The “Break it Down” Blog

I guess it was only a matter of time utnil someone found a quick way to break WPA Wi-Fi Encryption.  Erik Tews and his co-researcher Martin Beck found a way to break the Temporal Key Integrity Protocol (TKIP) key used by WPA in a relatively short amount of time: 12 to 15 minutes.  So far they have been able to to read data being sent from a router to a laptop.  They have not yet managed to crack the encryption keys used to secure data that goes from the PC to the router with this same type of attack.

The details of the attack will be discussed next week at the PacSec conference in Tokyo. Erik Tews will be showing how he was able to crack WPA encryption the. The attack could also be used to send bogus information to a computer connected to the router.

IT World has a few more specifics about the attack, but we’ll have to wait until PacSec next week to find out the details and if there is anything that can be done on the router to prevent this type of attack from being so effective.

Security experts had known that TKIP could be cracked using what’s known as a dictionary attack. Using massive computational resources, the attacker essentially cracks the encryption by making an extremely large number of educated guesses as to what key is being used to secure the wireless data.

The work of Tews and Beck does not involve a dictionary attack, however.

To pull off their trick, the researchers first discovered a way to trick a WPA router into sending them large amounts of data. This makes cracking the key easier, but this technique is also combined with a “mathematical breakthrough,” that lets them crack WPA much more quickly than any previous attempt, Ruiu said.

Tews is planning to publish the cryptographic work in an academic journal in the coming months, Ruiu said. Some of the code used in the attack was quietly added to Beck’s Aircrack-ng Wi-Fi encryption hacking tool two weeks ago, he added.

WPA is widely used on today’s Wi-Fi networks and is considered a better alternative to the original WEP (Wired Equivalent Privacy) standard, which was developed in the late 1990s. Soon after the development of WEP, however, hackers found a way to break its encryption and it is now considered insecure by most security professionals. Store chain T.J. Maxx was in the process of upgrading from WEP to WPA encryption when it experienced one of the most widely publicized data breaches in U.S. history, in which hundreds of millions of credit card numbers were stolen over a two-year period.

A new wireless standard known as WPA2 is considered safe from the attack developed by Tews and Beck, but many WPA2 routers also support WPA.

“Everybody has been saying, ‘Go to WPA because WEP is broken,’” Ruiu said. “This is a break in WPA.”

If WPA is significantly compromised, it would be a big blow for enterprise customers who have been increasingly adopting it, said Sri Sundaralingam, vice president of product management with wireless network security vendor AirTight Networks. Although customers can adopt Wi-Fi technology such as WPA2 or virtual private network software that will protect them from this attack, there are still may devices that connect to the network using WPA, or even the thoroughly cracked WEP standard, he said.