NEWS: WPA networks open to limited attack

Researchers find more flaws in wireless security
<http://www.theregister.co.uk/2008/11/08/wi_fi_protected_access_attack/>

Wireless networks that use a popular form of security known as Wi-Fi
Protected Access (WPA) are vulnerable to an attack that could compromise
certain communications in less than 15 minutes, two researchers plan to
tell attendees next week at the PacSec 2008 conference in Tokyo.

Martin Beck and Erik Tews - two graduate students at technical
universities in Germany - found a combination of techniques that allow
an attacker to decrypt limited communications protected with the lesser
of two WPA security protocols, known as the Temporal Key Integrity
Protocol or TKIP. Using the techniques, attackers could also recover a
special integrity checksum and send up to seven custom packets to
clients on the network, sources told SecurityFocus.

The attack does not allow the key protecting the communications to be
recovered, one of the researchers stressed .

....

While the security vulnerabilities are limited, the techniques could be
used in a denial-of-service (DoS) attack, the researchers stated in
their presentation, by using ARP injection to overwrite entries in the
ARP table or potentially attack a local network's domain servers. The
technique could also be used to channel data through a corporate
firewall, they added.

In an email to a security mailing list, PacSec conference organizer
Dragos Ruiu recommended that wireless-network administrators move to
WPA2 or use the improved WPA security mode, known as Counter Mode with
Cipher Block Chaining Message Authentication Code Protocol (CCMP). In
the latter case, the access point should not allow clients to revert to
TKIP for communications with legacy systems, Ruiu said.

"If you aren't given the option to disable this, you might want to think
about getting a different Access Point or Wi-Fi Router," he said.

According to Tews, an experimental implementation of the researchers'
attack has been introduced into a development version of the aircrack-ng
tool.

[MORE]