Wednesday, April 4th 2007
WEP Encryption Completely Broken
WEP (Wired Equivalent Privacy), the technology used to secure many wireless networks around the world, has been demonstrated to be extremely insecure in new research by a team of cryptographic researchers at the University of Darmstadt in Germany. Using information collected by previous studies that demonstrated correlations in the encryption used by WEP, the team found that they could recover a 104-bit WEP key 50% of the time using just 40,000 captured packets, increasing to a 95% success rate with 85,000 packets. To put it into perspective, 40,000 packets can be captured in under a minute, and a 1.7GHz Pentium M can them work out the WEP key in about three seconds. WEP has been known to have security flaws since 2001, but this latest research demonstrates how weak the technology has become in recent years - if your hardware supports WPA or WPA2 it is highly recommended that you shift to that if you are worried about keeping hackers out of your wireless network.Source:University of Darmstadt via The Inquirer
28 Comments on WEP Encryption Completely Broken
I used WEP until a few months back, and the only reason I didn't use WPA then is because I was bridging two wireless routers. I would hide my SSID but some laptops that use the LAN can't connect then...
b) Hiding SSID is useless. Do you really think antennas then don't capture packets flying around? They do, I don't even have to send a packet, I just passivly sniff whatever comes in my way. Disabling SSID broadcasting only disables the response if a client asks around "hey, any APs there?". So anyone who wants to WILL SEE your WLAN, will take no time at all.
b1) Disablind SSID broadcasting is annoying. If people who do not know much about WLANs will see *nothing* and this just use whatever channel they want. But what if one or even many other APs in the area (yeh, the APs of cool *secure* people) use the same channel? It may or most certanly will interfere with your WLAN if they are close enough.
oh and c)
Anyone who can read can crack WEP, honestly... It IS that easy. I almost fell off my chair when I read that, lol
I know, I'm stupid. And proud to be.
look for knoppix-std v0.1, s-t-d.org/...this is the only few that can do the job.
Mac filter are not crap, unless you dont know which address are programed in to the router, how in hell are you gonna spoof?
Also, have anybody sniff packets out? Its not a 1-2 min thing...it can take couple hours to days...and the get a clean crack, a good whole week or so.
If you can read, you can wep crack eh? Why dont you type a nice doc on how to do so. For crack wep has been such an old thing, i have yet see a proper setup that can do the job without a hitch. Plus some peeps can have 4 wep keys that rotate? start capturing packets, than swtich...all that you caped is waste.
I do enjoy the networks everywhere I go that do give my laptop access.
I was surprised about a month ago I downloaded a trial for a mac sniffer. It gave me every mac, ip, and comp name on the network. And when done gave me the pleasant option of setting my mac to what I wanted. All for FREE
b) Yes, macspoofing requires a client which is connected to the AP so you can use that MAC address. Either wait until it disconnects, or just throw it of the network and connect yourself ;)
c) Lets see,... passivly capturing takes long yes, thus we activly *capture* by creating the needed traffic. And with that new attack you need even less IVs, not 500.000-1.000.000 but less than <100.000.
I saw WEP being broken in less than 2 Minutes with that new attack :)
d) Uh, google, that's what I did.
The programs are NOT 802.11b only - i have NO idea where you got that from.
Look up air crack, it comes with all the other programs needed, and everything works fine under windows assuming you can get the right drivers for your card.
and for the record hiding your SSID wont really protect you. as long as you are broadcasting some sort of signal someone somewhere can access it with the right tools. now granted the easiest way to avoid having your internets stolen is to hide SSID and to have a complicated access code which changes every month and to use WPA. although that isnt completely secure either. the point is to make it as hard as possible so the potontial hacker will try an easier target. even for an experienced hacker it will take several hours to capture enough packets from your signal to put together some sort of key and then several days to actually crack that information into an access code.
some i stuff i use with freebsd are aircrack-2.41, bsd-airtools-0.3, kismet-2007, and wistumbler2