Researchers Crack WPA Wi-Fi Encryption

narramissic writes "Researchers Erik Tews and Martin Beck 'have just opened the box on a whole new hacker playground, says Dragos Ruiu, organizer of the PacSec conference. At the conference, Tews will show how he was able to partially crack WPA encryption in order to read data being sent from a router to a laptop. To do this, Tews and Beck found a way to break the Temporal Key Integrity Protocol (TKIP) key, used by WPA, in a relatively short amount of time: 12 to 15 minutes. They have not, however, managed to crack the encryption keys used to secure data that goes from the PC to the router in this particular attack. 'Its just the starting point,' said Ruiu."

Comments

Re:Who uses TKIP instead of AES?

[kannibal_klown]

Is AES not the more secure of the two? From everything I have read, AES is the preffered option over TKIP.

I recall seeing some AP setups where TKIP was the default scheme.

In the wide spectrum of Luddite to Novice to Hobbyist to Professional there are probably a bunch of users that might know enough to use WPA (perhaps from prodding from friends) and use the default settings with a key (either random or a passphrase).

WPA2 is NOT broken

[fractalus]

Just WPA. WEP was already hideously broken but now WPA should also be considered broken. WPA2 is still safe.

Although, if you really have data you're concerned about keeping safe, you should (a) use a wired network, (b) use IPSEC, or (c) both.

Re:WPA2 is NOT broken

[Anonymous Coward]

That will have been via brute forcing the handshake, though any passphrase based authentication method is going to be vurnrible from a method such as this.

Re:WPA2 is NOT broken

[Hatta]

Don't install cat5, install conduit. Then you can pull whatever you want, wherever you want, at any point in the future with ease.

Re:WPA2 is NOT broken

[lostfayth]

Fairly easy, if you have a basement or attic (crawlspace) where you can drop wire. Cut a hole for an "old work" electrical box, and drill a hole in attic or basement to run the wire through. Run a fish wire through the hole in the attic/basement, and to the larger hole in the wall to pull some cat5 through, then run the wire to where you need it. Terminate and enjoy.

Gets a little more tricky in multi-story houses or those without attic/basement, but that's the basic idea.

Re:WPA2 is NOT broken

[Hatta]

Go to the attic, you'll have access to the insides of the walls from above. Drop a chain with a weight down an interior wall (so there's no insulation in the way). Cut a hole in the drywall for your ethernet jack. Guide the weight to the hole, a strong magnet(perhaps from a hard drive) can help here. Then just attach your cat5 to the end of the chain, go back to the attic and pull it up. You can run the cat5 across the entire house in the attic and not worry about people tripping on it or anything. It's kind of shitty work, but it's doable if you're just a little bit handy.

Re:WPA2 is NOT broken

[Firethorn]

But are wired solutions really anymore secure? I mean can't packets that go out still be captured and worked on?

Actually, unless you're doing seperate encryption, most wired connections today are less secure than wireless with proper security set.

Part of the clue is with WEP - Wired Equivalent Privacy. The idea was that, at the time, to make the wireless connection as much of a pain to get into as a wireline. IE not very difficult in most circumstances. Today, due to the march of technology, WEP IS easier to get into than a wire, but not much less either.

There are ways to sniff traffic today without breaching the wire, there's packet sniffers that can sit in the middle of a cable, etc... They just require either expensive equipment for ranged use or somebody actually getting to the wire.

So, regardless if you have a wired or wireless connection, before you start putting financial or other private information onto a network, using a secure protocol is a very good idea. HTTPS, SSH, etc...

Of course, if you want to be really secure, do something like WPA2/AES to the router, then VPN to the private network.

Re:WPA2 is NOT broken

[smellsofbikes]

Some notes on wiring -- either power or ethernet cable.
1. Drill two holes in the header, each about 1/2" in diameter, about 2" apart. You put a flashlight over one so you can see what you're doing when you drop the line down the other.
2. On the bottom end, cut a full-sized hole for a standard rework box. You can get standard wall faceplates for snap-in Cat5 outlets. I generally wire with double-hole faceplates, and put a phone cord in the lower one and Cat5 in the upper. A rework box hole gives you a large enough opening that you can get your hand in there and grab stuff. Pull the wire out and run it into a rework box and put that in the wall. (if you have really big hands you might not be able to do this. Find someone with smaller hands or run a loop of wire into the wall first, then drop the wire from the top, through the loop, and then pull the loop out the hole.)

