Slashdot Mirror
WPA2 Wireless Security Crackable WIth "Relative Ease"
An anonymous reader writes "Achilleas Tsitroulis of Brunel University, UK, Dimitris Lampoudis of the University of Macedonia, Greece and Emmanuel Tsekleves of Lancaster University, UK, have investigated the vulnerabilities in WPA2 and present its weakness. They say that this wireless security system might now be breached with relative ease [original, paywalled paper] by a malicious attack on a network. They suggest that it is now a matter of urgency that security experts and programmers work together to remove the vulnerabilities in WPA2 in order to bolster its security or to develop alternative protocols to keep our wireless networks safe from hackers and malware."
This sounds like the classic de-auth, handshake capture, then brute force attack.
It's still a bitch to crack without G.O. resources. Moxie has a service that will try for you...
Every encryption scheme will fall at some point. Once quantum computing fully arrives, I guess encryption will be mostly moot.
Reads article...
Longer passwords make brute force cracking more difficult... Possible attack vector via the wireless de-authentication and re-authentication that WPA2 connections maintain for clients... With potential fast scanning and proper spoofing, an intruder could knife their way it...
Why does this feel like nothing new?
How do you keep something you never had?
“He’s not deformed, he’s just drunk!”
At least use MAC filtering and Pre Shared Keys together with WPA2, this will lower the probability of a successful attack happening.
You can't handle the truth.
I already have to tell friends and family to use a alphanumeric password not based on a dictionary word - I was helping a friend find out why her wireless charges were so high, and using backtrack and some basic documentation - (knowing almost nothing about wireless security) - I was able to find out her wireless password based on the fact she was using a regular word in my dictionary list
wireless = never safe
----------
ah honey, we're all resplendent - Bill Mallonee
I understand this is about recovering the PSK. This would mean that authentication using a certificate, such as EAP-TTLS is still safe. Correct?
So you can read this totally unencrypted message I just posted? I don't know why I even enabled WPA2, I expect it was the default setting. WPA2 keeps the neighbors from eating mah bandwich?
Brute force attacks compromise simple passwords?
This is news?
_ _ _ Go for the eyes Boo! GO FOR THE EYES!
This attack has been known for years. Am I missing something? How is this \news\ ?
The only reason I encrypt my wifi connections is to prevent casual wanderers from connecting to my network and sucking up bandwidth. Any data that needs securing is encrypted by the computer, not by the modem/router.
If I could get proper password protection without the encryption, I wouldn't bother encrypting the traffic. I could care less who snoops it -- so long as they're not sucking up bandwidth.
I do not fail; I succeed at finding out what does not work.
If you are even the slightest bit concerned with the security of data on your network, isolate wireless completely from your secure data. In my very unscientific estimate it seems 90%+ of the usefulness of wireless is for just basic internet access for executive types anyhow who don't need to be checking production data.
Its behind a cowards pay wall. THe link at the bottom is for the fraud article about the Wi-Fi virus that can magically infect all computers and wireless routers. Man do I love not having to expose "research" to public scrutiny.... What a cushy life.
NSA says we'll hack whatever we want fuck you citizen
and where are your papers....
If anyone can find a backdoor it will be three Greek guys.
What has limited the attack number in WPA-PSK? That's the question I have after reading all the data that is freely available. From what I know and can gather about this, the researchers found a way to reduce the amount of brute forcing required to guess the key in WPA-PSK. They used something in the de-auth and probably re-auth after that to gather information about the key to do so.
Paywalling this information is a bad thing. Either do a full disclosure, or keep it secret and notify all vendors that are vulnerable. What we have now is Fear, Uncertainty and Doubt. The result will be that the bad guys will find out how it's done and implement a practical attack that we don't know how to detect or defend against. Alternatively, a white-hat will find out or pay for the article and publish it. That will probably result in the white-hat getting sued for leaking the information in the article. Regardless what will happen, this is probably the worst way to tell the world of a security vulnerability in a product used world wide by over a billion people.
