Slashdot Log In
Feds Hack Wireless Network in 3 Minutes
Posted by
CmdrTaco
on Tue Apr 05, 2005 11:26 AM
from the still-can't-balance-budget dept.
from the still-can't-balance-budget dept.
xs3 writes At a recent ISSA (Information Systems Security Association) meeting in Los Angeles, a team of FBI agents demonstrated current WEP-cracking techniques and broke a 128 bit WEP key in about three minutes. Special Agent Geoff Bickers ran the Powerpoint presentation and explained the attack, while the other agents (who did not want to be named or photographed) did the dirty work of sniffing wireless traffic and breaking the WEP keys. This article will be a general overview of the procedures used by the FBI team.."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
First DEAD BEEF (Score:5, Funny)
Re:First DEAD BEEF (Score:5, Funny)
Note to poster: DEADFEDDEADFEADDEADFED is also a poor choice.
Parent
Re:First DEAD BEEF (Score:5, Funny)
Indeed it is. It's several characters too short.
Parent
I personally prefer (Score:5, Funny)
Parent
Re:First DEAD BEEF (Score:5, Interesting)
Pretty much. It does have some historical meaning, although most people are probably unaware of it. See DEADBEEF in the Jargon File [catb.org].
Parent
WEP = weak (Score:5, Insightful)
WPA is just as 'weak' against Brute Force (Score:5, Insightful)
Parent
Re:WPA is just as 'weak' against Brute Force (Score:5, Interesting)
This is reasonably secure for most of my clients, but I'm still a bit worried about those mind-control-rays penetrating my tinfoil hat. How do I know the numbers weren't intercepted. Granted, I'm not advertising the customers they're going to, but you can never be too careful.
Anybody have experience with building and integrating a hardware random number generator?
Parent
$20 hardware random number generator. (Score:5, Interesting)
To speed up the process, get one of those
clear boxes they use to make sure people take the right number of pills per day. Get one with more than 22 boxes. (4 times a day for a week = 28, fairly common)
Put dice in boxes. Put a sheet of something solid on the door side. Shake. Invert. voila, random byte strings. w/ 28 boxes you have 84 random bits. Repeat twice for your 152 bit key, dropping the last 16 bits.
chessex.com has a variety of dice - you can can order single d8s for
Someone will probably complain about the non-cryptographic quality randomness of this process. But you only need cryptographic quality randomness when you're going to use it very repeatedly and someone can attack the similarity between them. Since the nonrandomness isn't known to anyone outside and you probably aren't generating a massive number of keys you're fairly safe. To increase security, buy dice from multiple manufacturers and occasionally switch around the lots.
(every 4 d8 values converts to 3 hex values. If you're converting by hand, you could alternately use a pair of dice for a hex value, generating only 56 bits per shake but only needing a table of 16 values to convert by hand to hex. You could also use 4 sided dice for this equally well, since you're only using 4 bits per pair.)
Parent
Re:WEP = weak (Score:5, Insightful)
More info here. [google.com]
Parent
Re:WEP = weak (Score:5, Insightful)
If you can not recieve the signal, you can access or hack it. My home has aluminum siding with aluminum screening. my accesspoint is in the basement on the street side with another sheet of aluminum 1 wavelength away from the antennas in the direction of the street.
so far even holding a wireless card AGAINST the windows screens will give you no signal, you must be in the house to get a signal, and then it's strong.
The first thing in security is to make sure that your wireless signal is not going places you do not want it to.
Parent
How is this news? (Score:5, Insightful)
Pffft Cracking? The Feds have backdoors! (Score:5, Funny)
Parent
takes me longer than 3 minutes (Score:5, Funny)
It takes me longer than 3 minutes just to type the WEP key from my router into my client!
No worries. (Score:5, Funny)
Still, it may be time to look at running an IPSEC tunnel over the wireless network.
Re:No worries. (Score:5, Funny)
Parent
Re:No worries. (Score:5, Funny)
Parent
Tongue, Meet Cheek (Score:5, Interesting)
When I first read the closing line of the article, I chuckled.
Then I felt dismayed.
It really is a shame when the prevailing "geek" attitude towards agencies like the FBI is mistrust and fear, not confidence and respect.
Re:Tongue, Meet Cheek (Score:5, Interesting)
Shame... but well earned. Just read the history of FBI.
Parent
Re:Tongue, Meet Cheek (Score:5, Insightful)
Parent
Re:Tongue, Meet Cheek (Score:5, Insightful)
The problem is that, as an agency, it is their collective duty to enforce bad policies. Increasingly, they are defeating their own purpose and becoming a threat to the very freedoms they supposedly protect. The war on drugs and PATRIOT spring to mind.
