Slashdot Mirror
New Improvements On the Attacks On WPA/TKIP
olahau writes "Two weeks ago, improvements to the previously reported attack on WPA/TKIP, were presented at the NorSec Conference in Oslo, Norway. In their paper coined 'An Improved Attack on TKIP,' Finn Michael Halvorsen and Olav Haugen describe the improvements, which enable an attacker to inject larger, maliciously crafted packets into a WPA/TKIP protected network, thus opening the probabilities for new and more sophisticated attacks against the well-established wireless security protocol."
New Improvements On the Attacks On WPA/TKIP
... in Cincinatti!!
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
Disgruntled goats, what you've just said is one of the most insanely idiotic things I have ever heard.
At no point in your rambling, incoherent post were you even close to anything that could be considered a rational thought.
Everyone on this site is now dumber for having read it. I award you no points, and may God have mercy on your soul.
WEP is better? Has it always been better? I used WEP for the longest time until I figured I could set my own (short & easy) password with WPA.
Should I switch back? Not that I expect my neighbours to be leet hackers...
But one time not too long ago I logged into my one of my neighbours unsecured network (no idea who owned it) and noticed they had a printer on the network. So I downloaded the drivers off of HP and then sent a message to their printer telling them they should secure their wireless, and a website to show them how.
Now to you or I, this would seem like a noble act in educating people on good security measures, but everyone else (meaning not computer people) thought that this was an outright invasion of privacy and advised me "Never to attempt that kind of stunt again" (not that I'll listen to them).
Anyways, ever since then I've had this itching feeling that someones going to break into my wireless and show me whats what in a sort of karmic irony.
Why did they invent a (well, multiple) new encryption algorithm(s) for WiFi? Any competent security specialist will tell you that using an established encryption algorithm is always the wise choice. Did the people behind WiFi simply lack competence? Not Invented Here?
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
This tells us nothing more than we knew before. Stop using WPA/TKIP and switch to WPA2/AES
News at 11!
Wake me when someone's got something on WPA2.
I think someone should post a story about bugs in zmodem.
The timing of this new attack could not have been better - the day after the UK government announces they want to introduce a "three strikes" rule before disconnecting suspected file-sharers.
I imagine this must be a massive headache for ISPs who have been shipping routers with WPA/TKIP enabled for compatibility (i.e. a lot of them). Suddenly their routers need remotely updating and they have to hope that most of their customer's wifi drivers will cope with the move to AES.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
They didn't use AES because AES didn't yet exist. (Or, to be specific, was very early on in the algorithm competition to determine which one would become the standard.)
Rijndael was chosen as the AES winner by NIST in 2001. WEP was finalized in 1997.
At that point, I believe DES was already known to have issues.
retrorocket.o not found, launch anyway?
In-order to hack WEP it's quite simple today, you need to do the following :
:
1) Listen to packets going through (monitor mode)
2) Force people to send more packets using arp-replay packets or specially crafted packets
3) Capture about 25000 packets and make an crypto analysis [the more packets you capture, more chance you'll be able to decrypt the password] about this packets to get password
In WPA1/2 it's quite different
1) Listen to packets going through in monitor mode
2) Wait un-till you capture a connection-login handshake (it's 2 packets both ways = 4 packets)
3) After you capture packets in 2, you need to do Dictionary attack on the captured session login. If that word isn't in your dictionary, you're screwed.
That's why a current wireless hacking methods against a strong not-in-dictionary WPA(PSK) password will be quite hard (if possible) to hack these days.
Just so we all be cleared.
Read and Comment at my BLOG
!!!
Is there? I'm pretty sure you can't actually obtain the password like WEP, or am I wrong? ... :(
Let me know asap, I'm low on my monthly quota for downloads!
Oh Australia....
I leave my wireless connection "unsecured". Sure, the neighbours use it, and people needing iPod Touch location services.
I figure it's just good social behaviour. If I need network access when I'm "out and about", I will use someone else's wifi.
Just don't be a 'leet hacker asshole.
