WiFi is no longer a viable secure connection

http://www.scmagazineuk.com/WiFi-is-no-longer-a-viable-secure-connection/article/119294/

by prakash • 18 years ago

34 19 18 years ago

cbrinker• 18 years ago

Since when were we under the impression it ever was?

I sure as hell know that I don't trust wireless; wired is bad enough. Tack on an open-ended medium to invite all of the fun guys onboard.

DenisM• 18 years ago

Elcomsoft is the same place where Dmitry Sclyarov worked when Adobe tried to put him in jail for breaking PDF "encryption": http://www.freesklyarov.org/

jkkramer• 18 years ago

Sounds like they only increased the speed of brute force attacks. Use a strong password and you'll be fine.

EDIT: That said, at least for me, the main reason I need wireless encryption is to prevent neighbors from using it. It would be silly to rely on wireless encryption to safeguard sensitive network activity. That's what SSH, SSL, etc. are for.

wallflower• 18 years ago

From their flowerly press release: "With billions of possible combinations, it can take years to break into a WPA/WPA2 protected network. However, WPA/WPA2 protected networks are not immune against distributed attacks performed with GPU-accelerated algorithms. With the latest version of Elcomsoft Distributed Password Recovery, it is now possible to crack WPA and WPA2 protection on Wi-Fi networks up to 100 times quicker with the use of massively parallel computational power of the newest NVIDIA chips."

Now if only I could somehow get Eclipse to use my GPU to do a compile

maximilian• 18 years ago

Your GPU would be slow as shit at compiling. You wouldn't want it to compile anything.

GPUs are only good at doing lots of arithmetic in parallel.

tptacek4• 18 years ago

This is stupid for two reasons:

(1) They're cracking pre-shared keys, which is the least secure mode of deployment for WPA2; they can "crack" it because it's essentially password-protected. Modern wireless security use crypto-strong keys derived from secure authentication. That's not how home wireless networks get deployed, but it is how corporate wireless networks are set up.

(2) Nobody who cares about security relies on WEP or WPA; they use 802.11 to set up an insecure last-mile to VPN through. Nobody has broken any popular VPN protocol in the last 5 years.

newt0311• 18 years ago

Seconded. Thats what I use for my house. In fact, I just disable security on my wifi network and use a QoS setup to discriminate between traffic.

eru• 18 years ago

Why were those new protocols (WEP and WPA) developed anyway? "We need new encryption schemes, because it's wireless!"?

baddox• 18 years ago

That's what the Wi-Fi Alliance does, they make new protocols. But truly, no ubiquitous wireless protocol should be trusted for any private data. Those protocols are (or should be) only meant for home users.

tptacek4• 18 years ago

Because no operating system secures IP by default, so without something in place, wireless is devastatingly insecure.

The first round of wireless security protocols were a hack, a veneer of security designed to give the perception that 802.11 was "at least as secure" as your office Ethernet, which you'd want to secure with SSL or IPSEC anyways. That strategy failed.

The most recent round of protocols is every bit as sophisticated as IPSEC. It's no longer the design goal to provide something that's "good enough" for normal stuff, and to run VPN over for everything else.

There's a lot of moving parts in WPA2-Enterprise/EAP, and I don't love it. But it's no longer a silly strategy.

wmf• 18 years ago

I'm not aware of any standards for Ethernet crypto before WEP, so I don't know what they would have borrowed. Something from DOCSIS maybe. Heck, the IEEE didn't even come up with MACsec until recently.

michaelneale2• 18 years ago

Its only meant to be kinda close to wired equivalence - if someone really wants to snoop, there are ways to do it with wired as well (even without physically breaking in to the cable).

So yes, you security has to come from other layers (VPN, SSL for web etc).

tptacek4• 18 years ago

WPA2 with EAP is end-to-end crypto strong; there's no funky password derivation function to brute-force, the packets are AES keyed randomly after a (most likely) TLS key exchange. I'm not saying I'd choose it --- too many moving parts --- but you can make the argument that modern wireless security is more secure than wired networks.

3KWA• 18 years ago

it never was anyway

rbanffy• 18 years ago

Well...

I have been using VPNs for years. It's sweet to connect to insecure, possibly malware-intensive, password-grabbing "free" wireless spots that abound around hotels and airports and grab all their bandwidth while everything they get is highly secure cryptographed data.

I say that if they ever get my data, they should at least deserve it.

njharman• 18 years ago

ssl & ssh

What's the problem?

dcurtis• 18 years ago

Does anyone have any hard data on the prevalence of random WiFi hacking? I think the chances of someone trying a GPU-accelerated bruteforce attack on my home network is ridiculously low.

WiFi is no longer a viable secure connection

Related Stories