Wi-Fi Attacks

Not only one of the first Wi-Fi attacks, but one of the first breaches that led to US government and, uh, others in the industry saying, "Hey, maybe we should have some breach transparency.

Maybe you should be required to notify people of breaches." And back then attackers were focused on stealing payment data, stealing credit card numbers, selling those credit card numbers, or pulling as much cash as they could off them and laundering that money somehow.

And that put w- wireless security in the headlines in a big way.

With WEP, yeah.

Good old WEP.

So that was the first security standard back in the first releases.

Yeah, WEP.

So we don't use WEP anymore.

We don't talk about WEP, right?

It was, uh, I remember originally it took about 10 minutes in my early pen testing days, back when WEP became known as incredibly flawed and easy to crack.

And then I remember, I, I think the tool was Aircrack, somebody found a better way of doing it and got it down to, like, under 60 seconds.

So it was, if you had the tool to do it and if you had a laptop and you had the right network card, I think you needed a card you could put in promiscuous mode so you could collect those IVs.

It was trivial with a laptop and maybe $100 card and, and the right piece of open source software, you could hack any, pretty much any wireless network because there was nothing-

That was it

... to upgrade to, nothing to really patch.

Like, we had to replace the whole security part of the protocol.

Yeah, that's what we talked about last episode is WEP came around, you know, you know, around 2000, 1999.

2001 it was just wrecked.

Wi-Fi Alliance came into being and they said, "Hey, we've got to address this." Came out with WPA next, which came out around 2002, 2003.

From the last episode, you remember there's authentication requests and responses, and then there's association requests and response, and we talked about how usually we use open system authentication for those first messages now.

But for WEP, they actually put the challenge and response right there.

So right up front you're just like, "Hey, prove that you have the key." They pro- both prove that they have the key, and then they're like, "All right, let's use that key and we'll encrypt stuff." And they used what you, you mentioned, an IV, an initialization vector.

There's only, like, 16.7 million unique, uh, initialization vectors you use with that same key.

Now that sounds like a lot to you and me maybe, but for the computers, as you go through traffic, they start to get reused.

And when you reuse the same key for encryption, that's bad.

Not only one of the first Wi-Fi attacks, but one of the first breaches that led to US government and, uh, others in the industry saying, "Hey, maybe we should have some breach transparency.

Maybe you should be required to notify people of breaches." And back then attackers were focused on stealing payment data, stealing credit card numbers, selling those credit card numbers, or pulling as much cash as they could off them and laundering that money somehow.

And that put w- wireless security in the headlines in a big way.

With WEP, yeah.

Good old WEP.

So that was the first security standard back in the first releases.

Yeah, WEP.

So we don't use WEP anymore.

We don't talk about WEP, right?

It was, uh, I remember originally it took about 10 minutes in my early pen testing days, back when WEP became known as incredibly flawed and easy to crack.

And then I remember, I, I think the tool was Aircrack, somebody found a better way of doing it and got it down to, like, under 60 seconds.

So it was, if you had the tool to do it and if you had a laptop and you had the right network card, I think you needed a card you could put in promiscuous mode so you could collect those IVs.

It was trivial with a laptop and maybe $100 card and, and the right piece of open source software, you could hack any, pretty much any wireless network because there was nothing-

That was it

... to upgrade to, nothing to really patch.

Like, we had to replace the whole security part of the protocol.

Yeah, that's what we talked about last episode is WEP came around, you know, you know, around 2000, 1999.

2001 it was just wrecked.

Wi-Fi Alliance came into being and they said, "Hey, we've got to address this." Came out with WPA next, which came out around 2002, 2003.

From the last episode, you remember there's authentication requests and responses, and then there's association requests and response, and we talked about how usually we use open system authentication for those first messages now.

But for WEP, they actually put the challenge and response right there.

So right up front you're just like, "Hey, prove that you have the key." They pro- both prove that they have the key, and then they're like, "All right, let's use that key and we'll encrypt stuff." And they used what you, you mentioned, an IV, an initialization vector.

There's only, like, 16.7 million unique, uh, initialization vectors you use with that same key.

Now that sounds like a lot to you and me maybe, but for the computers, as you go through traffic, they start to get reused.

And when you reuse the same key for encryption, that's bad.