WEP Gone in 60 Seconds?

Rich Tate

Supreme [H]ardness
Joined
Jun 9, 2005
Messages
5,955
According to this article, if you rely on WEP encryption you might not be as safe as you think.

As Erik Tews, Andrei Pychkine and Ralf-Philipp Weinmann describe in a paper, they were able to reduce the number of captured packets required for a successful attack by a factor of ten. A wireless network secured with 128-bit WEP encryption can, according to the researchers, be cracked in less than a minute using their attack method. An archive can be downloaded from the working group's website, which adds the new method to the Aircrack WEP cracking program.
 
it is an active attack which means it can be detected. There also exist a percentage chance that the key can not be decoded or it can be decoded wrong. I doubt that this algorithm would work with passive methods to crack WEP encryption. Never the less, possible success in 60 seconds is pretty damn good.
 
I read about this last week. WEP is on its way out.

I use MAC filtering as well.
 
<--- Doesn't bother with all this wireless nonsense.

QFT.

Gigabit wired Cat6 is very easy to install (at least, it is, for me).. Every room in my house (no, that does not include all the bathrooms) has at least 1 ethernet jack. Offices have 4, bedrooms have 2.
1,000 Mbps connection, that, even if it were only working at 15% efficiency, is still faster than anything wireless can do (unless you want to count "Draft-N" which, from what I'm reading.. barely works at all!) but, then again, whose Gigabit Ethernet is only 15% efficient?
 
WEP has never been secure if you know how to work it, and MAC filtering? hehe That won't help either, folks. Even WPA won't help in many situations if the infiltrator is serious and has the right tools.

Why some people just don't get it yet is beyond me. I've been "cracking" WEP for 2+ years now with simplistic tools that are now very well integrated into the Back|Track pentesting and security suite CD - which is free, by the way.

As for doing a WEP crack in under 60 seconds, that's awesome, but it's only a few hundred seconds faster than I've been doing it for some time now (usually 10-20 mins on average).

Hell I even got a CEH - Certified Ethical Hacker - cert last year just for shits and giggles so whenever someone needs pentesting done I can say "Yep, I can do it, and here's my sign." Sometimes they get the joke, sometimes they don't. Either way, I get the job, and they get a more secure system overall when I'm done with it.
 
I’m perfectly happy with a wired network still. I just don’t have the time to set up another layer of security when all the computers in my house are right beside an Ethernet jack anyways.
 
Congrats of whatever hacker wastes his time hacking my network. I have absolutely zilch of any value for anyone.
 
QFT.

Gigabit wired Cat6 is very easy to install (at least, it is, for me).. Every room in my house (no, that does not include all the bathrooms) has at least 1 ethernet jack. Offices have 4, bedrooms have 2.

only some? your not [H]ard....

lol


I use MAC filtering too, the only thing worth stealing from my network are my porn collection and my bandwith...no ones tried yet.
 
only some? your not [H]ard....

lol


I use MAC filtering too, the only thing worth stealing from my network are my porn collection and my bandwith...no ones tried yet.

Well.. one of my bathrooms is a double-master with dual vanities :) so, I had, at one time, thought about pumping a video feed via some sort of encased screen that had network access for streaming audio / RSS feeds so that, while "getting ready" in the morning, we could listen to webcasts of the weather, podcasts, and the like. The jack is there. The device is not.
 
QFT.

Gigabit wired Cat6 is very easy to install (at least, it is, for me).. Every room in my house (no, that does not include all the bathrooms) has at least 1 ethernet jack. Offices have 4, bedrooms have 2.
1,000 Mbps connection, that, even if it were only working at 15% efficiency, is still faster than anything wireless can do (unless you want to count "Draft-N" which, from what I'm reading.. barely works at all!) but, then again, whose Gigabit Ethernet is only 15% efficient?

What? I think you are joking with yourself if you are saying that wired is faster than wireless. I have recently tested my computers on wired and wireless networks, and for some reason they are FASTER on wireless networks than wired ones.

Though, I have also noticed that network speeds are SEVERELY CPU-limited for some reason as well. My new Core 2 Duo Notebook gets 1.2mb speeds on my internet connection on wireless, while my old Pentium 4 machine that my parents bought for their use that was a top of the line Media Center PC back in the day gets maybe 200 kb speeds.

