Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 59 guests and 5 members online
EH-Net News Feeds
Latest Additions
 
Advertisement

You are here: Home arrow Forum arrow Ethical Hacking Discussions and Related Certificationsarrow Wirelessarrow New Attack Cracks WPA TKIP in a Minute
EH-Net
May 25, 2012, 10:42:29 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Advertise on EH-Net!! - Reasonable Rates, Highly Targeted Audience.
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: New Attack Cracks WPA TKIP in a Minute  (Read 9501 times)
0 Members and 1 Guest are viewing this topic.
don
Editor-In-Chief
Administrator
Hero Member
*****
Offline Offline

Posts: 3916


Editor-In-Chief


View Profile WWW
« on: August 28, 2009, 11:19:56 AM »

Quote

By Robert McMillan, IDG News Service

Computer scientists in Japan say they've developed a way to break the WPA encryption system used in wireless routers in about one minute.

The attack gives hackers a way to read encrypted traffic sent between computers and certain types of routers that use the WPA (Wi-Fi Protected Access) encryption system. The attack was developed by Toshihiro Ohigashi of Hiroshima University and Masakatu Morii of Kobe University, who plan to discuss further details at a technical conference set for Sept. 25 in Hiroshima.

Last November, security researchers first showed how WPA could be broken, but the Japanese researchers have taken the attack to a new level, according to Dragos Ruiu, organizer of the PacSec security conference where the first WPA hack was demonstrated. "They took this stuff which was fairly theoretical and they've made it much more practical," he said.

They Japanese researchers discuss their attack in a paper presented at the Joint Workshop on Information Security, held in Kaohsiung, Taiwan earlier this month.

The earlier attack, developed by researchers Martin Beck and Erik Tews, worked on a smaller range of WPA devices and took between 12 and 15 minutes to work. Both attacks work only on WPA systems that use the Temporal Key Integrity Protocol (TKIP) algorithm. They do not work on newer WPA 2 devices or on WPA systems that use the stronger Advanced Encryption Standard (AES) algorithm.


For complete story:
http://tech.yahoo.com/news/pcworld/20090827/tc_pcworld/newattackcrackscommonwifiencryptioninaminute

Don
Logged

CISSP, MCSE, CSTA, Security+ SME
Ketchup
Hero Member
*****
Offline Offline

Posts: 1006



View Profile
« Reply #1 on: August 28, 2009, 11:56:32 AM »

Thanks Don,  their research paper (linked from the article you provided) was very interesting.   I haven't seen many WPA implementations out there.  I have mostly seen WEP and WPA v2.   
Logged

~~~~~~~~~~~~~~
Ketchup
aweSEC
Hero Member
*****
Offline Offline

Posts: 1100


View Profile
« Reply #2 on: August 28, 2009, 01:15:33 PM »

Read about that today too, certainly interesting. Though it seems they still have to proof this in practice.
Logged
dalepearson
Sr. Member
****
Offline Offline

Posts: 356


View Profile WWW
« Reply #3 on: August 28, 2009, 03:55:42 PM »

This has been kicking about for a while now hasnt it, I guess its just in the media again because of the recent claims of super fast cracking.
Logged

don
Editor-In-Chief
Administrator
Hero Member
*****
Offline Offline

Posts: 3916


Editor-In-Chief


View Profile WWW
« Reply #4 on: August 28, 2009, 09:15:49 PM »

Yeah... it wasn't the fact that it was cracked, but the speed in which they claim it can be done. Even the article states that it has already been done in the 15 minute time frame.

Worthy of posting anyway.

Don
Logged

CISSP, MCSE, CSTA, Security+ SME
Vertigo
Newbie
*
Offline Offline

Posts: 13


View Profile
« Reply #5 on: September 08, 2009, 04:30:00 AM »

Described attack works only with one essential restriction: WAP and wireless client doesn't "see" each other:

"An access point and a client cannot be communicated directly since the
interval between these is large. The attacker behaves like a repeater, namely all packets that include SSID beacon are relaid to the receiver with no modification, and the packet of the access point/client delivers to the client/access point."
http://jwis2009.nsysu.edu.tw/location/paper/A%20Practical%20Message%20Falsification%20Attack%20on%20WPA.pdf

MiTM attacker must work with two directional antennas: one for WAP and one for wireless client. If WAP and wireless client "see" each other, attacker sending chochop guess to WAP, WAP respond with MIC failure and wireless client change TSC (TKIP Sequence Counter) and attack fails. Such restriction hasn't previous Beck-Tews attack, which works nicely with tkiptun-ng from aircrack-ng-1.0 suite, but also have other restrictions: WAP and wireless client must works in WMM(WiFi MultiMedia- QoS according 802.11e standard) mode and rekeying interval  is more than 1200 secs. In both attacks attacker get MIC key and RC4 keystreams only, not TKIP pairwise or group keys itself. Attacker with decrypted RC4 keystream can fake arp and dns packets  only.

===========
GCIH, Security+
« Last Edit: September 10, 2009, 10:23:18 AM by Vertigo » Logged
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.16 | SMF © 2011, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.344 seconds with 24 queries.
 

gk_static-ad_feb2012.jpg
Global Knowledge: Build Security Skills to Protect & Defend

els_130x200fixed2.gif
eLearnSecurity Student Course Now Live!
5% Off with Code
ELS-EH-5

SANS Deals 4 EH-Netters
$150 OFF Any SANS Course in Any Format!
Coupon Code: EHN_Connect Including SANS Security West 2012 & SANSFIRE 2012
Recent Forum Topics

cbtnuggets_logo_125.jpg
Try CBT Nuggets Free!

Vote For EH-Net

Add to Technorati Favorites
technorati fave

 
         
Advertisement

© 2012 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.