AfterDawn: News

Researchers find cracks in WPA wireless security

Two researchers plan to provide details at next week's PacSec 2008 conference in Tokyo on how Wi-Fi Protected Access (WPA) is vulnerable to attack. Of course, this does not mean that WPA is as vulnerable to compromise in the same way that Wired-Equivalent Privacy (WEP) is, far from it in fact. The weakness in WPA is being reported by Martin Beck and Erik Tews, two graduate students in Germany. The attack could make it possible to compromise certain communications in less than 15 minutes.

The researchers found the weakness in the lesser of two WPA security protocol, Temporal Key Integrity Protocol (TKIP). Attackers can use the techniques to decrypt limited communications and can recover a special integrity checksum and send up to seven custom packets to clients on the network, according to SecurityFocus.



"The new attack on WPA is not a complete key recovery attack," Tews said in an email to SecurityFocus. "It just allows you to decrypt packets and inject packets with custom content. But there is only a single short-term key recovered during the attack."

More details of the attack:
http://www.securityfocus.com/news/11537

Written by: James Delahunty @ 9 Nov 2008 22:54

• Previous article

• Journey catalog track becomes first to 2 million downloads, legally

• Next article

• Sirius-XM channel merging to begin next week

• 5 comments

• Leningrad

  It wont be long before they crack LEAP and cisco will go whining.

  10.11.2008 16:22 #1

• borhan9

  So does this mean that it just basically goes against our internet quota?? Quite fasinating i will read on this has got me thinking.

  10.11.2008 18:30 #2

• varnull

  They aren't telling you the full picture.. It's been possible to crack wpa-psk for ages.. You just need the time to sniff the communications for long enough and you well get the key req/ack pairing you need to spoof a valid network device.. It just takes waiting for a device wanting to connect.. say a laptop being booted while you are listening to the packets flying about... exactly the same way as with bluetooth.. except to actually get in the loop with that the handset needs to accept the connection... remember "press OK to accept incoming"?.. a router doesn't ask for that manual confirmation... get the reply string right and it is happy....and you just had both halves of that didn't you.. through your sniffer?
  
  Again.. too much info.. shutting up now.
  

  
  
  Free open source software = made by end users who want an application to work. The flower of carnage-shura no hana..

  10.11.2008 18:42 #3

• onya

  Originally posted by Leningrad: It wont be long before they crack LEAP and cisco will go whining.
  
  

  
  

  11.11.2008 02:02 #4

• hermes_vb

  WPA is fine. The dangers of such a crack in the real world are minimum at best. If you are still worried about being hacked just use WPA2 with AES instead of TKIP.

  18.11.2008 09:21 #5