The only difference between them? Different processor, everything else from the sound card, to the network chip (I've tried it wired and it gets blazing 3.0mb speeds on my internet connection!), to the memory...... same. Only difference is the processor.
 
I just stick to the basics,and use a hardware firewall with WEP 128bit enabledwith a very long pass,that I change weekly(not perfect,but better then most home users) as well as a third party software firewall,and the firewall softs built in to Vista/XP Pro.All of my comp passwords are at least 15+ characters.You guys think 2 soft firewalls,a hardware one,
and diligent password use.Why do these cheap SOHO routers/firewalls only use 64 or 128 bit encryption ?? and what is the next step ? What is coming up the pike to increase security for the home user ?
 
I just stick to the basics,and use a hardware firewall with WEP 128bit enabledwith a very long pass,that I change weekly(not perfect,but better then most home users) as well as a third party software firewall,and the firewall softs built in to Vista/XP Pro.All of my comp passwords are at least 15+ characters.

You guys think 2 soft firewalls,a hardware one,and diligent password use,is enough?.

Why do these cheap SOHO routers/firewalls only use 64 or 128 bit encryption ?? and what is the next step ? What is coming up the pike to increase security for the home user ?
 
http://bcheck.scanit.be/bcheck/showresults.php

Browser Security Test Results

Dear Customer,

The Browser Security Test is finished. Please find the results below:High Risk Vulnerabilities 0
Medium Risk Vulnerabilities 0
Low Risk Vulnerabilities 0

http://compnetworking.about.com/od/wirelesssecurity/tp/wifisecurity.htm

I checked off well on all the ones the about.com list has....

and grc.com gave a perfect score.... on all the 'Shields Up' tests....

And I use his password systems,for all of mine.

What now ? :confused:
 
MAC Filtering
NON-Broadcast SSID
128bit WEP

If you can get on my network, more power to you.
More than likely, all you would sniff would be my 5 neighbors broadcasting away. (gotta love clearwire techs, they rarely lock the wireless routers down)
 
MAC Filtering
NON-Broadcast SSID
128bit WEP

If you can get on my network, more power to you.
More than likely, all you would sniff would be my 5 neighbors broadcasting away. (gotta love clearwire techs, they rarely lock the wireless routers down)

No don't use the wep use the wpa instead!
 
Not surprising, especially with how fast computers are today. Most of the tools you use are completely free and do a darn good job at what it is meant to do.
 
Best practices...

-Use WPA, not WEP for security. If at all possible, use WPA2.
-If at all possible, turn off SSID broadcast on your router.
-MAC address filtering by itself isn't worth much, since as others said, MACs can be spoofed. Added on to tougher security schemes though, and at least it's one more thing to hassle a potential wardriver with.
-If you don't need the extra power, lower the transmit power on your WAP or router, decreasing its range until signal strength is good in your house, but weak beyond the area you use it from.

There's enough unsecured access points out there that if you make yours hard to get into or a pain to use, people will look for an easier target. I'm sure there's other things out there that could be done if you really wanted (most of us don't wish to run our own RADIUS server so we can set up WPA-2 (Enterprise) level security at home) but often, making it difficult is the most important thing --it's unlikely anyone could make it impossible.
 
Wireless? We don' need no stinkin' wireless man...

My antenna's in my desk drawer.....can't get a signal 2 feet from the router.;) Go ahead - hack me.
 
http://www.ex-parrot.com/~pete/upside-down-ternet.html

That's just one of the funniest things I've ever encountered in all my years online (coming up on 30, actually). While I haven't had an opportunity to put such tactics to use, I can just imagine the look on the face of someone thinking "MUAHAHAHA I'm leeching free Internet from this guy, watch... WTF!?!?!?!" and then that little bastige trying to figure out what's wrong with his equipment.

Classic idea... ;)
 
Best practices...

-Use WPA, not WEP for security. If at all possible, use WPA2.
-If at all possible, turn off SSID broadcast on your router.
-MAC address filtering by itself isn't worth much, since as others said, MACs can be spoofed. Added on to tougher security schemes though, and at least it's one more thing to hassle a potential wardriver with.
-If you don't need the extra power, lower the transmit power on your WAP or router, decreasing its range until signal strength is good in your house, but weak beyond the area you use it from.