"They're only doing their job" is never an argument: unethical practice is not magically justified or even mitigated by being paid for it. If anything I'd say the opposite is in fact true.
And in that regard, the fact that their agents are such able individuals is really just sad: think of what they might accomplish if only they were not busy hatching plans to penetrate my tinfoil hat?
IMHO, no offense.
Parent
Re:Tongue, Meet Cheek (Score:5, Informative)
At least we "geeks" have not been so foolish as to forget history. The FBI *earned* the mistrust and fear that we, and other people who haven't already been brainwashed [democratic...ground.com] yet. The story of COINTELPRO [cointel.org] is a case in point. There are many other similarly creepy programs that they've embarked on in their history, and since the Patriot act has practically removed the checks on their authority that once existed, there is more reason than ever to be mistrustful and fearful of them.
Parent
You and The Founders (Score:5, Insightful)
It really is a shame when the prevailing "geek" attitude towards agencies like the FBI is mistrust and fear, not confidence and respect.
I find it refreshing.
The founders of our government were quite aware that the greatest threat to freedom was the very government intended to secure and maintain it. That governments are run by people, that people are fallible, and that the power of government tempts them to sieze still more power- to simplify their jobs, to enhance thier own lives, or just for the fun of it.
They knew that some people and some institutions would be corrupted, did their best to put roadblocks in the way of corruption to slow the process down, and to warn their successors (us) to be on watch, so we could catch the inevatable slippages and correct them.
An attitude of healthy suspicion combined with grudging respect and occasional heartfelt praise is precicely right, when it comes to agencies such as the FBI. Healthy suspicion because agents - singly, in groups, or institutionally - have gotten out-of-hand repeatedly. Grudging respect (which must be earned but is honest when it is), because the government and its agencies houseclean from time to time, the agency mostly stays on track, and many of its agents are honest, hard-working, and often heroic, doing their best to identify, protect us from, and bring to justice some truly evil people. Occasional heartfelt praise - when they earn it (which they often do), spending their sweat, smarts, and blood to make the rest of us safer.
The reason I find "the 'geek' attitude" refreshing is that it show that a new generation - no, a large social group that crosses several generations - have "gotten it". Like most powerful tools, law-enforcement and investigative agencies can do significant when used properly, and even greater harm when misused or broken. Eternal vigilance is needed to keep them in good repair and on the right job. Now we have yet another generation that understands the need for this vigilance and is standing guard.
Parent
On automatic "confidence and respect" (Score:5, Insightful)
Others are mentioning COINTELPRO, or Hoover's reign of terror, or Waco, and on and on. No need for me to cover that territory, which any well-informed citizen knows. There's always Wikipedia if you need to bone up on the cheap.
No, I wish to call attention to your language. Therein lies your problem: your language shortcuts thought. Do you realize you write less like a citizen than a subject?
Agencies like the FBI, you write.
Government agencies, law enforcement agencies, you mean. Please stop and think about that.
"Agencies like the FBI"--which would include, of course, the CIA, the NSA, the DEA, the BATF, for starters--are nothing more than arms of power. It is that power to which we must turn, thoughtfully, and ask our questions. We cannot say de facto that an enforcement agency is worthy of "confidence and respect," as you would have it, unless we first examine whose laws and whose agenda these agencies are enforcing.
To take but one high-profile example: the war on drugs. This irrational prohibition has stocked our prisons with the poor, but failed demonstrably by creating more crime in illegal drugs; yet it is blindly enforced by those before whom you would have us genuflect. What choice have they, after all? Yet, fortunately, we have a choice: we can think, they cannot. We can withhold automatic "confidence and respect," as we should, since a brutal and destructive prohibition depends on patsies and collaborators.
The founders of our nation viewed overweening power with deep suspicion, and they anticipated the glamor of irrational obedience--the impulses of mob-like majorities, of good little yes-men. Examine their writings, and behold their constitutional framework: it is in sum a work of almost beautiful paranoia, conceived by men who looked on history as realists. They designed the nation to survive not terrorists or criminals but the surrender of thought by its own inhabitants.
Parent
Comment (Score:5, Funny)
-Peter
Encryption is now useless (Score:5, Insightful)
People just need to realize that nothing is infalliable, maybe when this is mentioned on Fox News or CNN the general public will learn that they shouldn't trust their network for sensitive data. I know I don't.
