WEP's fatal flaw exposed
 
|
|||
 | |||
|
Wired Equivalent Privacy vulnerabilities came to light more than a year ago in October 2000, when Jesse Walker of Intel published "IEEE P802.11b Wireless LANs, Unsafe at any key size; an analysis of the WEP encapsulation." That was soon followed by University of California at Berkeley's "Security of the WEP algorithm" last January, and the University of Maryland's "Your 802.11 Wireless Network has No Clothes" in March 2001.
In 2001, several people wrote programs for hacking 802.11b's WEP, primarily by capitalizing on its improper use of RC4's initialization vectors. These days, any hacker or script kiddie can use one of several tools, such as WEPCrack or AirSnort, which yields WEP keys in fairly short order. For example, I cracked my 128-bit static-key WEP network in less than 18 hours. Nearly all 802.11b vendors offer 128-bit key extensions to WEP so most would implement the 128-bit version.
None of this really matters, as it's the WEP algorithm that's vulnerable. Once a hacker has the keys, it provides access to the network. The hacker can then load the keys into any wireless sniffer, such as WildPacket's Airopeek or Sniffer Technologies Sniffer Wireless, and gain full access to broadcast data. Download the tools and test your own wireless LAN - just remember it's against federal wiretapping laws to view any data on someone else's network without permission.
RELATED LINKS
Janss is the president of Jansys Information Systems, a consulting firm specializing in IS technologies for small businesses. He can be reached at bizcom@jansys.com.
Wireless LAN security
The IEEE 802.11b Task Group I is working on a new standard that provides authentication and encryption for secure wireless networking. In the meantime, proprietary products that plug the holes in 802.11b security may be your best bet.
How we did it
Our testing methods ecplained.
IEEE is working on new standard
The scope of IEEE's 802.11b Task Group I is "to enhance the 802.11 Medium Access Control to enhance security and authentication mechanisms."
A closer look at LEAP
How Lightweight Extensible Authentication Protocol works.
