This one hit my in-box tonight. I'm forwarding the information about the crack of the wired equivalent privacy ( WEP ) This is far more serious than the announcement by the Berkeley folks a few weeks ago. I look forward to Cisco's response. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Sunday, August 12, 2001 11:50 PM Subject: SECURITY WIRE DIGEST, VOL. 3, NO. 63, AUGUST 13, 2001 Security Wire Digest is an e-mail newsletter brought to you on Mondays and Thursdays by Information Security magazine. SWD is written, edited and produced by: Shawna McAlearney, editor, mailto:[EMAIL PROTECTED] Andy Briney, mailto:[EMAIL PROTECTED] Anne Saita, mailto:[EMAIL PROTECTED] Christine St. Pierre, mailto:[EMAIL PROTECTED] Lawrence M. Walsh, mailto:[EMAIL PROTECTED] 1. INFOSEC NEWS *POP GOES THE WEP PROTOCOL By Shawna McAlearney Any remaining illusions about the security of 802.11 protocol for wireless local-area networks (WLAN) were dashed last week when AT&T Labs released a report describing a devastating new attack that acquires a network key in 15 minutes. Based on the RC4 cipher, the wired-equivalent privacy (WEP) encryption scheme has weaknesses in the key-scheduling algorithm that allows an attacker to retrieve a network's key, gaining full user access in less than 15 minutes, according to the report written by AT&T's Adam Stubblefield, John Ioannidis and Avi Rubin. University of Maryland computer scientists earlier this year found a way to "sniff" cleartext messages containing the name of the network, which is used as a shared secret for authentication in some 802.11 implementations. A similar problem was found in the media access-control addresses used on the WLAN cards, which also broadcast in easy-to-capture cleartext. A third flaw involved an encryption error that allows an attacker to capture plaintext and ciphertext of shared keys and leverage them against WEP's shared-key authentication to join the network. Earlier, researchers at the University of California at Berkeley found a number of ways to intercept and modify wireless transmissions and to access restricted networks. Previous attacks have taken from eight hours to several days to exploit, and resulted in the capture of finite amounts of encrypted data--not the retrieval of the full network key. "It's much worse than the Berkley paper," says Chris Wysopal, @stake's director of research and development, also known as Weld Pond. "Their attack never recovered the key--only bits and pieces of encrypted data--and it was fairly difficult to do because you captured the data and then had to go and crack it. That's not the case with the new exploit." Another ramification of the new exploit is that it's passive, never giving the user any indication that he is being monitored. "In this attack, an attacker never has to actually transmit a packet; he can simply sit on the network and the victim will never even know that he was attacked," says Stubblefield, the AT&T Labs intern who created the exploit. "So this is a much stronger attack and allows the attacker to completely recover the key, which means that he can send arbitrary data on the network." Though only recently standardized, 802.11 has been incorporated into the Microsoft Windows OS and WLAN components by several companies. It's also widely deployed in corporations, hospitals and other locations. "The 802.11 standard is really catching on because it's very cheap and it replaces the need to completely wire the building," says Stubblefield. "According to the manufacturer, it comes with its own security, but the fact that it's so easy to completely compromise and undermine the security, means that there are now many, many vulnerable networks out there." In addition to the exploit tool made by AT&T Labs, security consultancy @stake also created one to help in its wireless assessment efforts. "The problem lies in the key-scheduling algorithm of RC4 and allows almost anyone with a WLAN-enabled laptop to retrieve a network's key in less than 15 minutes," says Wysopal. "This is only with the 40-bit key, but the attack scales linearly to 128 bits so it shouldn't take much longer." Security experts recommend installing the WLAN outside the firewall using a VPN in a DMZ with only an access point; changing the key immediately and often; and conducting WLAN audits regularly to ensure there are no rogue connections. Others say the entire network would need to be restructured and IPSec installed on each individual desktop. "Mitigation might be doing network-level security on top of the link wire IPSec or doing application-level SSH and using the 802.11 simply as a data link layer for communication and not relying on any security services from that layer," says Rubin, principal researcher at AT&T Labs and author of "White-Hat Security Arsenal." http://www.cs.rice.edu/~astubble/wep ===================================================== Security Wire Digest and Information Security magazine are published by TruSecure, the world's leader in Internet security services. Copyright (c) 2001. All rights reserved. Redistribution of this newsletter is permitted provided all content is reproduced verbatim with proper attribution to Security Wire Digest and Information Security magazine. ===================================================== To SUBSCRIBE to Security Wire Digest, go to: http://infosecuritymag.bellevue.com To UNSUBSCRIBE from SecurityWire Digest, go to: http://infosecuritymag.bellevue.com/USL.asp?[EMAIL PROTECTED] To CHANGE your e-mail address, go to: http://infosecuritymag.bellevue.com/CEL.asp?[EMAIL PROTECTED] To subscribe or renew your existing subscription to Information Security magazine, print edition, please go to: http://www.submag.com/sub/is Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=15842&t=15842 -------------------------------------------------- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
