Slashdot Mirror
The Real Story On WPA's Flaw
Glenn Fleishman writes "The reports earlier today on WPA's TKIP key type being cracked were incorrect. I spoke at length with Erik Tews, the joint author of the paper that discloses a checksum weakness in TKIP that allows individual short packets to be decrypted without revealing the TKIP key. I wrote this up for Ars Technica with quite a bit of background on WEP and WPA. Tews's paper, co-written with Martin Beck, whom he credits as discovering and implementing a working crack (in aircrack-ng as a module), describes a way to use a backwards-compatible part of TKIP to exploit a weakness that remains from WEP. ARP packets and similarly short packets can be decoded. Longer packets are likely still safe, and TKIP hasn't been cracked. Don't believe the hype, but the exploit is still notable."
Use really long words.
Well, really, these stories should be checked out more throughly before publication!!!!
Ruby Neural Evolution of Augmenting Topologies
OK, that settles it. Ars Technica for the win!
They've been doing a great job on technical analysis for a long time now ...
One simple rule for its versus it's
This is more interesting than I suspect most people will think it is. With any security system, researchers build on weaknesses found piece by piece. It might not seem a big deal that short packets can be decoded nor that a few additional packets can be injected into a wifi network data stream, but these small cracks almost always lead to methods of getting more information from the security system.
I've been watching WPA security studies for a while, and this seems the most significant flaw yet found. It will be very interesting to see if and how this exploit is grown into something more generally usable.
Attacks only get better, not worse. The right thing to do, IMO, is treat this as a warning. We need to stop trying to concoct schemes that are specific to wifi and just treat wireless media as untrusted. Harden the clients. Don't let them act like they're on a trusted local network until they're on your VPN. Besides getting more thoroughly vetted crypto, this leaves your road warriors in a much better position when they sign on in coffee houses, airports and hotels.
.sig: file not found
Yes, it's only a crack, not a collapse. But a crack into which can be inserted the crowbar of, in this case, ARP or DNS spoofing. Enough to force quite a large hole into a wireless network which relies on TKIP. AES is safe, yes, but if your router allows TKIP, this could be quite a large hole... enough to poke a user on the other side to start sending their private traffic across the Internet, other wireless networks, etc. to a third-party IP.
And it won't be long before that crack becomes a hole big enough to slap the user through. It's not "the sky is falling" but it's a wake up call to people who thought TKIP/WPA was "safe enough" to instead make sure they are using AES with strong keys. Personally, even the school wireless routers that I manage have WPA2, AES with PSK's in the range of 512bytes each. Doing that from the first has bought me a lot of time in which to be secure. However, if I had started slightly earlier with WEP equipment, moved onto WPA as a compatability measure, etc. I might now be in the position where I would need to move again.
It's right to make a fuss of this. It's wrong to suggest the WPA (or, by unsaid extension) WPA2 are "broken". Even if they were, we have no viable alternative just yet, anyway, so you're stuffed. :-)
They have people 'reporting' for them that have no degrees in the computer sciences, nor even certifications in the art & sciences of computing, let alone years to decades of hands on experience in computers in the trenches actually doing the job. Jeremy Reimer being a prime example thereof in fact. This makes them good? I know not. Anyone can re-report what has already been posted up from other sources after all. That does not take brains, nor is it indicative of quality original work either.
assigned
computer
Alright, they're of middling length and not "really long", but still! Cut the guy some slack, at least he /tried/ to keep on-topic by using middling-length words.
I wonder if it's somehow related to this thing I found some time ago?
Still using WEP here. ;)
I mean were talking physical proximity VS. the entire Internet!
... like the TCP packets sent when you actually key in a password over the wire(less) ?
Any protocol that assumes wpa is `secure' and sends interactive passwords in the clear becomes very attractive for pirates, suddenly.
WPA
Well, the ARS writeup is much better that what dribbled out yesterday, and I actually understand what is going on here. I was one of the authors of IEEE 802.11i. The protection mechanism we built in to counter these type of attacks (TKIP Countermeasures triggered by two or more MIC failures within 60 seconds) is STILL present and functioning as designed. These guys figured out that the MIC counter is incremented separately for each QoS queue, so instead of one guess at the key per minute, you get LOTS more. The "flaw" then is in the interaction of 802.11i (the security enhancements) and 802.11e (QoS), not in 802.11i itself.
Remember that the key that is cracked is a per-frame temporal key, not the pairwise master key, and the scope of what you can do with this is severly limited. I am personally not at all convinced that that this attack or ones which build on it will improve. This attack is an active one, and it is detectable either by the AP under attack or by a wireless IDS. I can also predict that a simple change in the way MIC failures are tracked and rekeying the network when this attack is detected would defeat it, just as the original Michael MIC was designed to do.
Finally, remember that TKIP was intended to be a retrofit to band-aid the problem until the full AES based standard was finished. We published what became known as WPA more than 6 years ago, and didn't mandate the replacement of hardware to implement it.
Not to bad, in my humble opinion....
Apart from VOIP, what really uses QOS anyway?
IranAir Flight 655 never forget!