Just another "Cubible(sic) Joe" 2 17 3061
But one time not too long ago I logged into my one of my neighbours unsecured network (no idea who owned it) and noticed they had a printer on the network. So I downloaded the drivers off of HP and then sent a message to their printer telling them they should secure their wireless, and a website to show them how.
I run my WLAN open, or "unsecured", intentionally and encourage everyone to do the same. Your neighbors are good people who leave their network open, so why would you be rude and abuse their printer?
The Internet DOES NOT MAGICALLY BECOME SECURE by using encryption on a local wireless network. No. If you are talking https then you have end-to-end encryption. If you are talking http then you do not. These are the facts regardless of you using encryption 10 feet between your laptop and your router.
If you want real security then use end-to-end encryption. If you do that then it no longer matters if that end-to-end encrypted connection goes encrypted or unencrypted through the air locally. "Securing" wireless networks in pointless and rude. It provides no security beyond your local network and it makes it harder for those good folks next door or folks who happen to park their car within range who want to update their facebook status or something.
9/11: Never forget it was a false-flag operation
Or those guys who just moved in, wanting to eat up your bandwidth downloading music and playing world of warcraft without paying for their own internet service?
Thinking that you shouldn't secure a wireless network is ridiculous. Do you leave your door open and encourage people to use the washroom? Do you leave your keys in the ignition to encourage your neighbours to do their grocery runs with your car?
If so, you are a very unique, not to mention naive character, who will only be taught once they get scammed.
May sound cynical, but my motto is: Assume the worst of people you will never meet.
You're wrong.
SSL doesn't always mean secure either.
See the third video here: http://www.defcon.org/#earlyVids
Small note of warning, not all routes like the arp-replay and crafted packets. Some low cost routers die from an arp 'flood', requiring a reboot.
If there were not evil people in the world and laws that will get you in hot water should that evil person use your network in a bad way, I'd agree. That's not the world we live in.
Yes from your LAN to the internet is wide open, all email from your ISP to another ISP is in the open (GPG if you care), but for me that's not the point of securing my WLAN. It's securing who accesses my internet connection which is tied to me personally, and without physically being in my home/office, WLAN is the only way to do so, so that's why I secure it.
I have a longer reply about this and the reasoning here:
http://mobile.slashdot.org/comments.pl?sid=1423971&cid=29918555
More information PLZ!
Some of us believe the internet should be free to use for anyone and everyone. There's a big difference between a personal vehicle (which itself is horribly inefficient and vain, but that's for another post), and access to a global information network where the only cost is related to the "onramp".
If someone drives off with your car, you no longer have use of your car. If someone checks their email over a small slice of your bandwidth, you're not being deprived of anything. All you really need to do is keep your internal network secure, and maybe put in some sane speed limits to deter abuse.
Wouldn't it be nice if all WiFi routers came with these features built-in and easy to configure ? I'd be fine with allowing web and mail traffic, but not idiotic Limewire and the virulent teens who use it. If it means I can whip out my laptop anywhere in the city and feed trolls on slashdot, or knock off a few work items while I wait for the damned bus to show up, then I'm all for moderate, conscientious sharing. It won't kill you, it won't help the terrorists win (hint: they won a long time ago), it won't replace your corn flakes with paint chips, so why are you complaining so much ?
I get that this is considered pinko/commie thinking, so all I can do is politely flip the bird and pray your so-called economy continues its freefall toward obsoletion.
-Billco, Fnarg.com
Does this guy not get it?
Linksys global network is your firend
WPA2 mandates the use of AES, so if you are running WPA2 you must already be using AES.
Can we please have a way to have secure _anonymous_ WiFi access?
Something like https/TLS? With https you don't need to give everyone passphrases or have them share the same passphrase. And the users can't decipher each other's traffic. Can we have something like that for WiFi please?
Combine it with something like ssh method: "WARNING! The AP's public key fingerprint has changed!". Then that's good enough, make the CA stuff optional.
Because, the CA system on browsers doesn't really improve security that much since there are tons of CAs bundled with browsers. And if one screws up and signs microsoft.com/somebank.com for the bad guy the browsers don't give a warning that the cert has changed, even if the original cert had years left before expiry. Whereas the SSH method will give you a warning.
