Print 52 comment(s) - last by glennpratt.. on Dec 4 at 1:15 AM

Bring your laptop, leave your dictionary

A pair of security researchers claim to have partially cracked WPA encryption, with an attack that takes around 15 minutes.

The technique relies on an undisclosed “mathematical breakthrough,” say researchers Erik Tews and Martin Beck, and breaks the Temporal Key Integrity Protocol (TKIP) key used to encrypt data between a wireless router and its clients. Currently, the attack works only one way: data traveling from the access point to its clients is vulnerable, while data traveling in the opposite direction is not.

The only other known, effective attack against a WPA connection relies on computationally-intensive dictionary attacks, which involves testing wireless data against an extremely large list of educated guesses until one of them successfully decrypts the data in question.

Tews and Beck’s attack lowers these requirements considerably, allowing anyone with the knowledge, a laptop, and 15 minutes of time the ability to listen in on one side of a WPA-encrypted wireless connection.

CNet notes that Tews is no stranger to wireless hacking, as he also co-authored a 2007 paper (PDF) discussing how to crack a 104-bit WEP key in 60 seconds.

The duo will reveal their findings at next week’s Tokyo, Japan-based PacSec security conference in a presentation titled, “Gone in 900 Seconds, Some Crypto Issues with WPA”.

According to PC World, some of the pair’s research already is already appearing in wireless security tools.

Companies and internet users looking to keep their wireless networks secure will have to upgrade to WPA2 now, says PacSec organizer Dragos Ruiu.

“Everybody has been saying, 'Go to WPA because WEP is broken,'” he said. “This is a break in WPA.”

While it is too early to tell how the WPA attack will be exploited by criminal organizations, many companies are still in the process of transitioning to WPA from weaker standards like WEP, or no encryption at all. Hackers hit one such company, T.J. Maxx, in January 2007 from secured WEP access points; they ran off with one of the largest credit-card hauls in history and caused more than $200 million in damage.

Comments     Threshold

This article is over a month old, voting and posting comments is disabled

RE: WPA? TKIP? Pfah!
By JonnyDough on 11/7/2008 9:48:04 AM , Rating: 3
Unless you live in a really crowded apartment complex, the odds of being hacked when you're using WPA is almost zilch. Out in the country on a big acreage you almost wouldn't even need encryption, but I'd still use it. It also helps to make your network invisible, as in...set it so the name won't appear unless someone knows what they're doing to be able to see it.

RE: WPA? TKIP? Pfah!
By Hare on 11/7/2008 9:54:52 AM , Rating: 2
It also helps to make your network invisible, as in...set it so the name won't appear unless someone knows what they're doing to be able to see it.

No it doesn't. Hiding the SSID does absolutely nothing, the access point still exists and can be seen by anyone if they simply use a hotspot sniffer that lists access points that have hidden SSID.

Mac address filtering and SSID hiding are completely unnecessary and offer no real security benefits.

RE: WPA? TKIP? Pfah!
By FITCamaro on 11/7/2008 10:06:20 AM , Rating: 2
His point is that most don't have a sniffer. Granted anyone who is capable of hacking your network to begin with likely does.

RE: WPA? TKIP? Pfah!
By Hare on 11/7/2008 10:51:17 AM , Rating: 2
If someone is worried about security it shouldn't matter. With that logic, WEP is "secure" because many people don't have the tools to break the encryption. If someone wants to get to your network, hiding the SSID and having MAC-address filtering is completely pointless.

There are countless freeware apps that show also access points with hidden SSID. I personally use network stumbler (not for malicious purposes). I just want to see all access points in the neighbourhood so that I can pick a channel that has least traffic. Hiding the SSID is just the access point saying that please don't list me. It's up to the wlan client to decide wheather or not the AP is actually listed or not.

RE: WPA? TKIP? Pfah!
By JonnyDough on 11/7/2008 5:29:40 PM , Rating: 2
That was exactly my point.

