Re: Cracking WEP and WPA keys

[Cedric Blancher <blancher () cartel-securite fr>]

Le vendredi 16 décembre 2005 à 09:50 -0200, Demetrio Carrión a écrit :
> 1. The AP sends a 128bit number (challenge)
> 2. The client/user encrypts the challenge with the WEP key (Challenge XOR Key)

No, it's not Challenge XOR Key, it's:

        Challenge XOR RC4(IV,Key)

It would be too simple if it was :

        Response = Challenge XOR Key <=> Key = Response XOR Challenge 

But anyway, you still have:

        RC4(IV,Key) = Response XOR Challenge

And you both know Response and Challenge. So you can guess 144 bytes of
RC4(IV,Key), which allows you yoo:

        1. Authenticate yourself by crafting any challenge response
           using this RC4(IV,Key)
        2. Inject any frame you want using this RC4(IV,Key) providing
           payload does not exceed 132 bytes

You can't guess the key, however, you get sufficient knowledge to be
able to inject traffic, and then perform chopchop or aireplay attacks.


-- 
http://sid.rstack.org/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
> > Hi! I'm your friendly neighbourhood signature virus.
> > Copy me to your signature file and help me spread!

------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner:

Hackers are concentrating their efforts on attacking applications on your
website. Up to 75% of cyber attacks are launched on shopping carts, forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
futile against web application hacking. Check your website for vulnerabilities
to SQL injection, Cross site scripting and other web attacks before hackers do!
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------