I would have nothing opposed to sharing internet access if I was not aware of the dangers imposed with it. The problem with insecure routers is that you leave yourself open to whims of anyone who can use it.
You can leave it open, and share, and you'd be doing a good thing. You may never run across a bad guy in your life. Likewise, you can leave your car unlocked and no one will ever enter it.
But I personally have never been in the scenario where I KNOW my neighbours nor have I ever been in a situation where I Had my laptop with me and I wanted to check my email, thus forcing me to use someone elses wifi or using Wifi without paying for it.
If you can afford a Laptop nowadays, you can afford a decent phone, and you can use that for the internet.
The potential cost for someone malicious on your network doesn't approach the social good of you leaving it open to everyone. If you want to share it with your neighbours, send them the key.
Hardwire - its the future...
"In 2006, Bittau, Handley, and Lackey showed[5] that the 802.11 protocol itself can be used against WEP to enable earlier attacks that were previously thought impractical. After eavesdropping a single packet, an attacker can rapidly bootstrap to be able to transmit arbitrary data. The eavesdropped packet can then be decrypted one byte at a time (by transmitting about 128 packets per byte to decrypt) to discover the local network IP addresses. Finally, if the 802.11 network is connected to the Internet, the attacker can use 802.11 fragmentation to replay eavesdropped packets while crafting a new IP header onto them. The access point can then be used to decrypt these packets and relay them on to a buddy on the Internet, allowing real-time decryption of WEP traffic within a minute of eavesdropping the first packet."
http://en.wikipedia.org/wiki/Wired_Equivalent_Privacy#Flaws
From what I read that means there is current attacks that could bypass WEP in one packet.
Call me cynical, but I am not as trusting as you are.
First, people have been convicted (or found culpable) about activity done on IP addresses assigned to them. This by itself should get individuals to lock down their wireless routers.
Second, with someone clued enough to spoof their MAC address, by leaving an open AP, it gives them an untraceable base to actively hack from, with the onus of the attacks hitting the AP owner's shoulders. Almost all ISP contracts say that it is the responsibility of the subscriber for any security issues. Let an aspiring black hat go somewhere else.
Third, my ISP also has a contract that they can shitcan me off their network if I allowed open access. It might be worded differently, but it is there. It might be not enforced right now, but as audit tools and other items get better, it might be something an ISP can easily catch.
Fourth, unless I have two APs, or a VPN system, by not locking down my AP, I would be allowing any Tom, Dick, or Harry access to my LAN. This means they are a username and password away from a lot of juicy things such as an Exchange server, my Linux samba server, and so on. They can also try attacks on systems without any worry about being caught if they have any clue at all, even if they can't immediately guess my network topology (I have DHCP service turned off and a nonstandard address range, but that doesn't mean much to any clued attacker)
Fifth, and this is purely selfish. I don't feel like putting an AP that can do throttling or QoS. Usually someone hopping on someone else's wireless will end up doing high bandwidth P2P stuff. Where I live, they will be charging by the bit. I don't feel like paying for some freeloader's P2P session so they can download the latest pr0n sequel.
Almost everyone has an iPhone. Want to have a solid (but fairly low bandwidth) Internet connection? Jailbreak and tether your iPhone via Bluetooth or hard wiring to your PC. A lot of Windows Mobile PocketPCs even support tethering as a menu option without requiring any type of futzing to get it running. Or buy a Sprint or Verizon MiFi, chuck it on a table and connect your clients to that.
Until I am sure I have legal protection from criminal or civil offenses for people on my wireless, I'm not charged for their bits, and I feel like installing a system like NoCatAuth, I'm keeping my APs locked down (and usually turned off when I am not using a laptop.) Let other people who are naiive get sued for large sums of cash or face prison time because a blackhat paid their LAN a visit.
http://www.tntshoes.com
Oh geez. instead of alt+numbers, you could just type the numbers. I can't believe I didn't see that.
Can you be Even More Awesome?!