Fall Back Son

I was told that programs such as cain and abel can crack WEP keys with relative ease. I'm curious as to how this works. I'm not sure if this fits into any of the forums, so I posted it here. If anyone wants to share their knowledge on the subject. Thanks.

mrynit

http://revision3.com/thebroken/ep1

http://www.twit.tv/sn89

http://www.hak5.org/episodes/ ep 2x07

__________________
i dont know much about programming but i try to help

john Wesley

http://www.remote-exploit.org/

Backtrack2 from the above link is the easiest way (I know of) to check the integrity of the security of a wireless network. If you cant exploit it with Backtrack then either:

A) It does not have driver support for your wireless card or

B) The network is 100%, which I have never seen before.

__________________
Mona Lisa must of had the highway blues you can tell by the way she smiles..

Fall Back Son

thanks guys, I would never have stumbled across those links on my own... and lol @ the broken episode playing the music from "living in a gangsters paradise" (you might know it as living in an amish paradise by weird al though.

he didn't explain what a weak key was. I'm assuming its a packet which contains encryption which isn't as strong as other packets. why though?

and lol @ the pizza thing. owned.

mrynit

nmap, etherreal and metasploit are some good tools

__________________
i dont know much about programming but i try to help

Fall Back Son

yeah but I'm not interested in breaking a wireless network. if that was the case I'm sure I could download some programs and read directions on their use. I'm interested in the technical aspects, such as how WEP encryption is breakable, etc. Maybe I just don't understand how the network is encrypted, but I've been reading up on it.

john Wesley

public/private key encryption.

The public key is stored in each destined packet when sent along with your encrypted WEP key, we can then receive it and with our private key and the public key decrypt the WEP key, or not depending on whether we have the correct key-pairs to decrypt it.

If only it were that simple...?

Does anyone here actually have a good knowledge of wireless networks? As it would be nice to have some confirmation.

__________________
Mona Lisa must of had the highway blues you can tell by the way she smiles..

Dameon

Check your facts.

WEP uses a stream cipher, specifically RC4. It serves the purpose of generating a more or less random stream of bits for a given key. The resulting random data is then XORed with the data that needs to be encrypted. In the case of WEP this is wireless traffic.

In order for the encryption to be useful, the Bad Guys(tm) can't know your key. If they know your key, they can generate the same stream of bits to XOR with your traffic and read it, or even generate their own and associate with the access point.

The key used for a given packet consists of the initialization vector (IV) as well as the key that you must configure for each wireless device (the one we're looking for). The IV is random and included, in the clear, in each packet. The reason is that repeated keys in RC4 are bad. Using the user configured key on each packet on its own isn't a good idea.

The IV is supposed to prevent this. The effective RC4 key keeps changing -- part of it is secret, and the plaintext IV is supposed to be useless to the attacker since the combined key can't be derived from the payload. But the problem is that the IV is too short -- chances are very good in fact (birthday paradox) that multiple packets will have the same key. Coupled with some other weaknesses, including the fact that the first byte of the unencrypted data is almost always the same due protocol specs, the all-important key can be derived from a reasonable number of packets.

More details here, in annoying detail.
PDF Warning
http://www.rootsecure.net/content/do...p_analysis.pdf
http://www.drizzle.com/~aboba/IEEE/rc4_ksaproc.pdf

More useful stuff, but less reliable:
http://en.wikipedia.org/wiki/Stream_cipher_attack
http://en.wikipedia.org/wiki/Wired_Equivalent_Privacy
http://en.wikipedia.org/wiki/RC4
http://en.wikipedia.org/wiki/Birthday_paradox

__________________
MD5(sig) = bcef75433db02e9ad9bf81d6f7c5c270

john Wesley

Kind of implying there that I dont know the facts, or at least I thought so...

__________________
Mona Lisa must of had the highway blues you can tell by the way she smiles..

Fall Back Son

I read your post and attempted to read the links, but both were over my head. I do appreciate you trying to help though... it's frustrating not understand most of this stuff.