Hacking Wireless Networks For Dummies

260 Part III: Advanced Wi-Fi Hacks

As if key management problems weren’t enough, you have other problems with the WEP algorithm. Check out these bugbears in the WEP initialization vector:

The IV is too small and in cleartext. It’s a 24-bit field sent in the cleartext portion of a message. This 24-bit string, used to initialize the key stream generated by the RC4 algorithm, is a relatively small field when used for cryptographic purposes.

The IV is static. Reuse of the same IV produces identical key streams for the protection of data, and because the IV is short, it guarantees that those streams will repeat after a relatively short time (between 5 and 7 hours) on a busy network.

The IV makes the key stream vulnerable. The 802.11 standard does not specify how the IVs are set or changed, and individual wireless adapters from the same vendor may all generate the same IV sequences, or some wireless adapters may possibly use a constant IV. As a result, hackers can record network traffic, determine the key stream, and use it to decrypt the ciphertext.

The IV is a part of the RC4 encryption key. The fact that an eavesdropper knows 24-bits of every packet key, combined with a weakness in the RC4 key schedule, leads to a successful analytic attack that recovers the key after intercepting and analyzing only a relatively small amount of traffic. Such an attack is so nearly a no-brainer that it’s publicly available as an attack script and as open-source code.

WEP provides no cryptographic integrity protection. However, the 802.11 MAC protocol uses a non-cryptographic Cyclic Redundancy Check (CRC) to check the integrity of packets, and acknowledges packets that have the correct checksum. The combination of non-cryptographic checksums with stream ciphers is dangerous — and often introduces vulnerabilities. The classic case? You guessed it: WEP.

There is an active attack that permits the attacker to decrypt any packet by systematically modifying the packet, and CRC sending it to the AP and noting whether the packet is acknowledged. These kinds of attacks are often subtle, and it is now considered risky to design encryption protocols that do not include cryptographic integrity protection, because of the possibility of interactions with other protocol levels that can give away information about ciphertext.

Only one of the problems listed above depends on a weakness in the cryptographic algorithm. Therefore substituting a stronger stream cipher will not help. For example, the vulnerability of the key stream is a consequence of a weakness in the implementation of the RC4 stream cipher — and that’s exposed by a poorly designed protocol.

262 Part III: Advanced Wi-Fi Hacks

The manufacturer may provide one or more keys to enable shared-key authentication between the device that’s trying to gain access to the network and the AP. And yes, we’re going to say it again: Using a default shared-key setting is a security vulnerability — a common one because many vendors use identical shared keys in their factory settings. A malicious cracker may know the default shared key and use it to gain access to the network.

Don’t use default WEP keys! No matter what your security level, your organization should change the shared key from its default setting because it’s just too easily exploited. In the event you don’t know the default keys for a wireless access point (or you don’t know whether there is a default key), check out www.cirt.net.

Some products generate keys after a keystroke from a user that, when done properly using the appropriate random processes, can result in a strong WEP key. Other vendors, though, based WEP keys on passwords chosen by users; this typically reduces the effective key size.

You may find your configuration utility doesn’t have a passcode generator, but allows you to enter the key as alphanumeric characters (that is, a to z, A to Z, and 0 to 9) rather than as a hexadecimal number. You just need to create a good passcode, right? Sounds like a good idea — until you study it. Each character you enter represents 8 bits, so you can type 5 characters for a 40bit code and 13 characters for a 104-bit code. Entering 5 characters in ASCII is not as strong as generating the key randomly in hexadecimal. Think of all the poor five-letter passcodes you could create!

So take it from us: WEP is weak. The following is a summary of some of the more glaring weaknesses of WEP:

The IV value is too short — and not protected against reuse.

The way keys are constructed from the IV makes it susceptible to weak key attacks.

There is no effective detection of message tampering; that is, WEP has no effective message integrity.

It directly uses the master key and has no built-in provision to update the keys.

There is no provision against message replay.

There is no key-management mechanism built in.

At a minimum, enterprises should employ the built-in WEP encryption. But that’s a poor minimum. And it’s amazing how many access points don’t have any encryption at all. We find that less than half the access points we stumble on have encryption of any sort.

Chapter 14: Cracking Encryption 263

If an access point is using WEP, it makes your hacking a little more difficult but certainly not impossible. You just need to get yourself a WEP cracker. Several are available from Web sites on the Internet and are relatively easy to use. If you’ve dug in to Chapter 8 and know how to use ethereal, then cracking WEP keys is easy.

How long it will take to crack the WEP key depends on the access point’s level of activity.

Attacking WEP

There are several active and passive attacks for WEP as follows:

Active attacks to inject traffic based on known plaintext

Active attacks to decrypt traffic based on tricking access points

Dictionary-based attacks after gathering enough traffic

Passive attacks to decrypt traffic using statistical analysis

The following sections discuss these attacks in detail.

