One-minute WiFi crack puts further pressure on WPA

In the wake of WEP's failure, WiFi Protected Access (WPA) was supposed to keep …

Nate Anderson – Aug 27, 2009 3:02 pm | 40

Researchers have come a step closer to breaking open a common WiFi encryption scheme. An attacker can now read and falsify short packets in the common TKIP version of WiFi Protected Access (WPA) encryption in about one minute—a huge speed increase from the previously-required 12-15 minutes.

The hack is not a complete break; it only results in the ability to read and falsify particular short data packets, but cannot retrieve a WPA encryption key. Still, the rapid development of WPA hacks suggests that those paranoid about security ensure that their WiFi networks are using WPA2 with AES encryption rather than WPA with TKIP.

The current attack comes courtesy of Toshihiro Ohigashi (Hiroshima University) and Masakatu Morii (Kobe University), and it is outlined in a new paper (PDF) of theirs called “A Practical Message Falsification Attack on WPA.” It builds on 2008 research from a pair of German students, research that also attacked WPA TKIP systems and could read individual packets, crafted new data for them, then recalculate a legitimate packet checksum.

That attack, called the Beck-Tews attack, had several weaknesses: it only worked on WPA implementations that supported 802.11 quality of service (QOS) features, it only worked on short packets, and it took about 15 minutes.

In less than a year, the Japanese team was able to build on the Beck-Tews attack and apply it to “man in the middle” situations. The result: an attack that functioned on any WPA TKIP network, regardless of QOS, and one that works in about a minute.

In the paper, the researchers describe a scheme in which a computer and a WiFi access point are far enough apart that neither can communicate with each other—but each can talk to the “attacker” computer sitting between them. The attacker then acts as a repeater, passing along the proper packets in both directions. When falsified packets are to be sent, the attacker executes the now-standard “chopchop” attack on a short packet (often ARP broadcasts), deciphers its 64-bit Message Integrity Code (MIC), and can then craft whatever packet it wants. The new packet is coded with the proper checksums and passed along to the access point, which should accept it as genuine.

As we noted when first covering the Beck-Tews attack, WPA is “battered but not broken” by such an attack. These two attacks can certainly present problems, but they do not threaten the overall encryption of the wireless stream. They do highlight weaknesses of TKIP-based encryption, which was designed to patch up some of egregious security holes in the first WiFi encryption protocol, WEP.

But the good news is that encryption has already moved on. WPA2 with AES encryption is now standard on most WiFi products and has yet to show similar security weaknesses.

Further reading: