Slashdot Mirror
Researchers Crack WPA Wi-Fi Encryption
narramissic writes "Researchers Erik Tews and Martin Beck 'have just opened the box on a whole new hacker playground, says Dragos Ruiu, organizer of the PacSec conference. At the conference, Tews will show how he was able to partially crack WPA encryption in order to read data being sent from a router to a laptop. To do this, Tews and Beck found a way to break the Temporal Key Integrity Protocol (TKIP) key, used by WPA, in a relatively short amount of time: 12 to 15 minutes. They have not, however, managed to crack the encryption keys used to secure data that goes from the PC to the router in this particular attack. 'Its just the starting point,' said Ruiu."
Cat5
All your AP are belong to us.
You have no chance to survive make your time.
What's up with the 'story' tag? Perhaps we should also tag this 'words'?
Is AES not the more secure of the two? From everything I have read, AES is the preffered option over TKIP.
I use WEP!
[FUCK BETA]
OMG! We need routers w/ better encryption. Buy router company and encryption company stocks! Everyone run out to Best Buy and get a new router.
Or, it just might be a real problem. /crumples tinfoil hat and pouts.
Just WPA. WEP was already hideously broken but now WPA should also be considered broken. WPA2 is still safe.
Although, if you really have data you're concerned about keeping safe, you should (a) use a wired network, (b) use IPSEC, or (c) both.
People are never as simple as their stereotypes. This applies equally to Christians, Muslims, and Emacs-lovers.
or is anything worth protecting worth using CAT5 on?
Most banks and government institutions don't use WIFI because of the security vulnerabilities. Granted CAT5 doesn't have have security to access (like wifi tkip/aes key), but it is physically secure, which is at the same level of security as the physical machines themselves.
I find WIFI performance and coverage to be dodgy at best. It's an absolute pain to support.
If I remember reading right, a few years ago, TKIP client encryption was always able to be broken. The catch was that you had to capture the packets with the handshake between the access point and the client. This could be done by breaking the signal and capturing the ensuing reconnect. AES fixed this problem.
I think this may have been if you wanted to actually decrypt the data between the two though and that meant having the WPA key, which these guys have broken. Before this, as the article states, the only thing was a dictionary attack. So, I wonder if you combine the two, can you intercept data and successfully look at it.
import system.cool.Sig;
Does anyone seriously treat any wireless transmission as if it was secure? If anyone who cares to listen can easily pick up everything being sent from your computer it's only a matter of time and CPU power before they can read it.
Yes I know, the article mentions they actually found a more efficient method of cracking WPA than a simple brute force attack, and that is a flaw in WPA not wireless security. Although while they may come up with new encryption methods I still don't trust wireless for much more than browsing slashdot or searching google. If I need to do anything that involves sensitive information like ordering something online I can wait to go to a wired desktop.
So, the headlines blare "WPA is cracked!!!!", but the researchers themselves say they haven't cracked the keys used to encrypt the data and all they have is a "starting point".
So, how is WPA cracked and useless, again??
I suppose maybe we'll see at the PacSec conference.
Use WPA 2, AES, create private network, MAC address lock on, turn off SNMP, if your router allows it: Reduce transmission strength (Mine is reduced to 10%). Some Windows laptops cannot use WPA2 or AES due to obsolete Wi-Fi card, change the card in the laptop to fix the problem.
As a serious question, the ignorant wanting to be enlightened: Why don't wireless access points just use some well-known and tested public key encryption? What problem is being solved by WEP/WPA/etc which simply broadcasting (or for the paranoid: copying over with a USB key) a regular old public key wouldn't cover?
-- 'The' Lord and Master Bitman On High, Master Of All
I know I just got root access...BTW could you put in some bread? I'm trying to install pop-up's.
-Ours is the wisdom of Solomon, the magic of Merlyn, the fall of Icaris.
Meh, that's nothing, I use DOUBLE ROT13. Learn 2 secure your data you n00b!
Check out my blog!
Cordless phones have to be some of the most insecure communication devices out there but people still think nothing of using them for 'secure' transactions.
When my mom got her first cordless phone she was concerned about giving out things like credit card info to companies using the cordless phone. She got a revelation with my answer of "Just use the corded phone for those."
We also had Cat5 run when we had some electrical work done. We use the corded connections for 99% of what we do. Wireless is there for the very rare time when we want to use one of the notebooks in an area without a network jack. And in no way do I consider the connection secure regardless of any encryption put in place.
Wireless isn't all that great. I'm not about to do my online banking at a Starbucks or any other place when I'm literally broadcasting my communication to anyone willing to sniff for it. That's just silly.
Comment removed based on user account deletion
I think as long as your WPA passkey is not easily guessable and long enough you should be good to go.
MAC Address filtering and not broadcasting your SSID is really not doing anything for you though. MAC addresses are trivial to spoof, and SSID can be sniffed out without too much trouble.
over 9000.
DRM: Terminator crops for your mind!
And if you live in Australia it is *ILLEGAL* for you to run your own cat5 in dry wall. You need to have a special licence that not even electricians have.
Welcome to the REAL nanny country!
46137