Researchers find more flaws in wireless security

Wireless networks that use a popular form of security known as Wi-Fi Protected Access (WPA) are vulnerable to an attack that could compromise certain communications in less than 15 minutes, two researchers plan to tell attendees next week at the PacSec 2008 conference in Tokyo.

Martin Beck and Erik Tews — two graduate students at technical universities in Germany — found a combination of techniques that allow an attacker to decrypt limited communications protected with the lesser of two WPA security protocols, known as the Temporal Key Integrity Protocol or TKIP.

Click below to read more.

Wireless networks that use a popular form of security known as Wi-Fi Protected Access (WPA) are vulnerable to an attack that could compromise certain communications in less than 15 minutes, two researchers plan to tell attendees next week at the PacSec 2008 conference in Tokyo.

Martin Beck and Erik Tews — two graduate students at technical universities in Germany — found a combination of techniques that allow an attacker to decrypt limited communications protected with the lesser of two WPA security protocols, known as the Temporal Key Integrity Protocol or TKIP. Using the techniques, attackers could also recover a special integrity checksum and send up to seven custom packets to clients on the network, sources told SecurityFocus.

The attack does not allow the key protecting the communications to be recovered, one of the researchers stressed in an e-mail to SecurityFocus.

"The new attack on WPA is not a complete key recovery attack," Tews said in the e-mail. "It just allows you to decrypt packets and inject packets with custom content. But there is only a single short-term key recovered during the attack."

The research describes the latest weakness in wireless networks' security. In 2001, three researchers found a way to reliably break the previous wireless security protocol, known as Wired Equivalent Privacy (WEP), in less than two hours. By 2007, the latest refinement in attacks against WEP – found by Tews and two other researchers – reduced the time to recover a WEP key to <a href='http://www.cdc.informatik.tu-darmstadt.de/aircrack-ptw/' target='_blank'>less than a minute of calculations.

In 2002, after seeing WEP thoroughly broken, the industry alliance responsible for setting standards for wireless access points <a href='http://www.securityfocus.com/news/1554' target='_blank'>created the Wi-Fi Protected Access (WPA) protocol. Two years, later the firms <a href='http://www.securityfocus.com/news/7968' target='_blank'>created a stronger version of the standard known as WPA2.

Tews and Beck's attack appears to be the first practical, albeit limited, break of WPA encryption.

The duo's attack on WPA's Temporal Key Integrity Protocol (TKIP) uses a similar technique to an attack on WEP found in 2004, according to a copy of Beck's and Tews' presentation obtained by SecurityFocus. The WEP attack, known as <a href='http://www.securityfocus.com/infocus/1824' target='_blank'>chopchop, could decipher a packet of data without knowing the key by guessing each byte and using the access point as a check on each guess: If the packet is accepted by the access point, then the attacker knows the plaintext guess is correct.

The Temporal Key Integrity Protocol (TKIP) adds several countermeasures to foil attacks that would have succeeded against WEP. The protocol adds a message integrity check, or MIC, to protect against header and message alterations and uses replay counters to prevent replay attacks.

The researchers, however, found that the countermeasures only made the attack take longer: A wrong guess would cause the packet to be dropped by the access point, while a correct guess would cause a MIC failure and require the attacker to wait 60 seconds. In the case of an important type of networking data known as an Address Resolution Protocol (ARP) packet, only 14 bytes are not known. In less than 15 minutes, an encrypted ARP packet could be deciphered, including the secret MIC data, according to the researchers' presentation.

The attack also allows a limited amount of data to be sent on other channels using the same keystream — an end run around the replay-attack protection of TKIP.

While the security vulnerabilities are limited, the techniques could be used in a denial-of-service (DoS) attack, the researchers stated in their presentation, by using ARP injection to overwrite entries in the ARP table or potentially attack a local network's domain servers. The technique could also be used to channel data through a corporate firewall, they added.

In an e-mail to a security mailing list, PacSec conference organizer Dragos Ruiu recommended that wireless-network administrators move to WPA2 or use the improved WPA security mode, known as Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP). In the latter case, the access point should not allow clients to revert to TKIP for communications with legacy systems, Ruiu said.

"If you aren't given the option to disable this, you might want to think about getting a different Access Point or WiFi Router," he said.

According to Tews, an experimental implementation of the researchers' attack has been introduced into a development version of the aircrack-ng tool.

Beck and Tews plan to discuss their findings at the PacSec conference in Tokyo next week.

Source: <a href='http://www.securityfocus.com/news/11537' target='_blank'>http://www.securityfocus.com/news/11537