Re:Encryption is now useless (Score:5, Funny)
Parent
Already acting slow... (Score:5, Informative)
Assembled, for your pleasure:
-------
Title: The Feds can own your WLAN too
Introduction
Millions of wireless access points are spread across the US and the world. About 70% percent of these access points are unprotected--wide open to access by anyone who happens to drive by. The other 30% are protected by WEP (Wired Equivalent Privacy) and a small handful are protected by the new WPA (Wi-Fi Protected Access) standard.
At a recent ISSA (Information Systems Security Association) meeting in Los Angeles, a team of FBI agents demonstrated current WEP-cracking techniques and broke a 128 bit WEP key in about three minutes. Special Agent Geoff Bickers ran the Powerpoint presentation and explained the attack, while the other agents (who did not want to be named or photographed) did the dirty work of sniffing wireless traffic and breaking the WEP keys.
This article will be a general overview of the procedures used by the FBI team. A future article will give step-by-step instructions on how to replicate the attack.
WEP Cracking - The Next Generation
WEP is an encryption scheme, based on the RC-4 cipher, that is available on all 802.11a, b and g wireless products. WEP uses a set of bits called a key to scramble information in the data frames as it leaves the access point or client adapter and the scrambled message is then decrypted by the receiver.
Both sides must have the same WEP key, which is usually a total of 64 or 128 bits long. A semi-random 24 bit number called an Initialization Vector (IV), is part of the key, so a 64 bit WEP key actually contains only 40 bits of "strong" encryption while a 128 bit key has 104. The IV is placed in encrypted frame's header, and is transmitted in plain text.
Traditionally, cracking WEP keys has been a slow and boring process. An attacker would have to capture hundreds of thousands or millions of packets--a process that could take hours or even days, depending on the volume of traffic passing over the wireless network. After enough packets were captured, a WEP cracking program such as Aircrack would be used to find the WEP key.
Fast-forward to last summer, when the first of the latest generation of WEP cracking tools appeared. This current generation uses a combination of statistical techniques focused on unique IVs captured and brute-force dictionary attacks to break 128 bit WEP keys in minutes instead of hours. As Special Agent Bickers noted, "It doesn't matter if you use 128 bit WEP keys, you are vulnerable!"
On with the Show
Before we get into the steps that the FBI used to break WEP, it should be noted there are numerous ways of hacking into a wireless network. The FBI team used publicly available tools and emphasized that they are demonstrating an attack that many other people are capable of performing. On the other hand, breaking the WEP key may not necessarily give an attacker complete access to a wireless network. There could also be other protection mechanisms such as VPNs or proxy servers to deal with.
For the demonstration, Special Agent Bickers brought in a NETGEAR wireless access point and assigned it a SSID of NETGEARWEP. He encrypted the access point with a 128 bit key--made by just keying in random letters and numbers.
Note that normally, you have to find wireless networks before you can crack them. The two wireless scanning tools of choice are Netstumbler for Windows or Kismet for Linux. Since the other WEP cracking tools are mainly Linux-based, most people find it easier to stick with Kismet, so they don't have to switch between Windows and Linux.
Another FBI agent started Kismet and immediately found the NETGEARWEP access point. Just for fun, a third agent used his laptop and ran FakeAP, a program that confuses scanning programs by putting up fake access points.
Attack!
After a target WLAN is found, the next step is to start capturing packets and convert th
Protection (Score:5, Interesting)
Re:Protection (Score:5, Insightful)
Now what would be really spiffy would be generating MAC-specific keys, so that (combined with blocking after X attempts) no progress could be with a dictionary attack...
Parent
WEP is only useful for (Score:5, Interesting)
WEP is like gun laws in the US. They only keep the honest people from having guns. What a great society we live in.
Re:WEP is only useful for (Score:5, Interesting)
Um no, WEP is like a lock on your door and shades on your curtains. It provides you with a certain level of protection and privacy. They won't stop the prof. thief or the determined voyeur. If you need/want a higher level of privacy/safty, then one needs to take additional steps to try to attain them.
Note too that having WEP enabled also is a useful tool when it comes time to prosecute. If you leave your packets unencrypted for the world to see, then someone might have a reasonable argument for "accidentally" capturing your data (hey, there is no law against sniffers right). However, if you have WEP enabled (regardless of how strong), then someone would have to be actively trying to break your key to get to your data. You can then prove intent.
Parent
Wifi: Feds best friend on a stakeout (Score:4, Funny)
Not really WEP weakness (Score:5, Insightful)
BTW, assuming a similar key generation scheme, this technique could break AES or 3DES, the encryption algorithm is irrelevant here. Why is it that vendors of security products can't figure out security?