RE: WPA? TKIP? Pfah!
By mindless1 on 11/8/2008 10:41:05 AM , Rating: 5
That's naive. Anything you do offers real security benefits, just like locking your car door offers real security benefits even if it's still hypothetically possible to break in. There is no absolute in security, just degrees of risk and degrees of managing it.

RE: WPA? TKIP? Pfah!
By glennpratt on 12/4/2008 1:10:06 AM , Rating: 2
Oy, misguided car analogies on tech forums.

If you must, SSID cloaking is like putting a piece of tape over the door handle and MAC address filtering is like requiring a code to start the car, except that code is written down all over the place inside the car.

The point is, WPA2 with nothing else is very secure today. SSID cloaking and MAC address filtering are not, they will only prevent uninformed people from hijacking your internet access - but then so will WPA1 and it will provide a good level of protection for now, so why bother with hacks.

RE: WPA? TKIP? Pfah!
By Murloc on 11/7/2008 10:01:38 AM , Rating: 2
I don't think someone will hack your wireless connection, unless you are sooo important and you work with secret things.

I can't see the problem in upgrading the protection.

RE: WPA? TKIP? Pfah!
By Yawgm0th on 11/7/2008 11:30:12 AM , Rating: 2
How about to steal bandwidth and commit crimes using your Internet? Or maybe just to sniff your traffic and grab your credit card or bank account information when you go online. A report I read not long ago (I want to say DT posted it, come to think of it) indicated many bank's web sites don't even have SSL properly implemented when you go to login, so that a MitM attack could easily grab your bank info.

I'm tired of this fallacy that if you are just some residential user that there is no incentive to break into your wireless.

RE: WPA? TKIP? Pfah!
By Suntan on 11/7/2008 12:58:00 PM , Rating: 2
I'm tired of this fallacy that just because you are on wireless, someone is going to steal your CC number or your network bandwidth.

I have the wireless router in the basement, with stucco siding (metal lath inside it makes a nice faraday cage.) You can't get a signal from the street even with a directional antenna. You can get one if you are about 50 feet from the back door, or to put it another way 30 inside my back yard.

Yeah, I suppose a couple of goons can ride up with a really elaborate antenna setup to hear my wpa network. Or go commando in the middle of the night and setup in my backyard. I'm guessing I have more to worry about when Jimmy at Red Robin walks away from our table with my CC, that I just gave him to ring up, though.


RE: WPA? TKIP? Pfah!
By GaryJohnson on 11/8/2008 8:23:59 AM , Rating: 2
If Jimmy at Red Robin walks away with your CC your going to know it's gone and you can cancel it. What's bad is when you're at Red Robins and Jimmy goes to ring you up and those goons with the antenna setup have left you with a $0 balance.

RE: WPA? TKIP? Pfah!
By glennpratt on 12/4/2008 1:15:32 AM , Rating: 2
Here's the problem, when virtually every one else in the world could have the same vulnerable setup. Sure, odds are it won't happen to you - but it probably will happen to someone.

Frankly, it's pretty rare that any news will apply directly to you, so I don't know why you act like you surprised in this case.

"I want people to see my movies in the best formats possible. For [Paramount] to deny people who have Blu-ray sucks!" -- Movie Director Michael Bay
Related Articles

Most Popular ArticlesAre you ready for this ? HyperDrive Aircraft
September 24, 2016, 9:29 AM
Leaked – Samsung S8 is a Dream and a Dream 2
September 25, 2016, 8:00 AM
Inspiron Laptops & 2-in-1 PCs
September 25, 2016, 9:00 AM
Snapchat’s New Sunglasses are a Spectacle – No Pun Intended
September 24, 2016, 9:02 AM
Walmart may get "Robot Shopping Carts?"
September 17, 2016, 6:01 AM

Copyright 2016 DailyTech LLC. - RSS Feed | Advertise | About Us | Ethics | FAQ | Terms, Conditions & Privacy Information | Kristopher Kubicki