New attack cracks common Wi-Fi encryption in a minute

Network World ^ | 27 August 2009 | Robert McMillan

[ShadowAce]

Computer scientists in Japan say they've developed a way to break the WPA encryption system used in wireless routers in about one minute.

The attack gives hackers a way to read encrypted traffic sent between computers and certain types of routers that use the WPA (Wi-Fi Protected Access) encryption system. The attack was developed by Toshihiro Ohigashi of Hiroshima University and Masakatu Morii of Kobe University, who plan to discuss further details at a technical conference set for Sept. 25 in Hiroshima.

Last November, security researchers first showed how WPA could be broken, but the Japanese researchers have taken the attack to a new level, according to Dragos Ruiu, organizer of the PacSec security conference where the first WPA hack was demonstrated. "They took this stuff which was fairly theoretical and they've made it much more practical," he said.

They Japanese researchers discuss their attack in a paper presented at the Joint Workshop on Information Security, held in Kaohsiung, Taiwan earlier this month.

The earlier attack, developed by researchers Martin Beck and Erik Tews, worked on a smaller range of WPA devices and took between 12 and 15 minutes to work. Both attacks work only on WPA systems that use the Temporal Key Integrity Protocol (TKIP) algorithm. They do not work on newer WPA 2 devices or on WPA systems that use the stronger Advanced Encryption Standard (AES) algorithm.

The encryption systems used by wireless routers have a long history of security problems. The Wired Equivalent Privacy (WEP) system, introduced in 1997, was cracked just a few years later and is now considered to be completely insecure by security experts.

WPA with TKIP "was developed as kind of an interim encryption method as Wi-Fi security was evolving several years ago," said Kelly Davis-Felner, marketing director with the Wi-Fi Alliance, the industry group that certifies Wi-Fi devices. People should now use WPA 2, she said.

Wi-Fi-certified products have had to support WPA 2 since March 2006. "There's certainly a decent amount of WPA with TKIP out in the installed base today, but a better alternative has been out for a long time," Davis-Felner said.

Enterprise Wi-Fi networks typically include security software that would detect the type of man-in-the-middle attack described by the Japanese researchers, said Robert Graham, CEO of Errata Security. But the development of the first really practical attack against WPA should give people a reason to dump WPA with TKIP, he said. "It's not as bad as WEP, but it's also certainly bad."

Users can change from TKIP to AES encryption using the administrative interface on many WPA routers.

[djf]

Unsecured users are EXTREMELY common.

Years ago I got my hand on a Linksys wireless card. I didn’t have a service or a provider, so it sat on the shelf for a while.

Well, one day I plugged it in just to see and the darn thing connected!!

My neighbor had wireless with no security turned on.

So a couple months later. I charged the laptop battery good, set it on my front seat in my car, and just for the hell of it, started Network Stumbler and drove aroung the block.

I was hitting two to four wireless networks per block. Half or so of them unsecured.

The reason is people, probably most people, don’t want to be network engineers, they just want it to work out of the box. So they get the hardware, plug it in and turn it on, then do the minimal amount they need to get connected.

Part of the problem also being the people who run unsecured networks are also the people who never turned off sharing for their files and folders. Odds are very, very high that they’re infected.

[ken in texas]

Do you have FIOS? My Verison FIOS router came with a default WEP key based on the MAC address. If you could get the router’s MAC address, you basically had the key. First thing I did was change the key.

[Califelephant]

Thanks Ken ... yes, I think there is a way to access the FIOS router from my PC ... I’ll spend some time figuring out how to do that (and change my key), this week.