RE: Cracking WEP and WPA keys

["Rui Pereira (WCG)" <wavefront1 () shaw ca>]

With Open Authentication the WEP key is never sent on the wireless
connection.

With Shared Key authentication the WEP key is not sent but a challenge text
is sent in the clear. The wireless client encrypts the challenge text with
the WEP key and sends that back to the AP. Someone sniffing wireless packets
during this authentication session could derive the WEP key given that they
would have both the plaintext challenge and its encrypted form - the
plaintext and the cipher text - and could solve for the missing WEP key.
Anyone know of a tool that automates this process?

Thank You
 
Rui Pereira
Principal Consultant
WaveFront Consulting Group



-----Original Message-----
From: Demetrio Carrión [mailto:demetrio.carrion () gmail com] 
Sent: December 16, 2005 3:51 AM
To: pen-test () securityfocus com
Subject: Re: Cracking WEP and WPA keys


Hi,

The key is not sent to the AP in the clear. The WEP authentication is a
challenge-response protocol.

1. The AP sends a 128bit number (challenge)
2. The client/user encrypts the challenge with the WEP key (Challenge XOR
Key) 3. The AP compares the client response against the expected response.
4. The AP sends an ACK or NACK response

You can brute force the response, since you have the challenge and might end
up discovering the key. You don't need to set up a fake AP to carry out this
type of attack, although.

Regards,

Demetrio Carrión

On 12/14/05, pagvac <unknown.pentester () gmail com> wrote:
> Would the following attack be feasible for obtaining a WEP key?
>
> Set up an AP with VERY strong signal and same SSID as the one used by 
> the target network. After that, the client should be able to attempt 
> to connect to your AP (you send stronger signal than the legitimate
> one) and send you the WEP which you could sniff from the AP itself.
>
> After that you're done and the key is yours.
>
> Am I talking non-sense here? Wouldn't the WEP key be sent to the AP in 
> the *clear* at the beginning of the handshake? Otherwise how can the 
> AP check whether or not the client is using the right key?
>
> I've never tested this and my assumptions might be based on incomplete 
> and inaccurate knowledge about how wi-fi technologies.
>
> ----------------------------------------------------------------------
> --------
> Audit your website security with Acunetix Web Vulnerability Scanner:
>
> Hackers are concentrating their efforts on attacking applications on 
> your website. Up to 75% of cyber attacks are launched on shopping 
> carts, forms, login pages, dynamic content etc. Firewalls, SSL and 
> locked-down servers are futile against web application hacking. Check 
> your website for vulnerabilities to SQL injection, Cross site 
> scripting and other web attacks before hackers do! Download Trial at:
>
> http://www.securityfocus.com/sponsor/pen-test_050831
> ----------------------------------------------------------------------
> ---------


--
Demetrio de Souza Diaz Carrión
Mestrando em Redes de Computadores COPPE/UFRJ
Engenheiro Eletrônico UFRJ

----------------------------------------------------------------------------
--
Audit your website security with Acunetix Web Vulnerability Scanner: 

Hackers are concentrating their efforts on attacking applications on your 
website. Up to 75% of cyber attacks are launched on shopping carts, forms, 
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are

futile against web application hacking. Check your website for
vulnerabilities 
to SQL injection, Cross site scripting and other web attacks before hackers
do! 
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
----------------------------------------------------------------------------
---




------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner:

Hackers are concentrating their efforts on attacking applications on your
website. Up to 75% of cyber attacks are launched on shopping carts, forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
futile against web application hacking. Check your website for vulnerabilities
to SQL injection, Cross site scripting and other web attacks before hackers do!
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------