Slashdot Mirror
The Real Story On WPA's Flaw
Glenn Fleishman writes "The reports earlier today on WPA's TKIP key type being cracked were incorrect. I spoke at length with Erik Tews, the joint author of the paper that discloses a checksum weakness in TKIP that allows individual short packets to be decrypted without revealing the TKIP key. I wrote this up for Ars Technica with quite a bit of background on WEP and WPA. Tews's paper, co-written with Martin Beck, whom he credits as discovering and implementing a working crack (in aircrack-ng as a module), describes a way to use a backwards-compatible part of TKIP to exploit a weakness that remains from WEP. ARP packets and similarly short packets can be decoded. Longer packets are likely still safe, and TKIP hasn't been cracked. Don't believe the hype, but the exploit is still notable."
Use really long words.
OK, that settles it. Ars Technica for the win!
They've been doing a great job on technical analysis for a long time now ...
One simple rule for its versus it's
This is exactly why the trend of waiting to release news at security conventions is a bad idea. By announcing that there's an exploit but withholding the details, real harm can be done. I understand that security researcher is not a glamorous position (being one myself), and I understand the desire to keep certain details of an exploit under wraps until a vendor fixes them. Ultimately, if you want to wait until the vendor fixes the problem, you do not publish. It's that simple.
Otherwise you end up with, "omg the sky is falling!11!!!11!1! TKIP sux lol may just use open wifi".
This is more interesting than I suspect most people will think it is. With any security system, researchers build on weaknesses found piece by piece. It might not seem a big deal that short packets can be decoded nor that a few additional packets can be injected into a wifi network data stream, but these small cracks almost always lead to methods of getting more information from the security system.
I've been watching WPA security studies for a while, and this seems the most significant flaw yet found. It will be very interesting to see if and how this exploit is grown into something more generally usable.
Saw it on the Internet; It's gotta be true!
Ruby Neural Evolution of Augmenting Topologies
I want the news of a potential exploit that may affect me or my organizations to be presented as soon as possible, so I can take measures before the vendor releases a fix.
In many cases, knowing about an exploitable vulnerability doesn't mean you can do anything about it. That is the very heart of the full disclosure/responsible disclosure debate.
Attacks only get better, not worse. The right thing to do, IMO, is treat this as a warning. We need to stop trying to concoct schemes that are specific to wifi and just treat wireless media as untrusted. Harden the clients. Don't let them act like they're on a trusted local network until they're on your VPN. Besides getting more thoroughly vetted crypto, this leaves your road warriors in a much better position when they sign on in coffee houses, airports and hotels.
.sig: file not found
Yes, it's only a crack, not a collapse. But a crack into which can be inserted the crowbar of, in this case, ARP or DNS spoofing. Enough to force quite a large hole into a wireless network which relies on TKIP. AES is safe, yes, but if your router allows TKIP, this could be quite a large hole... enough to poke a user on the other side to start sending their private traffic across the Internet, other wireless networks, etc. to a third-party IP.
And it won't be long before that crack becomes a hole big enough to slap the user through. It's not "the sky is falling" but it's a wake up call to people who thought TKIP/WPA was "safe enough" to instead make sure they are using AES with strong keys. Personally, even the school wireless routers that I manage have WPA2, AES with PSK's in the range of 512bytes each. Doing that from the first has bought me a lot of time in which to be secure. However, if I had started slightly earlier with WEP equipment, moved onto WPA as a compatability measure, etc. I might now be in the position where I would need to move again.
It's right to make a fuss of this. It's wrong to suggest the WPA (or, by unsaid extension) WPA2 are "broken". Even if they were, we have no viable alternative just yet, anyway, so you're stuffed. :-)
I want the news of a potential exploit that may affect me or my organizations to be presented as soon as possible, so I can take measures before the vendor releases a fix. In many cases, knowing about an exploitable vulnerability doesn't mean you can do anything about it. That is the very heart of the full disclosure/responsible disclosure debate.
There's always something you can do about it -- even if it's a matter of policy vs. technology. Or sometimes there's creative solutions that can be put in place. For instance, if WPA encryption were found to have an actual exploit, you could add an additional encryption layer via VPN or even simply an SSH tunnel. I actually do the latter over the really insecure WEP connections.
Ruby Neural Evolution of Augmenting Topologies
An unknown attack vector is far worse than a known one. If you know where an attack is going to be coming from you have a far better chance of either A) preventing or B) reacting to an attack.
Knowing is a LOT better than having no idea your system is vulnerable and it getting compromised. Particularly if your job is knowing all you can about security and securing your company's system...
Still using WEP here. ;)
Well, the ARS writeup is much better that what dribbled out yesterday, and I actually understand what is going on here. I was one of the authors of IEEE 802.11i. The protection mechanism we built in to counter these type of attacks (TKIP Countermeasures triggered by two or more MIC failures within 60 seconds) is STILL present and functioning as designed. These guys figured out that the MIC counter is incremented separately for each QoS queue, so instead of one guess at the key per minute, you get LOTS more. The "flaw" then is in the interaction of 802.11i (the security enhancements) and 802.11e (QoS), not in 802.11i itself.
Remember that the key that is cracked is a per-frame temporal key, not the pairwise master key, and the scope of what you can do with this is severly limited. I am personally not at all convinced that that this attack or ones which build on it will improve. This attack is an active one, and it is detectable either by the AP under attack or by a wireless IDS. I can also predict that a simple change in the way MIC failures are tracked and rekeying the network when this attack is detected would defeat it, just as the original Michael MIC was designed to do.
Finally, remember that TKIP was intended to be a retrofit to band-aid the problem until the full AES based standard was finished. We published what became known as WPA more than 6 years ago, and didn't mandate the replacement of hardware to implement it.
Not to bad, in my humble opinion....