Slashdot Mirror
A New Wi-Fi Exploit, Limited But Clever
eggboard writes "Martin Beck, who in 2008 co-wrote a paper describing a way to inject packets into a secured Wi-Fi system, is back with a more extensive exploit. His 'Enhanced TKIP Michael Attacks' still don't allow extraction of a key, and are limited to TKIP (not AES-CCMP) WPA-protected networks. Still, he's figured out how to put in large payloads, and to extract data sent from an access point to a client — all without cracking the network key. The attack requires proximity to sniff and inject data, but it's another crack in the older key standard (TKIP) that no one with serious security interests should still be using." Here is Beck's paper (PDF) describing the new attacks.
That's what I always do.
Since I have an unnatural fear of vowels I'm waiting for a protocol who's acronym is constructed solely of consonants.
This still can be worked around by spoofing MAC addresses, but every thing you do to secure your wireless network helps (hidden SSID, etc).
From TFA:
As with the previous attack, a lot of stars have to be in alignment. The biggest requirement is that TKIP has be the key type, not AES-CCMP. An attacker has to be proximate to sniff traffic and inject packets. The router has to be running Linux, like many Wi-Fi routers do. The router doesn't need to be compromised; there's a particular Wi-Fi packet sequence that's more predictable, and thus easier to use in the attack. Network QoS (802.11e/WMM) needs to be enabled as well.
It hits in an hour at 11:19 AM local time (1:19 PM pacific time) so put your birth certificates in a safe place.
TKIP and CCMP are both vulnerable to cracking still. People can go in, wait, deauth you, steal your 4-way handshake, and dump the file on a computer or cluster, and have your password quickly.
How about ethernet? No? Well, make sure it's WPA2 Enterprise with a very long password, hidden, etc.
if you need really good security in your wireless, JUST LEAVE IT OPEN. ;)
And use a vpn of course
ipsec is widely supported, but openvpn is a good choice too.
secure, encrypted, configurable, and with YEARS of testing behind!
Annoyingly, I can think of two devices that can't cope without TKIP under WPA2. The older Apple Airport Express and a Linksys wireless bridge.
Without TKIP, these two devices have effectively become expensive (when they were purchased, at least) door stops. It's aggravating, because they both advertised support for WPA2-AES!
Re: wi-fi security, what's to stop someone from creating a hotspot with the same SSID and just wait for the user to provide their credentials when they try to re-login? The average user will probably just go ahead and re-enter their password. No need for breaking any encryption, just a bit of social engineering.