Erik Tews
ABSTRACT
In this paper, we describe two attacks on IEEE 802.11 based wireless LANs. The first attack is an improved key recovery attack on WEP, which reduces the average number of packets an attacker has to intercept to recover the secret key. The second attack is (according to our knowledge) the first practical attack on WPA secured wireless networks, besides launching a dictionary attack when a weak pre-shared key (PSK) is used. The attack works if the network is using TKIP to encrypt the traffic. An attacker, who has about 12-15 minutes access to the network is then able to decrypt an ARP request or response and send 7 packets with custom content to network.
- Andrea Bittau, Mark Handley, and Joshua Lackey. The final nail in WEP's coffin. In IEEE Symposium on Security and Privacy, pages 386--400. IEEE Computer Society, 2006. Google Scholar
Digital Library
- IEEE-SA Standards Board. Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications. Communications Magazine, IEEE, 2007.Google Scholar
- Rafik Chaabouni. Break WEP faster with statistical analysis. Technical report, EPFL, LASEC, June 2006.Google Scholar
- Scott R. Fluhrer, Itsik Mantin, and Adi Shamir. Weaknesses in the key scheduling algorithm of RC4. In Serge Vaudenay and Amr M. Youssef, editors, Selected Areas in Cryptography 2001, volume 2259 of Lecture Notes in Computer Science, pages 1--24. Springer, 2001. Google ScholarDigital Library
- David Hulton. Practical exploitation of RC4 weakness in WEP environments, 2002. presented at HiverCon 2002.Google Scholar
- Robert J. Jenkins. Isaac and rc4. {http://burtleburtle.net/bob/rand/isaac.html, 1996.Google Scholar
- A. Klein. Attacks on the RC4 stream cipher. Designs, Codes and Cryptography, 48(3):269--286, 2008. Google ScholarDigital Library
- KoreK. chopchop (experimental WEP attacks). http://www.netstumbler.org/showthread.php?t=12489, 2004.Google Scholar
- KoreK. Next generation of WEP attacks? http://www.netstumbler.org/showpost.php?p=93942&postcount=35, 2004.Google Scholar
- Yuko Ozasa, Yoshiaki Fujikawa, Toshihiro Ohigashi, Hidenori Kuwakado, and Masakatu Morii. A study on the Tews, Weinmann, Pyshkin attack against WEP. In IEICE Tech. Rep., volume 107 of ISEC2007-47, pages 17--21, Hokkaido, July 2007. Thu, Jul 19, 2007 - Fri, Jul 20 : Future University-Hakodate (ISEC, SITE, IPSJ-CSEC).Google Scholar
- D. C. Plummer. RFC 826: Ethernet Address Resolution Protocol: Or converting network protocol addresses to 48.bit Ethernet address for transmission on Ethernet hardware, November 1982. Google ScholarDigital Library
- David Sterndark. Rc4 algorithm revealed. Usenet posting, Message-ID: [email protected], Sep 1994.Google Scholar
- Adam Stubblefield, John Ioannidis, and Aviel D. Rubin. A key recovery attack on the 802.11b wired equivalent privacy protocol (WEP). ACM Transactions on Information and System Security, (2):319--332, May 2004. Google ScholarDigital Library
- Erik Tews. Attacks on the wep protocol. Cryptology ePrint Archive, Report 2007/471, 2007. http://eprint.iacr.org/.Google Scholar
- Erik Tews, Ralf-Philipp Weinmann, and Andrei Pyshkin. Breaking 104 bit wep in less than 60 seconds. In Sehun Kim, Moti Yung, and Hyung-Woo Lee, editors, WISA, volume 4867 of Lecture Notes in Computer Science, pages 188--202. Springer, 2007. Google ScholarDigital Library
- Serge Vaudenay and Martin Vuagnoux. Passive-only key recovery attacks on RC4. In Selected Areas in Cryptography 2007, Lecture Notes in Computer Science. Springer, 2007.Google ScholarDigital Library
Index Terms
- Practical attacks against WEP and WPA
Recommendations
Practical verification of WPA-TKIP vulnerabilities
ASIA CCS '13: Proceedings of the 8th ACM SIGSAC symposium on Information, computer and communications securityWe describe three attacks on the Wi-Fi Protected Access Temporal Key Integrity Protocol (WPA-TKIP). The first attack is a Denial of Service attack that can be executed by injecting only two frames every minute. The second attack demonstrates how ...
Real-Life Paradigms of Wireless Network Security Attacks
PCI '11: Proceedings of the 2011 15th Panhellenic Conference on InformaticsWirelesses Local Area Networks (WLANs) have become more prevalent and are widely deployed in many popular places like university campuses, cafés, airports, residences, etc. However, WLAN security is a very important but usually neglected issue. Focusing ...
Practical Side-Channel Attacks against WPA-TKIP
Asia CCS '19: Proceedings of the 2019 ACM Asia Conference on Computer and Communications SecurityWe measure the usage of cipher suites in protected Wi-Fi networks, and do this for several distinct geographic areas. Surprisingly, we found that 44.81% of protected networks still support the old WPA-TKIP cipher. Motivated by this, we systematically ...
Comments