Reports that researchers have successfully hacked wireless networks secured by Wi-Fi Protected Access (WPA) should not alarm corporate users, provided they’re using Advanced Encryption Standard (AES) on WPA2, wireless experts say.
“It’s not a network security threat,” said Geoffrey Smith, vice-president for products and marketing at Proxim Wireless Corp. of Milpitas, Calif. “The majority of networks should have already upgraded to WPA2 which supports the 128-bit AES algorithm.”
Mark Tauschek, senior analyst with London, Ont.-based Info-Tech Research Group, agreed.
“Chances are the hardware enterprises have today will support WPA2,” Tauschek said. “If you go that way I don’t think there’s anything to worry about in the short term.”
Smith and Tauschek were commenting on reports that Erik Tews and Martin Beck found a way to break the Temporal Key Integrity Protocol (TKIP) key in WPA, in 12 to 15 minutes. The researchers are scheduled to demonstrate their hacking method at the PacSec conference in Tokyo.
WPA2, released five years ago, is another name for the 802.11i security standard, designed to protect wireless networks using the Institute of Electrical and Electronics Engineers (IEEE) 802.11 standards.
Before 2003, the main security method was wired equivalent privacy (WEP), which became notorious for the speed with which hackers could defeat it. So in 2003, the Wi-Fi Alliance announced WPA, which used some, but not all, elements of 802.11i, which was still in the works at the time.
WPA did not include AES encryption but did use dynamic key allocation, Extensible Authentication Protocol (EAP) and TKIP.
Tews and Beck did not use a “dictionary attack,” or essentially making an extremely large number of educated guesses as to what key is being used to secure the wireless data
Instead, they first discovered a way to trick a WPA router into sending them large amounts of data. This makes cracking TKIP easier, but this technique is also combined with a “mathematical breakthrough,” that lets them crack WPA much more quickly than any previous attempt, said Dragos Ruiu, Organizer of PacSec.
But Tauschek emphasized TKIP is only one part of wireless security.
“It’s sort of getting blown out of proportion,” he said. “TKIP was a stopgap measure that has been compromised going one way. It’s still an issue and enterprises or anybody for that matter should move to AES given that breach but let’s not blow it too far out of proportion. There’s sort of some fear mongering going on there.”
Smith noted WPA2 has been in place for five years, and this is what corporate IT managers should be using for their wireless networks.
“What these guys are doing I really see as pass