By using an adjacent hole to admit light, I can usually manage to drop a wire into an existing box if I've punched out the knockout on the top, with a bit of care.

Note that all this advice, and the parent poster advice, all assume you don't have firebreaks inside the wall. Many newer houses have 2x4's across the wall halfway up, to keep the space between the walls acting like a chimney. In that case you're going to be cutting drywall and/or finding a seriously long drillbit. (It's possible to weld a drillbit onto the end of a 3' piece of mild steel rod, but it's pretty unpleasant to use.)

Re:WPA2 is NOT broken

[LandruBek]

Can you reference a single incident where such a raid has taken place?

The FBI has conducted armed raids of homes in at least three states due to clicks on honeypot links to files full of "gibberish." So the above scenario (of Alice getting arrested because of Bob's browsing habits) is highly plausible, even if it hasn't happened yet.

Re:WPA2 is NOT broken

[MikeBabcock]

You can always buy a decent network switch with 802.1x authentication and make your wired network significantly less open.

Re:WPA2 is NOT broken

[element-o.p.]

Part of the clue is with WEP...but not muc less either

I disagree. WEP was a marketing phrase -- "See? Our wireless networking gear is just as secure as traditional wired networks!" Unfortunately, it wasn't. WEP was flawed from the start because of some mistakes made in the implementation of encryption (I don't recall exactly what was wrong and I'm too lazy to Google it, but IIRC, they implemented RC4 incorrectly). A more telling clue about the security (or lack thereof) of WEP was in a quote I found while researching wireless networking for a college presentation: "Installing a wireless LAN may seem like putting Ethernet ports everywhere, including in your parking lot." (Cisco Systems document, "Wireless LAN Security"). You are correct that if you are on the inside, getting access to a wire is not terribly difficult. However, if you don't have access to my facilities, getting access to my wired network just got orders of magnitude harder. It might still be possible, but it's certainly not as easy as simply plugging into an empty network jack. For that matter, where I work, we turn off unused network jacks, so even if you get inside the building, you still won't have physical access to my network unless you unplug someone else's connection -- which will probably be noticed, even if it's only for a few seconds while you connect a switch. But it's worse than that, because on my switch, I can filter ports by MAC address, so unless you find an active port *and* clone a valid MAC address for that port you still won't have access.

If all you want to do is passively sniff traffic that is flowing through a wire, then it's certainly much easier for you -- all you have to do, as you state above, is insert a sniffer between a valid network host and the network jack and you're golden...but that's once you are inside my building. Fortunately, I work in a small enough company that if someone unknown starts mucking around with our network cables, someone is going to get suspicious, so even passively sniffing isn't as easy as you suggest.

With WEP -- and now WPA, as well -- all you have to do is sit in your car on the street outside my building, take ten to fifteen minutes (according to the summary above, anyway) and you can sniff to your heart's content. Sounds much easier than gaining access to my wired network, IMHO.

Huh....So for data....

[Seakip18]

If I remember reading right, a few years ago, TKIP client encryption was always able to be broken. The catch was that you had to capture the packets with the handshake between the access point and the client. This could be done by breaking the signal and capturing the ensuing reconnect. AES fixed this problem.

I think this may have been if you wanted to actually decrypt the data between the two though and that meant having the WPA key, which these guys have broken. Before this, as the article states, the only thing was a dictionary attack. So, I wonder if you combine the two, can you intercept data and successfully look at it.

Re: Huh....So for data....

[tlhIngan]

If I remember reading right, a few years ago, TKIP client encryption was always able to be broken. The catch was that you had to capture the packets with the handshake between the access point and the client. This could be done by breaking the signal and capturing the ensuing reconnect. AES fixed this problem.

I think this may have been if you wanted to actually decrypt the data between the two though and that meant having the WPA key, which these guys have broken. Before this, as the article states, the only thing was a dictionary attack. So, I wonder if you combine the two, can you intercept data and successfully look at it.

TKIP is a nasty hack, actually. It's designed to work with chipsets with onboard WEP encryption/decryption (it re-uses the RC4 hardware), and its security was always quite low (which is why it always re-keys itself every hour by default). It has mechanisms to detect and prevent replay attacks, as well as message integrity checks in case someone manages to break through the protections. It's final defense is a complete shut down of the network and a re-keying of everyone if it detects 2 or 3 MIC failures (the network literally shuts down for a minute).

