WEP

~ the last words ~

WEP was already a deprecated standard by the time most Turkish homes had a wireless network to protect. TTNet put an ADSL box in the corner of the living room somewhere in the middle of that decade, and the key was on a sticker glued to the underside, ten characters of hexadecimal that eventually half the building knew. Nobody was choosing WEP. It was simply what the firmware offered first, years after the people who wrote the standard had given up on it.

It arrived in the original IEEE 802.11 document in 1997 and was ratified as the Wi-Fi security standard on 17 September 1999. The name is the honest part. Wired Equivalent Privacy did not claim to be strong cryptography. It claimed to make radio about as inconvenient to eavesdrop on as a length of ethernet cable, which is a low bar and was understood at the time to be a low bar.

The trouble is that the bar was set by a physical property of copper and then met with a piece of math, and math does not care that the designers were being modest.

~ the record ~

~ the twenty-four bits ~

WEP used RC4, a stream cipher, which generates a keystream and exclusive-ors it against your data. Stream ciphers have one absolute rule: never use the same keystream twice. Do it once and an attacker who xors the two ciphertexts together has removed the cipher from the problem entirely.

Everyone on a WEP network shared one static key, so the only thing keeping keystreams distinct was a per-packet initialization vector prepended to it. That vector was 24 bits wide. Twenty-four bits is about sixteen million values, and on any real network you get a coin-flip chance of a repeat within roughly five thousand packets, which on a busy office link is minutes. The integrity check was CRC-32, which is linear, so an attacker could flip chosen bits in the ciphertext and correct the checksum without ever knowing the key.

~ how fast it went ~

In August 2001 Scott Fluhrer, Itsik Mantin and Adi Shamir published a paper on weaknesses in RC4's key schedule which turned the initialization vector problem from a theoretical worry into a passive attack: capture enough traffic and the key falls out, with no need to transmit anything. Tools implementing it were public within weeks.

After that it only got cheaper. The FBI gave a public demonstration in 2005, cracking a live WEP network in about three minutes using nothing but tools anyone could download, and a year later a team at UCL had the decryption running in real time on captured packets. By 2007 the Darmstadt attack of Tews, Pyshkin and Weinmann had a 104-bit key down to roughly forty thousand packets, which an attacker could provoke rather than sit and wait for. The Wi-Fi Alliance had already pushed WPA out in 2003 as an emergency patch that would run on existing hardware, and the IEEE finished the real replacement when 802.11i was ratified on 24 June 2004, formally deprecating both WEP-40 and WEP-104.

~ what it cost ~

The most expensive consequence was TJX, the parent company of TJ Maxx. Intruders got in through a WEP-protected wireless link at a store and stayed inside the corporate network long enough to take tens of millions of card records, disclosed in January 2007, two and a half years after the standard had been declared dead. The payments industry responded the way payments industries do: PCI DSS banned WEP on new installations from 31 March 2009 and outlawed it entirely after 30 June 2010.

That gap is the actual lesson of this grave. Deprecating a standard is a sentence in a document, and it does not reach into a warehouse full of already-manufactured routers, or into a firmware image the vendor stopped touching years earlier. WEP died in a working group six years before it stopped being the thing people were typing.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »