"Your 802.11 Wireless Network has No Clothes", "Arbaugh, Shankar, Wan", University of Maryland, March 2001.
"Intercepting Mobile Communications: The Insecurity of 802.11", Nikita Borisov, Ian Goldberg, and David Wagner, University California Berkeley,
http://www.idg.net/ic_814394_5056_1-2792.html
802.11 does not have a complete security standard, in that it leaves many of the harder issues (e.g. key management) undefined. It has also been found to be lacking in what it does standardize.
Weaknesses in the design of 802.11 security mechanisms exist regardless of whether encryption is used (and independent of the strength of encryption) on the network.
Problems in 802.11 security are attributed mostly to weaknesses in how the system was implemented, and not directly to the cryptographic strength of the algorithms. Public review of the approach presumably would have shown these problems before they became embedded in silicon.
Clients start in an unassociated and unauthenticated state.
Each BSS has a unique SSID (service set identifier).
Access points transmit beacon management frames periodically. Beacon frames contain the SSID associated with the AP. Clients listen for beacon frames to identify which access points are within their range. Clients may also send probe frames to find APs associated with a particular SSID.
Once a client selects an AP, the client and the AP exchange management frames to move to an authenticated state.
After authentication, the client and AP exchange some more frames to reach the authenticated and associated state.
If this first round of authentication is successful, the client and AP switch roles and reverse the process, thus insuring mutual authentication.
Lucent uses a proprietary scheme whereby the SSID acts as the shared key. If the client knows the SSID, it knows the secret, and can authenticate to the network.
Some vendors use an access control list in the APs. The APs maintain a list of MAC addresses which are authorized to use them. Clients whose MAC address are not on the list are denied association.
In some cases vendors claim to provide key management, but do so in a weak fashion. In other cases vendors won't divulge details of their key management, making security assessment impossible.
Since there is no standard, and since key management is difficult, the majority of networks have long key periods, meaning that keys are seldom changed. This results in insecurities in that once a key is compromised in some other fashion, illegal access to a network continues for a potentially long time.
An attacker can sniff the random challenge from an AP (in the clear), and the encrypted response from a client. The initialization vector is sent in the clear as part of even WEP encrypted frames. With these three known, and the fact that all fields in the management frame except the random challenge are the same for all frames in an authentication sequence, the attacker can create the frames required to authenticate with an AP without knowing the shared key.
If WEP is being used then the attacker can't communicate on the network unless the shared key is known. WEP attacks can provide this.
Problems with WEP were first published in late fall of 2000. Nikita Borisov, Ian Goldberg, and David Wagner at UCB.
WEP encrypts data with the shared secret key plus an initialization vector. Each packet includes an integrity check to detect packets that have been altered.
The encryption protocol is RC4. RC4 takes a small key and expands it into an infinite pseudo-random key stream. This keystream is then XORd with the plaintext.
The space of the IV's is small (24) bits. At 11 Mbps and 1500 byte frames, the entire space is exhausted (and hence must be reused) in about 5 hours. Small frames makes this even faster.
Some 802.11 cards (Lucent for example) reset the IV to 0 at initialization and increment it by 1 for each packet sent. This means that two laptops which are booted at roughly same time will be sending packets with a high probability of using the same IV.
Collecting a database of packets which cover the entire IV space allows you to decrypt any packet. Such a database would be about 15 Gbytes and take only a few hours to collect on a busy network.
Depending on how IVs are generated (little or big endian rolling counters), the number of packets required to discover the complete key by knowing the first byte is 1-4 million.
At 2500 packets per second (11 M bps, 500 byte packets) collecting 1,000,000 packets only requires 400 seconds.
In this attack, the cost of the attack goes linearly with the length of the key, so longer keys don't help that much.
Some criticism has already arisen that 802.1x has flaws. In February 2002, Mishra and Arbaugh found 802.1x was susceptible to man-in-the-middle and session highjacking attacks.
Dubbed "session hijacking" and "man-in-the-middle," both attacks basically exploit inherent problems in Wi-Fi as well as exploiting how the new 802.1x standard is designed.
"Here's how session hijacking works. The hacker waits for someone to finish successfully the authentication process. Then you as the attacker send a disassociate message, forging it to make it look like it came from the AP [access point]. The client [user] thinks they have been kicked off, but the AP thinks the client is still out there. As long as WEP is not involved you can start using that connection up until the next time out, usually about 60 minutes," said Arbaugh.
A session hijacking can occur because of the so-called race conditions between the 802.1x and 802.11 state machines. Arbaugh uses the analogy of a thief and a store owner racing for the front door at the same time. If the owner gets there first he locks the thief out, if the thief gets there first he steals everything. Because the client and the AP aren't synchronized, "loose consistency," the thief can tell the owner/client to go away and the AP still thinks he is there. "The robber gets there first," said Arbaugh.
The second form of attack is called man-in-the-middle, and while Brian Grimm, a spokesman for WECA [Wireless Ethernet Compatibility Alliance] said that the Wi-Fi association was aware of the problem and that it had already been fixed, Arbaugh said he had not heard from WECA but that he "would be shocked if they solved the problem." The man-in-the-middle attack works because 802.1x uses only one-way authentication. In this case, the attacker acts as an AP to the user and as a user to the AP.
"The trust assumption that is reflected from this design is that the access points are trusted entities, which is a misjudgement. The entire framework is rendered insecure if the higher-layer protocol also performs a one-way authentication," according to the Arbaugh, Mishra paper.
Temporal Key Integrity Protocol (TKIP)