These days, modern chipsets can do AES in hardware, and there's no reason to use TKIP anymore except in legacy applications (which still exist - though modern software can often just offload the AES in software).

Re:Who uses TKIP instead of AES?

[Anonymous Coward]

For the longest time, XP didn't come with AES/WPA support. You'd have to add this patch: http://www.microsoft.com/downloads/details.aspx?familyid=662BB74D-E7C1-48D6-95EE-1459234F4483&displaylang=en

I'm not sure if this was rolled into a newer SP. Many people couldn't access a WPA2 AP so manufacturers chose to just enable WPA as there was less chance of incompatibility.

In my apartment complex, I'm one of two people who have WPA2 enabled. I'm the only one who has only WPA2 enabled.

Heh, the captcha word is "paranoia".

Secure Wi-Fi

[extract]

Use WPA 2, AES, create private network, MAC address lock on, turn off SNMP, if your router allows it: Reduce transmission strength (Mine is reduced to 10%). Some Windows laptops cannot use WPA2 or AES due to obsolete Wi-Fi card, change the card in the laptop to fix the problem.

Re:'Story' tag

[Hurricane78]

Valid question.

Well, if a story comes from the firehose, it gets tagged "story", because it became a story. And If it didn't, it gets tagged "!story".

Re: 'Its just the starting point,'

[AdmiralXyz]

For two reasons:

1) Even if it isn't completely broken, any kind of significant attack, as this most certainly is, is reason enough to switch to a more secure system if one is available. This revelation, combined with that Russian breakthrough of using GPUs to brute-force WPA keys in very little time, is evidence that WPA is very close to being insecure and inadvisable for use as a wireless security protocol, if it isn't already.

2) Alarmist headlines always have been the de facto when it comes to security-related news and always will be. While I agree it is an exaggeration in many cases, it gets people paying attention to vital security-related issues, which can only be a Good Thing.

Re:Who uses TKIP instead of AES?

[rpmayhem]

In short, yes, AES is more secure than TKIP.

WPA and TKIP was really just a stepping stone to get people off WEP and heading toward WPA2 and AES. Wireless hardware built to run WEP didn't have the processing power to run AES (I think it needed a separate crypto processor just for AES). So they made the WPA standard run TKIP so current WEP hardware was able to use a better security setup. It was all intended to move everyone to WPA2 with AES after everyone had bought newer wireless cards and routers.

Interestingly, this means if you have hardware that only supports WEP, and the vendor doesn't offer WPA support, it's because they are too lazy to implement it (or want you to buy the new stuff). The hardware can handle it, they just need to add it to the firmware. My work had some handheld units like this. We had to buy all new units.

Re:Who uses TKIP instead of AES?

[AndrewNeo]

Service Pack 3 does indeed enable WPA2 and AES support.

Re:'Story' tag

[spud603]

I know this is meta discussion, but i wish i had mod points. +1 informative

Re:Well duh...

[plague3106]

Does anyone seriously treat any wireless transmission as if it was secure? If anyone who cares to listen can easily pick up everything being sent from your computer it's only a matter of time and CPU power before they can read it.

Well, secure enough. I have WPA2 and AES with RADIUS setup... but as far as recording the transmitted data and decrypting it later, you can use tempest to snoop on Cat5 packets too.. so, I'm not sure wired vs. wireless is that relevent.

Re:Who uses TKIP instead of AES?

[sempernoctis]

TKIP is not a cipher; it is a keying protocol. When you use TKIP, the actual cipher you are using is called RC4, which is older and has more known vulnerabilities than AES. It is also the cipher typically used by WEP, though the keying protocol WEP uses contains additional vulnerabilities. TKIP basically takes RC4, which was designed to encrypt a single stream of data, and creates a protocol around it for sending arbitrary packets, which may not be reliably delivered. WPA2 provides a more secure way to similarly wrap the AES cipher, but retains support for TKIP/RC4 for legacy devices.

Re:Who uses TKIP instead of AES?

[dohnut]

AES and TKIP are not apples to apples. AES is an encryption algorithm. TKIP basically handles the keys that the encryption algorithm uses.

A better apples to apples comparison would be between the encryption algorithms (RC4 and AES) or the key managers (TKIP and CCMP).

