WPA-TKIP Cracked

Oh, them crazy Japaneseses. WPA2 with MAC address filtering here. I like to think I'm pretty safe.
 
Fun times: accessing someone's router and changing their SSID to something like "CHILD PORNOGRAPHY."

I did that to a friend, actually. He kept it.
 
WPA-TKIP was already hacked. it just used to take 10 to 15 minutes, now they found a way to do it in 1 minute flat.

that said, TKIP is mostly used in cheapass routers. nearly everything about 50 euros has AES or WPA2.
 
Since the dawn of time, people have been building castles. Equally as long, there have been people on the other side of the castle walls, building trebuchets.

I think my point is clear. :wink:
 
DexterMorgan said:
WEP has been unsafe for years now, but now them wacky Japs managed to crack WPA-TKIP encryption. Apparently it only takes about a minute, better update your routers!

WPA2 and WPA-AES are still safe.

http://www.networkworld.com/news/2009/082709-new-attack-cracks-common-wi-fi.html
Click to expand...

NICE! I saw this network world e-mail come across my INBOX yesterday and was intrigued by the header but never got to read it. I forgot all about it, thanks for the link!
 
actually all forms of security/encryption in 802.11 G have been broken in as few as 10-15 seconds.

what they are doing is decoding the information stream and generating the key and such.

the much simpler method is much easier to crack it.

the easiest way to crack any g encryption method is to send out a signal strong enough to reset the session between device and PC, and examine the initial packets being sent to negotiate the connection. usually takes 2-3 session resets to crack it.

and as far as i know, there is no security measure for the routers/POPs to detect that kind of attack.
 
The reason WPA and WPA2 networks are more difficult to crack is because the encryption keys change. So unlike WEP, you can't simply sniff enough traffic and decode the key. WPA and WPA2 nets have (or now, had) to be brute-forced through repeated authentication attempts. This however is slow and if the key is complex (it can be 63 chars long) nigh-impossible. Works only for PSK (pre-shared key) authentication, other types are far more difficult to crack. If the network uses certificate based auth... well, good luck trying to hack that.

And there are systems out there that detect rogue stations and then match their frequencies in order to neutralize them.
 
its actually really easy to crack...

when your device is negotiating the connection with the router/POP you can sniff the first few packets as those will always have the negotiations with the encryption in them.

to secure a wireless connection, you cannot ever transmit the encryption method or key. and all of them do.

i do not know of a single wireless encryption method that does not involve transmitting the key or encryption method within the first few packets.

although i have not looked up how certificate handles the encryption, PSK and other similar methods all transmit the key within the first few packets. once you have the key, you are golden.

and MAC filtering will not really stop a hacker. you can spoof MACs. once you spoof the MAC, it all comes down to who negotiates the connection first, the hacker or the legit device.
 
While basically true, you're forgetting to mention that keys being transmitted are NOT sent in plaintext and are far from easy to crack. Without going in depth of the whole 4-way handshake of WPA (which I don't understand all that well anyway), I'll copy paste from the relevant document on wireless security:

The protocol design (4096
hashes for each password attempt)
means that a brute force attack is
very slow (just a few hundred passwords
per second with the latest
single processor).
The PMK cannot be pre-computed
since the passphrase is
additionally scrambled based on
the ESSID. A good non-dictionary
passphrase (at least 20 characters)
should be chosen to effectively protect
from this flaw.
Click to expand...

Now, brute forcing a password that can be 63 chars in length at few hundred attempts per second takes forever and is nigh impossible when a strong PSK is used due to a high number of permutations. I don't know what method the japs used to crack this yet.

And yes, spoofing a MAC is trivial and they're transmitted in unencrypted headers, so it's more an inconvenience rather than a real obstacle.
 
Of course no security is infallible, but with the right measures you can protect yourself against the majority of people that would take advantage of your network. It's like having a lock on your front door. Keeps the "honest" ones out. Won't stop shit if someone really wants in your house, since they're willing to break your door or window to get inside.

In addition to the security I have in place, I'd adjusted the transmitting power of my router (<3 Tomato firmware) so that it dies out only a short distance away from my house. I'm still able to access it from anywhere inside, but more than thirty feet outside and it's no-go. Unless I have a knowlegable and determined person (or genetically altered squirrels) living in my bushes, I've nothing to worry about.
 
What's the point?

Having an unsecure network as default is one of the most viable defenses in court whenever it comes to piracy.
 
I`ve found that just not using wlan is the best defence. I also keep my router inside steel pan just in case, so if my neighbours arent willing to drill to make physical connection somewhere along the way i think im quite safe.

Yeah, maybe im bit paranoid.
 
Wooz said:
What's the point?

Having an unsecure network as default is one of the most viable defenses in court whenever it comes to piracy.
Click to expand...

Trust me, it no longer works like that. Ignorance is not an exception to the law in the USA. I've seen many instances where the book was thrown at the individual for having an unsecured network.

A good portion of my work-description is track down and call people with unsecured networks and give them the chance to secure it before their lives are utterly ruined...
 
SSID and MACs are transmitted in plaintext

SSID is the first thing in a wireless packet
 
DexterMorgan said:
Are you kidding? On what grounds do these people get prosecuted?!
Click to expand...

Let me put it this way. If you committed a crime, but you were not aware of the laws against your actions; would you expect to get let off with a warning if the crime caused a company big dollars? Before you answer, ask yourself, WDKMD? (What did Kevin Mitnick Do) :P

Not exactly the same story -but close nonetheless. Kevin felt he was just a broozin' a computer network that was negligently left wide open and figured, no different than finding a $20 dollar bill laying on the street.

More and more copyright agencies and those they represent are looking at how to stop the bleeding. What will be the biggest bang for their buck. We've all heard about the horrid law suits against elderly grandparents because their children used their Internet connection to download thousands of songs. Were they not just as ignorant as those providing Internet to anyone in range?

Interestingly pornographic copyright holders have started tracking down those sharing their property illegally. If you think it an awkward task to call ol' grandma Wilbur and explain someone using her internet connection was downloading Harry and the Henderson's and on top of that, describing to her the TV program; well, you could only imagine what it would be like calling Pastor McCay's wife and explaining that someone's downloading Naughty Tranny Nurses 6 -and finding there is no wireless network...

Many of the pornographic copyright holders now give you an option to "pay up". They request you pay fifty dollars which to me would be nothing more than an admission of guilt but I doubt they see it that way, its just quick money.

Now here is the kicker of all these copyright infringement allegations. Roughly 75% of the time no one bothers to do their research. They get an IP address, look it up and fire off a threat of legal action. The other 25% actually bother to provide irrefutable evidence that the IP in question was the one committing the violation, DNS info tied to that IP.

I imagine the likelihood of any successful legal action against said violator would have to come from that 25% if its ever to hold up in court... Then again, most ISP's don't require that information, they reach the maximum amount of infractions and ban that user from their network as outlined in their Acceptable Use Policy. And almost ALL ISP's state that those running a open wireless network are in "violation" of their AUP. I use quotes because we all know its just a escape clause but one that I've seen used from time to time. It's not worth the company's necks to provide Internet service to a potential copyright violator.
 
You must log in or register to reply here.
Back
Top