There's enough unsecured access points out there that if you make yours hard to get into or a pain to use, people will look for an easier target. I'm sure there's other things out there that could be done if you really wanted (most of us don't wish to run our own RADIUS server so we can set up WPA-2 (Enterprise) level security at home) but often, making it difficult is the most important thing --it's unlikely anyone could make it impossible.

Why would anyone war driving even bother with trying to spoof a MAC address? A program designed to find a spoof a working MAC address to access would take forever just to get internet to screw around.

Just hitting view wireless networks in any neighborhood and a number of small business office areas/buildings will result in at least one unsecured network you can mooch for internet. Even just disabling the SSID broadcast and using a random mix of numbers and letters is enough to push these people away.

Anyone who's really all that concerned about their personal data either has something they shouldn't, or someone with an ulterior motive to get into their network.

A business network is an entirely different aspect altogether. Other companies or individuals trying to steal important data and so on.
 
<--- Doesn't bother with all this wireless nonsense.

I used to be the same way... but now I really enjoy using my laptop on the sofa while my wife watches TV next to me... or I put it on the kitchen counter and look something up real quick like directions or send someone an email really quick. Wireless really is a nice convenience. But that's what it is, a convenience, not a necessity for me. I'd love to have my house wired for CAT5E or CAT6, but it wasn't done before it was built and wiring it now would be quite a challenge so I'm holding off until I can do it right and not mickey mouse it.

What? I think you are joking with yourself if you are saying that wired is faster than wireless. I have recently tested my computers on wired and wireless networks, and for some reason they are FASTER on wireless networks than wired ones.

Are you serious? Have you figured out what that reason is yet? Perhaps it is not the wireless that is actually faster, but maybe the way you have your wireless connected to your Internet connection? Have you ever tried copying 4GB of data over a wireless network compared to a gigabit Ethernet network? There is no comparison, even if you're using 802.11N, there is no comparison. And even if there was, what happens what you live in a tight neighborhood where everyone is overlapping on the same frequencies? Gigabit will not be affected and perform the same, but the 802.11 will suffer.

Even WPA won't help in many situations if the infiltrator is serious and has the right tools.

I'm not a security expert... but was under the impression that while WPA was theoretically not secure, there existed no publicly available tools to crack WPA at this time, although it is suspected that this won't be the case for long. Am I two years behind or something?

Congrats of whatever hacker wastes his time hacking my network. I have absolutely zilch of any value for anyone.

Me too... although one time my neighbor's laptop was on my wireless network which at the time was not secured at all. I suspect he didn't even know he was on my network. Normally I wouldn't do this, but since he was on my network, not me on his, I decided to see what was on his laptop. I was able to find some security information relating to how his company security their laptops, as well as a ton of his family photos taken while his house was being built. Nothing really serious or critical, but stuff that I'm not sure he really wants to be just broadcasted out to anyone willing to log in with a guest account. That is enough for me to at least apply WPA security to my network, although my computers are a little more hardened than his was, especially my company laptop.
 
I use WPA2 for my laptop's access when I want to do something in another room, but seriously who cares, ok you want to use my internet access for free? Oooh ok so park yourself outside my house all the time where you'll be lucky to get 1 bar of signal strength for my free internet *sigh*
 
WEP - First Layer of Security
MAC Address Filtering - If you get past WEP then you have to Spoof the MAC Address.
IPCOP - If you get passed to first two then congratulations you just accessed the "Blue" side of my IPCOP box which is a different subnet and firewalled from the network side. So basically you can steal my internet and start trying to get to the network side.

If you can hack the IPCOP box then you earned the right to steal everything on my network.
 
I'm not a security expert... but was under the impression that while WPA was theoretically not secure, there existed no publicly available tools to crack WPA at this time, although it is suspected that this won't be the case for long. Am I two years behind or something?

http://www.mirrors.wiretapped.net/s...rack/whax-aircrack-wpa/whax-aircrack-wpa.html

3 min 16 second video for what went from proof of concept WPA cracking to the real thing. Given the ease of cracking the key (they didn't use a particularly secure one since it was the original proof of concept attempt and success that was important - you don't give yourself a 75 digit passphrase if you're testing, you choose something simple to verify the process works from start to finish.