Generally, WPA uses TKIP/RC4 and WPA2 (802.11i) uses CCMP/AES.

WPA (TKIP/RC4) was supposed to be a bridge between WEP and WPA2. WPA used RC4 (just like WEP) but enhanced (TKIP) in order improve security while using existing (WEP/RC4) hardware.

WPA2 has always been considered more secure than WPA on paper though until this there has never been a documented exploit for either of them.

Re:Who uses TKIP instead of AES?

[JackHoffman]

AES is a cypher. TKIP is a protocol, the Temporal Key Integrity Protocol, to be precise. The cypher used by WEP and WPA/TKIP is RC4. TKIP is what keeps changing the RC4 key to avoid the attacks on WEP, for which the attacker needs to collect many packets which have been encrypted with the same key. TKIP was invented to salvage older hardware, which only implemented the RC4 cypher.

It is important to know that WEP's weakness is not simply a vulnerable cypher, but a vulnerability of the crypto system. The announcement states that the attack on WPA/TKIP does not actually crack the key, so this too looks like a vulnerability of the crypto system. That highlights the importance of crypto system design. You can't just take a "secure" cypher and be done with it. The protocol surrounding that cypher is just as important.

Re:Well duh...

[maxume]

The architecture of DSL is usually such that you can't see anybody else's traffic (well, it was the last time I spent any time trying to understand how it worked).

Just like cordless phones, really

[Rastl]

Cordless phones have to be some of the most insecure communication devices out there but people still think nothing of using them for 'secure' transactions.

When my mom got her first cordless phone she was concerned about giving out things like credit card info to companies using the cordless phone. She got a revelation with my answer of "Just use the corded phone for those."

We also had Cat5 run when we had some electrical work done. We use the corded connections for 99% of what we do. Wireless is there for the very rare time when we want to use one of the notebooks in an area without a network jack. And in no way do I consider the connection secure regardless of any encryption put in place.

Wireless isn't all that great. I'm not about to do my online banking at a Starbucks or any other place when I'm literally broadcasting my communication to anyone willing to sniff for it. That's just silly.

Re:Who uses TKIP instead of AES?

[Anonymous Coward]

At least it's not like the Nintendo DS that only supports WEP.

Re:why not RSA?

[swillden]

Why don't wireless access points just use some well-known and tested public key encryption? What problem is being solved by WEP/WPA/etc which simply broadcasting (or for the paranoid: copying over with a USB key) a regular old public key wouldn't cover?

Why public key? What problem is solved by using public key schemes, with their corresponding complexity, poor performance and large, unwieldy keys?

The question you SHOULD ask is: "Why don't wireless access points just use some well-known and tested symmetric key encryption?"

The answer is: They do. The cipher is called AES and the WiFi security scheme that uses it is called WPA2. What's been broken is the stuff that's still based on the RC4 cipher, which has some well-known flaws.

Re:Who uses TKIP instead of AES?

[bendodge]

I use WPA2 AES with a 128-bit key, but even the 'advanced' DD-WRT v24sp2 router firmware I'm using had TKIP as the default. I think it's for XP compatibility, but SP3 includes WPA2 and PNRP now.

Re:Does this help

[Mantrid]

I think as long as your WPA passkey is not easily guessable and long enough you should be good to go.

MAC Address filtering and not broadcasting your SSID is really not doing anything for you though. MAC addresses are trivial to spoof, and SSID can be sniffed out without too much trouble.

Re:Meh

[RiotingPacifist]

But wireless devices are susceptible to anything cat5 is and then some!

Re:It's a ploy!

[MikeBabcock]

You mean like point-to-point IPSec? That already exists, and is quite usable on modern computers.

Re:Who uses TKIP instead of AES?

[dohnut]

I'm am not aware of any hybrid wireless security scheme using both TKIP as a key manager and AES the cipher. Though I suppose it would be possible.

When you see TKIP/AES or more commonly TKIP+AES. They are saying both TKIP/RC4 and CCMP/AES specifications are supported. So, for instance, you could set up a client to use "TKIP+AES". This basically means the client will try to connect to the AP using CCMP/AES first. If that fails it will try TKIP/RC4. It doesn't mean you're using both TKIP and AES simultaneously.

WPA2 (full 802.11i) has always been and currently is only CCMP/AES.