Encryption broken in 3 seconds

Apr 5, 2007 14:32 GMT  ·  By

For all of you who are using a notebook, you must have heard of Wired Equivalent Privacy (WEP), the wireless network security standard. It has been ratified as a standard in 1999, and the technology behind it uses a stream cipher RC4 for confidentiality and the CRC-32 checksum for integrity. This standard has always been susceptible of being intercepted through the network and possibly decrypted, but the chances weren't that big so it was still considered safe.

Up until somebody broke it, badly, and the people that did it made it look sooo easy. Erik Tews, Ralf-Philipp Weinmann and Andrei Pyshkin, researchers at the computer science department at Darmstadt University of Technology in Darmstadt, Germany, have published a paper in which they showed how to break the 104-bit WEP encryption in less than one minute. By capturing packets, with a program such as Wireshark (previously known as Ethereal), a 50% success rate was achieved with 40.000 frames and 95% probability meant capturing 85.000 packets. By using an Intel Pentium M processor running at 1.7GHz, the key could be extracted from the intercepted data in 3 seconds, thus making this discovery extremely dangerous for the people that use this protocol to protect themselves on a network.

It's a known case that hackers are using celebrities to attract unsuspecting PC users onto websites which take advantage of the Windows pointer vulnerability, so they can hack their computers. And since the study was published, more of these "well-doers" will be "knocking" on your door to see if there is anybody at home.

Erik Tews said: "We think this can even be done with some PDAs or mobile phones, if they are equipped with wireless LAN hardware. Depending on your skills, it will cost you some minutes to some hours to switch your network to WPA. If it would cost you more than some hours of work if such private data becomes public, then you should not use WEP anymore."