Yeah, the music sucks, can't do much about it except turn the volume down. I used this video as a jump-point of sorts about 18 months ago to get started - this was done using tools in what was then called the WHAX distribution for pentesting before "pentesting" became the buzzword it is today.

Then the Auditor CD came into being, and the guys that did both projects started working together and they came up with Back|Track which is the best pentesting suite out there. Serious stuff, and incredibly useful in ways I can't even begin to explain.

So yes, it's possible - the weakness with WPA doesn't lie in the same place it does with WEP. With WPA it's all about capturing the info during the authorization and then cracking that sooo... while WEP takes brute force time to get the packets and then locate the key, with WPA cracking it's all about capturing the necessary info when you mass deauthorize clients from the AP and then sniff the authorization - then it becomes the brute force effort to find the key with primarily dictionary attacks.

Let's face it, when it comes to networking and security, the two statements really don't belong in the same sentence. Nothing is that secure anymore, nothing. It's precisely at the point where you figure "hey, I've got nothing to hide/nothing anyone would want/I don't care..." that suddenly you do care.

You might not think you have anything someone else would want, but that's simply wrong - the people typically into this sort of thing don't care primarily about your data or your network, they care about the access that penetrating your network just gave them.

Your system then becomes "ground zero" for whatever they intend to do with the access. I remember reading recently that someone had their home Wi-Fi network penetrated and then they found themselves under investigation for possible Child Porn activities - the person that hacked into their Wi-Fi had used the network access as his staging point to go to websites and do things related to that dispicable side of human nature, but in the long run, the actual owner of the Wi-Fi hardware and network access got pretty seriously screwed up in his life, job, finances, legal issues, etc.

He thought he didn't have anything anyone would want, and he didn't care.

He was wrong, as is anyone else that shares that belief.
 
Congrats of whatever hacker wastes his time hacking my network. I have absolutely zilch of any value for anyone.

You may not think you do, but what if said hacker downloads child porn through your connection, or even worse, stores it in hidden folders on YOUR computer. There's a decent chance of him being tracked/traced to YOUR computer/IP address. Do you want to take the fall for what some sicko uploaded/downloaded on your connection? How are you going to prove you didn't do it? Lots of hassle for sure. No thanks.
 
While not directly related to WEP cracking, I just thought this was hilarious when I "stumbled" on in (no pun intended) doing some random Google searches for newer Wi-Fi scanning stuff:

wifidsscannercl4.jpg


Yep, that's exactly what it looks like, a Nintendo DS modded out to do not only Wi-Fi stuff but basically turned into a handheld 802.11 "stumbler" - pretty damned spiffy in my opinion.

Get more info at:

http://www.akkit.org/dswifi/

347 APs found too. If the standard 70/30 rule applies here - and in my years of working with Wi-Fi it hasn't really changed - then he's gone through close to 450 APs. The 70/30 rule is basically ~70% of the active APs a person might pick up using a tool like Netstumbler or even that modded Nintendo DS as shown in the picture above are not only unsecured, they're still broadcasting the SSID. ~30% is secure and not broadcasting the SSID obviously.

When I moved back to Las Vegas last March (2005) I loaded the then current Back|Track 1.0 LiveCD onto a Dell Inspiron 4150 laptop with my trusty D-Link 11g card sticking in the PC card slot and got on the "Deuce" which is the double-decker buses we have now strictly for the Strip route - it goes from nearly the heart of downtown to a point just south of McCarran Airport here in Vegas. The entire trip is roughly 5-6 miles in each direction.

I sat up on the second level at the front of the bus - the Deuce is modeled after the British-style double-decker buses. The purpose was to "sniff" any and all APs that I might pick up on the trip outbound and then back in and get a database of activity along that corridor of road.

By the time I got home and looked at the data, I'd picked up over 1200 APs - mostly casinos, obviously, but a bunch of the smaller hotels, shops, stores, Walgreens (3 of 'em), the Metro Police Dept (wide open and not secure at all on 11 APs, go figure), the Federal courthouse (using WEP, shame on them), and pretty much everything else that little D-Link card that could pulled from the Ether.

Was an interesting experience, and in the long run it turned out that 67% of the APs were still broadcasting the SSID of the entire amount I picked up. Kismet is passive and doesn't require the AP to broadcast the SSID - if any packets are flowing, even the broadcast beacons, Kismet just yanks it outta the air and logs it.

So in the long run the round trip garnered me a ton of data about Vegas and the Strip, including a bunch of smaller places that actually offer FREE Wi-Fi access - they used something like FREEPUBLICWIFI for an SSID which I thought was pretty cool. I didn't actually try to connect to any of the APs on my journey - the laptop was on and sniffing while it sat in the seat beside me on the way out and back in.

Maybe I'll have to do that little journey again sometime and see how things have changed over the past 12 months. Could prove interesting...
 
What? I think you are joking with yourself if you are saying that wired is faster than wireless. I have recently tested my computers on wired and wireless networks, and for some reason they are FASTER on wireless networks than wired ones.

If your wireless is faster than your wired..you need new wires....or better wire, or better crimper's..:)
 
MAC Filtering
NON-Broadcast SSID
128bit WEP

If you can get on my network, more power to you.
More than likely, all you would sniff would be my 5 neighbors broadcasting away. (gotta love clearwire techs, they rarely lock the wireless routers down)

same set up i have..

but really.. anyone can break into any wireless network if they really wanted too...

i'm not so sure what someone would do if they broke into mine.. i don't have much..
 
I've got to get me one of those DS's... that looks like way too much fun.

Thanks for the info on WPA. It's the best I have right now since my WAP is so old, so it'll have to do. Some day I'd like to upgrade my router, but the main reasons are 1) increased speed which isn't going to help much since I use ethernet for any large data transfers 2) increased range which doens't help much since it works fine in my whole house, now there is 3) security... still not a huge concern... I know I'm securing it the best I can and there are about 3 networks nearby that are not secured so I figure if someone wants a free connection they'll go for theirs over mine unless they are intentionally trying to get me busted for kiddie porn. That would be kindof funny to pull a prank on someone and get their ISP to turn their connection off for illegal downloading... except they might not think it was so funny :)
 
Thanks for the info on WPA. It's the best I have right now since my WAP is so old, so it'll have to do. Some day I'd like to upgrade my router, but the main reasons are 1) increased speed which isn't going to help much since I use ethernet for any large data transfers 2) increased range which doens't help much since it works fine in my whole house, now there is 3) security... still not a huge concern... I know I'm securing it the best I can and there are about 3 networks nearby that are not secured so I figure if someone wants a free connection they'll go for theirs over mine unless they are intentionally trying to get me busted for kiddie porn. That would be kindof funny to pull a prank on someone and get their ISP to turn their connection off for illegal downloading... except they might not think it was so funny :)

AND THAT IS JUST ONE REASON WHY YOU SHOULD SECURE YOUR WIRELESS NETWORK. Not that I'm trying to make mryerse there out to be a bad guy/girl or anything. :)

*ahem*

It has nothing to do with "I don't have anything anyone would want" or "I could care less" or "I'm just not interested," which aren't logical or rational reasons to not secure it in the first place.

The reason you secure your wireless network is so you don't have to say this sort of thing:

"Well no, Mr. FBI Man, I don't recall ever visiting www.nambla.org and making contact with Bubba" or "That wasn't me, that couldn't have been me sending data to www.whitehouse.gov and email bombing their mail server" or "What do you mean I hacked into Visa's customer account database and stole 22 million credit card numbers?"

It's those possible situations that people need to worry about, and even then the worry can be addressed by and large with simple WEP/WPA encryption really. Using WEP is not a bad thing in and of itself and neither is MAC filtering, IP filtering, etc - anything the wireless router/AP offers as a form of securing the Wi-Fi network should be and must be top priority the moment it comes outta the box, really.

Anyone that thinks otherwise is just fooling themselves, and that foolishness won't come off as the least bit funny when that knock on their front door happens - if it does. More than likely it won't be a knock, it'll be a combat boot kicking the fuckin' door in as your home or office gets raided by a lot of guys like the ones you see on Cops when they bust into a drug house or meth lab. :(

I hope some people are paying attention...
 
What? I think you are joking with yourself if you are saying that wired is faster than wireless. I have recently tested my computers on wired and wireless networks, and for some reason they are FASTER on wireless networks than wired ones.

