Re: wep problems
- From: Jeff Liebermann <jeffl@xxxxxxxxxxxxxxxxxxxxxx>
- Date: Fri, 26 Aug 2005 09:23:13 -0700
On Fri, 26 Aug 2005 08:46:54 -0500, "JB"
<jbrandonbbremove@xxxxxxxxxxx> wrote:
>That's actually a misconception. Lots of people will tell you that hacking
>is easy, and will even say that WEP is weak and easily hacked. These are
>people who have never hacked into anything in their life. The reality is
>that WEP is fine for most users.
As one who has done more than a few dry runs in the area of wireless
hacking, I can assure you that it's fairly easy to crack WEP. 30 mins
of sniffing and its done for ASCII generated keys. I usually just
leave my laptop in my truck running, go to lunch, and have the WEP key
when I'm done. Interestingly, every once in a while I run into a
system that I simply cannot extract the WEP key no mattery how hard I
try. I captured over a gigabtye of data on one such system and was
not able to do anything with it using 5 different WEP key extraction
tools. I have no clue why or what they were doing. (No, it wasn't
WPA).
What is difficult is finding a location that will offer a decent
capture of both sides of a wireless session that will yield useful or
incriminating information. You then need a method of taking the TCP
sequence numbers and reassembling the captured data into something
that's readable or useful. This of course assumes that the wireless
user isn't using SSL, SSH, or a VPN.
If obtaining the WEP key is simply to get "access" to the connected
LAN, then there's a real danger. Most internal LAN's are not properly
secured. I hate to admit it, but my home LAN and part of my office
LAN are essentially wide open to a wireless intruder.
>The issue with security is whether
>something is *really difficult to hack or *nearly impossible to hack. I just
>finished testing many security protocols, and the reality is that there are
>a lot of steps involved, you have to know Linux (and I mean, *know Linux),
>you have to be within range of the network and run software for maybe an
>hour or more. Also, hacking is *illegal, so people will need to be happy
>with the idea of being a criminal.
I define impossible as when the cost of the captured data or access
exceeds the value of the captured data or access. However, I don't
think the average teenager that wants broadband access from the
neighbors to bypass the parental controls filter in their home router
is going to subscribe to my definition. He'll do ANYTHING to get
access to the neighbors system, which includes staying up all night to
extract the WEP key.
As for knowing Linux, I agree. At this time, most of the useful tools
are written exclusively for Linux. I'm guessing that it would now be
possible to find a collection of Windoze tools that will do the trick.
I haven't tried. Anyway, with the prevalence of GUI based Linux
LiveCD's, methinks the major barrier to using Linux (installing it on
a hard disk) has been eliminated. Either way, the tools are there and
getting more common and simpler every day.
--
Jeff Liebermann jeffl@xxxxxxxxxxxxxxxxxxxxxx
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
AE6KS 831-336-2558
.
- Follow-Ups:
- Re: wep problems
- From: JB
- Re: wep problems
- References:
- wep problems
- From: hunwalla
- Re: wep problems
- From: David Taylor
- Re: wep problems
- From: hunwalla
- Re: wep problems
- From: hunwalla
- Re: wep problems
- From: JB
- wep problems
- Prev by Date: Re: Legal Ramifications of Open Wireless Networks
- Next by Date: Re: Legal Ramifications of Open Wireless Networks
- Previous by thread: Re: wep problems
- Next by thread: Re: wep problems
- Index(es):
Relevant Pages
|
|