Just Leave It Open (Score:5, Funny)
Great, reasonable doubt in a pringles can (Score:5, Insightful)
Two of them are cryptography masters ... (Score:5, Funny)
Even if WEP is trivial to crack, it's useful (Score:5, Insightful)
It doesn't keep out a burglar.
It DOES make it clear that your INTENT was to keep him out, and that if he breaks in his INTENT was to break in.
This is a very important legal point if/when you, or law enforcement, bring action against him.
Similarly, the computing community has generally interpreted permission settings (on files and the like) as an expression of intent, generally honoring them even if they have the ability to bypass them.
This transfers directly to wireless access points: Some people deliberately leave their APs open, to let others use them as a community resource. Generally this is done by leaving them at the default settings. While there may be confusion about it if an AP is in this state, there is NO confusion about the intent if WEP is enabled.
Good riddance (Score:5, Insightful)
Look, your computer ought to be secure at the TCP/IP level. If you're depending on WEP link security, you're probably hosed anyways. And you'll almost surely be hacked by the teeming swarms of infected computers on the net long before you get trouble from a neighbor, a drive-by script kiddie, or now the FBI. Unless you're a paranoid freak and you're sure they're really out to get you. The roving script-kiddies that is.
Worried about bandwidth? If you and your neighbors cooperated instead of hording bandwidth from each other, you'd have more to go around. Heck, you could multi-home your laptop and get multiplexed bandwidth. That's more, not less.
Now turn off those keys and rename your home wi-fi network "public"!
Re:Not too surprising (Score:5, Informative)
They didn't do a dictionary attack. What they did was use aircrack that uses a statistical method to crack the key. You need lots and lots of packets and they got those using void/deauth and a replay attack. It's all in the article.
Also, you also only need one packet to brute force a key.
Parent
Re:Not too surprising (Score:5, Informative)
But so far I have "He encrypted the access point with a 128 bit key--made by just keying in random letters and numbers." which makes me wonder if they actually used a dictionary attack...
Finally loaded the 4th page. Apparently they knocked an authorized user off the AP repeatedly and collected the resulting flood of reauthentication packets, plus used packet replay attacks to get the AP to respond to replayed ARP requests (apparently they are easy to spot in a pcap dump despite encryption). This gave them all the IVs they needed to crack the key.
Parent
Re:Not too surprising (Score:5, Informative)
I always click on the printer-friendly format. That usually gives you the article and pictures on one continuous page.
Parent
Re:Not too surprising (Score:5, Funny)
Parent
Re:Not too surprising (Score:5, Funny)
Parent
Re:Not too surprising (Score:5, Insightful)
Random password generator? On a website? And it's not logging my IP and the password it has generated for me? I would have to be paid to believe this
Seriously, how secure is that?
Parent
Re:Countermeasures & Conclusion (Score:5, Informative)
The page you snipped this from is cached here:
http://66.102.7.104/search?q=cache:ChC8gBE_LsEJ:w
Parent
Re:Countermeasures & Conclusion (Score:4, Informative)
1) Install a OpenBSD [openbsd.org] after plugging in a wireless card that can be used in hostap mode.
2) Install OpenVPN [openvpn.net] (that has a nice Windows client), and generate server and client certificates. There are howto and scripts for this.
3) Configure the built-in OpenBSD packet filter [openbsd.org] to only accept connections to/from OpenVPN ports on the wireless NIC.
4) Show war drivers the finger.
Parent
Re:Those Crazy Feds (Score:5, Funny)
Actually, the Password was 1-2-3-4-5.
I found that to be rather disturbing, since I have the same combination on my luggage.
Parent
You are joking right? (Score:4, Informative)
OK, just in case you seriously don't know, MAC addresses are not encrypted, so it is dead simple to sniff traffic to find valid MAC addresses and then change the MAC address of the hacking box to the valid MAC address (usually during a time when that machine is not actually connected). I've heard that this is a good way to gain access at pay to play locations like Starbucks
Also keep in mind that MAC filtering only prevents someone from joining the network, you can still sniff at will at the packets.
Parent
Re:Watch the FBI take credit for somebody else's w (Score:5, Informative)
1. Where in the article does it say the FBI developed the attacks? Did you RTFA?
2. For the IDS comment, I did state that it is NOT a stealthy attack. Not stealthy = IDS will pick it up.
3. You weren't at the talk, and it shows. They did give credit (a LOT of credit) to KoreK and Devine, but I didn't put it in the article. So you can blame me for it.
Parent