Though, I have also noticed that network speeds are SEVERELY CPU-limited for some reason as well. My new Core 2 Duo Notebook gets 1.2mb speeds on my internet connection on wireless, while my old Pentium 4 machine that my parents bought for their use that was a top of the line Media Center PC back in the day gets maybe 200 kb speeds.

The only difference between them? Different processor, everything else from the sound card, to the network chip (I've tried it wired and it gets blazing 3.0mb speeds on my internet connection!), to the memory...... same. Only difference is the processor.

This tells me the following


1) You have no idea how to test network throughput. Seeing as how I own 75 web servers that are scattered around the country, I might know a tad bit about networking.

2) You are talking about internet throughput, over your wireless. I am talking about network speeds. My house has a 16 megabit internet connection. That means, that, the best I can hope for, with compression, and "bursting" is MAYBE 2 megabytes a second of data transfer. My house has a 1,000 Megabit network connection. I can transfer files from one computer to another at speeds that are ONLY LIMITED by harddrive performance. That means that when I send a 8 gigabyte file from one pc to another, it transfers at anywhere from 50 to 60 MEGABYTES per second, or 25-30 TIMES faster than my internet connection. Your 108 Megabit wireless link, could.. MAYBE get 8-10 megabytes a second in a perfect world.

The only difference between them? Different processor, everything else from the sound card, to the network chip (I've tried it wired and it gets blazing 3.0mb speeds on my
internet connection!), to the memory...... same. Only difference is the processor.

Your old pentium 4 machine probably has a 10/100 network card.
Your new Core2Duo machine PROBABLY has a 10/100/1000 network card.


Lets see if I can explain this to you.

My network has an interconnection speed of

My Network : 1,000 Megabit
802.11 : 108 megabit/54 Megabit/22 Megabit / 11 Megabit

At 100% efficiency, you are only capable of 10.8% of what my network is capable of.
How, do you think, it could be possible that your wireless is faster than my wired?

Answer : Because you are retarded.

Your new C2D with 108mb wireless is getting 1.2 Mb/second off of the INTERNET because that's the speed it can pull. Your old system getting 200K is probably laden with spyware (or, for that matter, probably has norton antivirus installed, which will halve your network performance)

You may also be running sub-standard cabling, enabling only a 10 megabit connection.

Please do not make further fool of yourself by trying to explain how your air-based broadcast could possibly out-pace a hard, dedicated link.
 
I have never ever gotten anywhere close to the 100Meg speeds doing network transfers when I'm only 15 feet away from the other computer. To be honest I see zero difference between wired and wireless.
 
I have never ever gotten anywhere close to the 100Meg speeds doing network transfers when I'm only 15 feet away from the other computer. To be honest I see zero difference between wired and wireless.

I just look at your user tag, and then I understand.

I transfer immense amounts of data around, and I can tell you for a fact that it is faster over gigabit.

Why is this so hard for you people to understand?

1,000 is faster than 108.
Even poorly performing, hardwired, 1,000 is still going to outperform a PERFECT 108 connection, that's if you even have a 108 connection.

Maybe you are using a cheap hub? My SWITCH & Routing PC cost me $980.00 for my house.

Did your 4 port 10/100 hub cost ~$19.00 ?

My wired networking infrastructure cost in the neighborhood of ~2k to install between keystones, all the actual wire, the conduit (inter-wall) and the switch, and periphery.
I can send data at 50-60 MEGABYTES a second across the network. A full DVD takes about 2 minutes. You CANNOT do that with wireless, you just can't.

My gigabit network runs ~50% efficient, as the theoretical max is something like 100-120megabytes a second. (never seen that throughput over a single link, even on Fiber-channel gigabit)

I am personally convinced that the reason I max out at 50-60mb is because of disk throughput limitations. If i had a much faster data array in the home (not necessary, mind you) I could get in the 80s, I'm sure.

I store 22 different drive images on my network for systems we build, (because, we have 22 core configurations) not counting the 19 gigabyte deployment package for my servers (yes, I have a copy of all that in the home, as well as, of course, at the business locations) because, for example, the next 25 servers I am adding to my stable are all being built, personally, by me, rather than employees. I can network boot and load a deployment image to install over network and it's much faster than running an o/s install from a DVD.
 
Back
Top