WEP Now completely useless: 104bit (128) key cracking in <1 minute

Impotence

Impotence

May the source be with u!
aircrack-ptw


WEP is a protocol for securing wireless LANs. WEP stands for "Wired Equivalent Privacy" which means it should provide the level of protection a wired LAN has. WEP therefore uses the RC4 stream to encrypt data which is transmitted over the air, using usually a single secret key (called the root key or WEP key) of a length of 40 or 104 bit.
A history of WEP and RC4

WEP was previously known to be insecure. In 2001 Scott Fluhrer, Itsik Mantin, and Adi Shamir published an analysis of the RC4 stream cipher. Some time later, it was shown that this attack can be applied to WEP and the secret key can be recovered from about 4,000,000 to 6,000,000 captured data packets. In 2004 a hacker named KoReK improved the attack: the complexity of recovering a 104 bit secret key was reduced to 500,000 to 2,000,000 captured packets. In 2005, Andreas Klein presented another analysis of the RC4 stream cipher. Klein showed that there are more correlations between the RC4 keystream and the key than the ones found by Fluhrer, Mantin, and Shamir which can additionally be used to break WEP in WEP like usage modes.
Our attack

We were able to extend Klein's attack and optimize it for usage against WEP. Using our version, it is possible to recover a 104 bit WEP key with probability 50% using just 40,000 captured packets. For 60,000 available data packets, the success probability is about 80% and for 85,000 data packets about 95%. Using active techniques like deauth and ARP re-injection, 40,000 packets can be captured in less than one minute under good condition. The actual computation takes about 3 seconds and 3 MB main memory on a Pentium-M 1.7 GHz and can additionally be optimized for devices with slower CPUs. The same attack can be used for 40 bit keys too with an even higher success probability.
Countermeasures

We believe that WEP should not be used anymore in sensitive environments. Most wireless equipment vendors provide support for TKIP (as known as WPA1) and CCMP (also known as WPA2) which provides a much higher security level. All users should switch to WPA1 or even better WPA2.
Click to expand...

As the attack only requires ARP requests / replies it would be possible to attack an access point with no authenticated clients as long as something generated an ARP request on the wired side, such as a computer or even the router itself!
 
Eeep, things have gotten even worse since I did my dissertation on the subject, but still just imagine if everyone just chilled out, stopped being nasty and joined the Community Wireless Network (wiki) philosophy.

I know it'll never get full realisation, but man... just imagine
 
The problem comes about when you CANT have an open network as you have sensitive data moving accross it...

WEP has been known to be broken for quite awhile, but its use is very widespread... for example, of the ~300 AP's ive seen near me (not going to say where this was :P)

~140 used a 40bit wep key
~90 used no encryption whatsoever (and most had the default SSID)
~50 used a 102bit wep key
~20 used WPA

all WEP's usefull for now is a sign saying 'private property, go away please'
 
Ive always seen WEP recently as a method of a 'private property, go away please' sign, after seen it done the 'long' (14 mins :P) way on a 40 bit key, but will this change anything among the non geek computer users? No i dont think so. So i can see this being a way to extend a hobby....
 
I am assuming your router doesn't support WPA then...

Most routers support WPA, and if not its the sort of thing i think should be possible with a firmware upgrade :) (i haven't checked this though)

If it is possible, i wouldn't be surprised if netgear didn't do it.... to try and force you to buy a new router, if so, check out OpenWrt for a possible solution.
 
I think the main point to think about is that it will keep your neighbors out, which is all 95% of the population actually care about...

Out of all the 10000's of people we will meet in our lives, what percentage will have any clue what this thread is even about (let alone be able to carry out such an attack).

I only use a 64bit WEP key, why? because its easy and im not dealing with sensitive data (The only 'sensitive' data that is very rarely carried by my network travels through a VPN anyway).

All i have to worry about are the family winblowz machines being owned, but i do have plans to monitor them (SNORT? i have a switch with an uplink so it shouldn't be too hard)
 
You must log in or register to reply here.
Back
Top