely crippled. Interestingly, the upload speed was not affected. Initially I had to fall back to WPA to fix the problem. I first blamed it on my crappy pci wifi card and went and bought a Linksys, but that didn't make any difference. Eventually I discovered that the AP had a setting for WPA with AES and that works fine with my XP pc. I was confused for a long time because I thought AES was the difference between WPA2 and WPA. Looking at this thread, I now see the difference is probably that I'm still using TKIP instead of CCMP as a key manager. My question is: What do you think is causing the incompatibility with WPA2, the access point or Windows XP? It actually sorta works, just is slower than hell (AP->PC only).
Pull cat6 or better for new work! Also pull multiple cables on the runs, in case you find a use later.
Why do you want to start with what is already marginal gigabit capability?
I'm betting that 10 gigabit over copper will get commoditized into cat6 cabling pretty soon.
As is common, there are many half-baked ideas being flung around this comment thread about wireless security. I would like to clear up what I can.
1> There are three major transmission security methods for Wifi: WEP, WPA and WPA2. WEP was badly received from the start and almost immediately broken, this article asserts that WPA is now almost as badly compromised, and nobody has yet made any reasonable threat to WPA2.
2> The major reason many interested parties have not yet migrated entirely to WPA2 is because of certain legacy hardware and software only capable of WPA. For example, pre-windows XP SP3 OS, voip phones, entertainment systems, printers; in the business sector you might also have certain AP's and base stations which will be costly to upgrade beyond WPA capability.
3> It is not helpful to say "wireless is dead" or "everyone should just use cat5". Wireless in general and Wifi in particular fills an important roll for homes and businesses worldwide both to connect devices difficult to reach by wire and for freedom and mobility.
4> No, there is no such thing as perfect security. On the other hand security can be pretty readily quantified, and the impact to WPA is significant if TFA turns out to be correct. While wireless has many strengths regarding mobility, it has an inherent weak spot given that all of your data is blared out into the air in every direction â" making it more easily analyzed by interlopers. This threat is virtually negated by responsible use of stable encryption technology, including WPA2 AES.
5> the type of encryption compromise TFA discusses will allow script-kiddy level attackers to sit outside the home or business (up to a good distance if they have line of sight and a directional antenna) of WPA users and either eavesdrop on your communications (valuable for identity theft and farmable, even if you are joe nobody) steal your bandwidth, potentially perpetrating illegal acts hidden behind your IP address, or possibly hack your machine (from behind your NAT) for use in a bot network. This is just a list of the uses joe nobody's connection might be put to that I can imagine off the top of my head, there may be more.
6> No, TFA is not a sales pitch for hardware. OEM's are embarrassed by any products which might be easy to compromise, and I am aware of none that push product A with weak security in an effort to gouge with product B which instead uses decent security. It's not a sales pitch for "encryption" since AES is a public standard. You might make the argument that it's a sales pitch for computer and network consulting, but that's an entire industry and I don't believe it will ever run out of things to actually do.
So the moral is: WEP (and now also WPA1) are like car door locks. They only protect you as long as wardrivers can preferentially use your neighbors cleartext connection. WPA2 with a well chosen password will provide you a level of security similar to a wired connection, with all the benefits of mobility. While all encryption standards are eventually broken, I see no reason to believe that WPA2/AES will fail in the next decade.
Cleartext hotspots at cafes and WEP/WPA1 connections are not entirely useless (especially if you can use SSL, or VPN / SSH tunnel for anything you wish to protect) but it is advisable to know when your traffic has a relative expectation to privacy and when it does not. It is also wise to give some amount of value to your privacy, if only because you won't truly understand it's worth until you've after you've lost it.
People willing to trade their freedom of expression for temporary entertainment deserve neither and will lose both.
and instead type something else in manually (not https: www.mynotsosecurebank.com)
Fixed that for you.
Since the latter could easily be hijacked prior to the typical auto-redirect to https.
Uh-huh. And firefox will display "My Mostly Secure Bank" in the green bar without warning about the self- or unsigned SSL certificate exactly why?
Or is your scenario something different that I'm not considering?