Universities should stop requiring publication in papers that aren't free to read, or free to publish in. The quality of the paper is of secondary importance to the magazine if people have to pay to get published. The reach to people for which the research is relevant is limited if the audience has to pay for reading the article. In my opinion, requiring at least three positive peer reviews from other universities or something similar, would be a much better way to make sure that research is up to standards and relevant than a short list of places that will publicise a paper. Reviewing papers from other universities should be part of the mandatory tasks students have to fulfil in order to be allowed to write their own paper.
I was promised a flying car. Where is my flying car?
Maybe the harder we try to secure the harder "they" try to circumvent it. I hardly think you have such sophistication in attempts to break into home WiFi. This really is more about sensitive business related networks. Which in my opinion is a problem anyway using any kind of wireless connection. Maybe the point is that any wireless connection should be considered more vulnerable then a wired one?
It's called 802.11w and introduces encryption on management frames (so de-auth attack is out), this problem is solved. It's up to vendors/developers to implement it.
So you start with a bational campaign and a computer database of those people and somehow months later the ones getting gassed are those who supported the idea. Weird eh?
Who would have thought a pre-shared key scheme could be so difficult to make secure? Pre-shared key? There's 90% of the sodding work done for you.
This article is a really takes a really roundabout way to tell you computers are getting faster...
TFAbstract says that WPA2 can be cracked with brute force search, and that long passwords are more secure than short ones. Looking up the home pages of these internationally renowned researchers http://www.brunel.ac.uk/bbs/pe... http://issel.ee.auth.gr/people... http://www.research.lancs.ac.u... reveals that these three claim no other security-focused publications. But perhaps I'm too quick to judge. Somebody pay the man and read their paper. Or is this the two-step get-rich-quick scheme?: - (1) Publish Paywalled Article Exposing Security Holes in Commonly-Used Security Protocol (2) Profit! (PPAESHiCUSP-P)
Having a wireless network amounts to giving those in close proximity physical access to your infrastructure. Try to protect it as you may, it's still physical access (more or less) and will be breached at some point. Simply cordon off your wifi so that when it is inevitably breached there is little value to the person who has breached it (a lot of work for little payout). As an absolute rule, my computer connects to an SSL VPN any time it's connected to wireless (at work, home or on the road).
What they should also do is add a DHE exchange as well. As it currently stands, by sniffing the handshake, the only part that is missing is the PMK. Once you brute that, you can get all traffic. Instead they should use the current process to encrypt the parts of a DHE exchange and use that to encrypt the PTK. It would not only make brute forcing much harder, it would also make the results of which basically useless for traffic captured in the past.
It's called 802.11w-2009. 2009 as in "Five fucking Years Old". Part of the updated 802.11-2012 standard. Supported by most modern OS under the condition that the fucking wireless drivers support it. It protects against fucking deauth frames and spoofed broadcast frames by signing them.
http://en.wikipedia.org/wiki/IEEE_802.11w-2009
It does not protect the initial connection though. For that, there this little thing called "Simultaneous Authentication of Equals" that got out somewhere in 2011 initially for 802.11s, that promises unbruteforcable authentication based on eliptic curve cryptography. But unless you only use Linux AP and clients, you can fuck off before you will be able to use it, and it need to be fuckingly audited serously to know if it is actually secure.
http://www.inderscience.com/storage/f212115103871469.pdf
This paper is ridiculous!
The "renowned researchers" just learn how to user aircrack-ng and published this piece of shit as a super new hacking technique... and thanks to slashdot to hipe this shit.
I emailed one of the authors and they sent me the PDF, which I as the anonymous coward I am uploaded here: https://anonfiles.com/file/f6933309e8b215470e015ce2427e239d
I read the discussion about this paper on reddit, and saw someone post a link to the pdf on their homepage. I am not posting the link to the pdf of this article, but merely pointing out that this dude on reddit posted it on his/her homepage at http://pastebin.com/aKMWbgq2