Active traffic injection

Suppose an attacker knows the exact plaintext version of one encrypted message using a passive technique. The attacker can use this information to construct — and insert — correctly encrypted packets for the network. To do this, the attacker constructs a new message calculating CRC-32 values and performs bit-flips on the original message to encrypt plaintext in its encrypted form. The attacker can now send the packet to the access point,

undetected. There are several variations on this technique; here’s where you get the tools to use them:

Aireplay: This program lets you take any captured packet and reinject it back onto the network.

WEPWedgie (http://sourceforge.net/projects/wepwedgie/): This program is a toolkit for determining 802.11 WEP keystreams and injecting traffic with known keystreams.

Active attack from both sides

An extension of the active injection technique from the previous section. The attacker makes guesses on packet header contents rather than packet

264 Part III: Advanced Wi-Fi Hacks

payload. Bit-flipping can transform destination addresses and route traffic to rogue devices where retransmission (with alterations) could occur. Educated guessing can also provide port information to allow passage through firewalls by changing it to use port 80 (the default port for Web traffic).

Table-based attack

A small space of possible WEP initialization vectors (IVs) — and the high likelihood they’ll be reused at relatively short intervals — allow attackers to build decryption tables. Using passive techniques, the attacker gains some plaintext information. The attacker can then compute the RC4 key stream used by the IV. Over time, repetitive techniques allow an attacker to build a complete decryption table of all possible IVs. This allows an attacker to decipher every packet sent.

Passive attack decryption

This is more of an intrusion than an attack, but monitoring leads to further exploits. An attacker monitors traffic until an IV collision occurs. A collision is when the algorithm reuses an IV. When a collision happens, the shared secret and the repeated IV results in a key stream that has been used before. Because the algorithm sends the IV in ciphertext, an attacker keeping track of all the traffic can identify when collisions occur. Then, the attacker will use the resulting XOR information to infer data about the message content.

IP traffic is redundant in nature, and replication of this process easily yields enough data to decipher the encrypted text.

You can find commercial, off-the-shelf (COTS) hardware readily available to monitor 2.4 GHz transmissions. We cover some of these products in Chapter 8. By re-configuring drivers, you can cause the hardware to intercept encrypted traffic. Using the techniques described previously, you can make the WLAN vulnerable.

Cracking Keys

We have discussed a lot of WEP flaws in this chapter, with good reason: WEP is the algorithm most commonly used to protect wireless networks. But WEP has many flaws. These flaws leave WEP open to crack attacks. To crack WEP keys, you need

A large amount of captured frames

A program to process the frames

266 Part III: Advanced Wi-Fi Hacks

Figure 14-2:

The ActivePerl installation wizard.

Figure 14-3:

Custom setup window.

5.In the New features in PPM window, either select Enable PPM3 to send profile info to ASPN; otherwise click Next.

6.If you wish, deselect any options you won’t be using and then click Next.

7.Click the Install button.

The Install Status window appears. As it says in the window, installation can take several minutes. When the process is complete, you are ready to use PERL.

Chapter 14: Cracking Encryption 267

8.From the Start menu, select Run.

9.Type command in the Open: dialog box and then click OK.

10.At the command prompt, type perl \progra~1\wepcrack\pcapgetIV.pl.

Of course, you’ll have to substitute the correct path for your WEPcrack PERL routines; the one we show here is just an example. This script itself is useless unless you have a captured packet you can drop in from another program such as ethereal or prismdump. You will need about 5 million frames; then you can proceed to Step 11.

If you have prismdump and want to do it in one step, you can run the command prismdump | pcap-getIV.pl. The output of this step is the ivfile.log file.

11.Start WEPcrack by typing perl \progra~1\wepcrack\wepcrack. pl ivfile.log.

Oops, there goes another WEP key.

12.When you are finished, click the X in the upper right-hand corner of the window.

Unfortunately, the key is in decimal format, so you have to convert it to hexadecimal before you can use it.

Using AirSnort

AirSnort (http://airsnort.shmoo.com/) is a passive scanner that also cracks WEP keys. When AirSnort gathers enough weak initialization vectors, it starts to crack the WEP key. Of the over 16 million IVs, approximately nine thousand of the 128-bit keys are weak. AirSnort looks for these weak keys. The folks at the Shmoo Group estimate they need only about 2,000 weak IVs to guess the WEP key.

You can download AirSnort from Sourceforge at

http://sourceforge.net/projects/airsnort/

It runs on a UNIX platform, and is fairly easy to install and use. Windows users can also get WinAirSnort from Nevillon at

www.nwp.nevillon.org/attack.html

Figure 14-4 shows the WinAirSnort window that looks eerily like the Linux version.