We published a story about the ethics of jacking open Wi-Fi connections way back in 2006, when a supposed ethics expert said it was ok: Jacking Wifi is ‘OK’ say Ethics Expert.

The main differentiation being that a router isn’t a computer and as long as the intruder doesn’t access any of the computers on the internal network – he’s within the law.

A Dutch court has ruled that hacking into Wi-Fi connections is not a crime providing any connected computers remain untouched. However Wi-Fi freeloaders would still lay themselves open to civil proceedings.

The unusual ruling came in the case of a student who threatened a shooting rampage against staff at students at Maerlant College in The Hague. The threat was posted on 4chan, the notoriously anarchic internet image board, after the student broke into a secure Wi-Fi connection. The unnamed student was caught and convicted of posting the message but acquitted on the hacking charge. The miscreant was sentenced to 120 hours of community service.

It seems like somehow 4chan was involved in this case and perhaps the Anonymous bunch too.

The interesting part for me is their definition of a computer and the part where the router falls down, they define it as a machine involved in the “storage, processing and transmission of data”. That sounds like a definition of a router to me, but for them – the router only stores the data in a transient matter as long as it needs to carry out its current task.

Reports are vague on how the student hacker was tracked down, but it may well be that the denizens of 4chan got the ball rolling by reporting the threats to police, something that happened in a similar school massacre threat case in Michigan back in February.

The Netherlands has a computer hacking law that dates from the early 1990s and defines a computer as a machine involved in the “storage, processing and transmission of data”. Since a router is not used to store data, a judge reasoned, it fails to qualify as a computer – and thus the computer hacking law isn’t applicable. The ruling, which surprised legal observers in The Netherlands, means that piggy-backing (or leeching) open wireless networks is not a crime: though civil proceedings against leechers would still be possible, so a free-for-all is unlikely.

Most countries have laws the apply to hacking into computer networks as well as computers but not, it would seem, The Netherlands. The Dutch attorney general has decided to appeal the verdict in the case, a process that may take several months.

Of course any wannabe Wi-Fi hackers in Holland are still open to civil proceedings from jacking connections, that’s if the person can show some negative effect to their livelihood or business.

And yah I also find it odd that the Dutch laws only cover computers and not networks or networking equipment. It means you’re pretty much open to hack anything you like as long as it’s not a computer (printers, telephones, faxes, routers, firewalls, proxies etc).

Source: The Register

While that sounds a little dramatic it wouldn’t surprise me if a lot still have no WEP key at all. And even if they have a WEP key with the tools available for WEP cracking now – it wouldn’t take that long to hammer it down – especially on a high traffic network.

From the study it seems that about 25% of networks are totally password free, I’m not sure how far they went though in terms of trying to connect. Perhaps a lot are public wifi spots that employ proxy services and require you to ‘login’, perhaps some are using MAC address white-listing.

Nearly half of all home Wi-Fi networks in the UK could be hacked within five seconds, according to CPP. The life assistance company employed the services of ethical hacker Jason Hart to roam six major cities across the UK and use specially developed software to identify home networks that were at risk of ‘Wi-Fi jacking’.

Wi-Fi jacking see hackers piggybacking on a net connection and allows them to illegally download files, purchase illegal goods or pornography or even sell on stolen goods, without being traced. It also allows them to view the private transactions made over the net, providing them with access to passwords and usernames that can subsequently be used to commit identity fraud. CPP’s research, which has been conducted ahead of National Identity Fraud Prevention Week, revealed 40,000 home Wi-Fi networks were at risk.

CPP also said that despite the fact 82 percent of web users believe their Wi-Fi connection is secure, nearly a quarter of private wireless networks are not password protected

It’s also interesting the amount of web users that use public or wifi-jacked networks without using encrypted connections. Grabbing login and password combos at a rate of 350 per hour is a LOT of passwords.

If they also recorded the associated services that could be a massive stash of credentials. It just goes to show if you do a little war-driving, what kind of goodies you can go home with.

Furthermore, nearly one in five (16 percent) of web users say they regularly use public networks. During his research, Hart was able to ‘harvest’ usernames and passwords from user of the public Wi-Fi networks at a rate of more than 350 an hour.

He also revealed more than 200 web users unsuspectingly logged onto a fake Wi-Di network over the course of an hour, during the experiment, putting themselves at risk from fraudsters who could harvest their personal and financial information.

“This report is a real eye-opener in highlighting how many of us have a cavalier attitude to Wi-Fi use, despite the very real dangers posed by unauthorised use,” said CPP’s identity fraud expert Michael Lynch.

“We urge all Wi-Fi users to remember that any information they volunteer through public networks can easily be visible to hackers. It’s vital they remain vigilant, ensure their networks are secure and regularly monitor their credit reports and bank statements for unsolicited activity.”

Hart warned both businesses and individuals to “think very carefully about network security and what information they provide when going online”.

As with most things this is not a technical issue, there are plenty of security options for home Wi-Fi setups, they are well documented and all new modems/routers come with filtering, white-listing and WEP/WPA encryption built in.

With a combination of these factors anyone can set up a secure WAP at home.

Oh well, it looks like things are going to change for a while.

Source: Network World

Features

• sorts targets by power (in dB); cracks closest access points first
• all WPA handshakes are backed up (to wifite.py’s working directory)
• mid-attack options: stop during attack with Ctrl+C to use (continue, move onto next target, skip to cracking, exit)
• numerous filters to specify exactly what to attack (wep/wpa/both, above certain signal strengths, channels, etc)
• very customizable settings (timeouts, packets/sec, etc)
• SKA support (untested)
• finds devices in monitor mode; if none are found, prompts for selection
• all passwords saved to log.txt
• switching WEP attacks does not reset IVS
• displays session summary at exit; shows any cracked keys

You can download wifite here:

wifite.py

Or read more here.

Well it looks like what happened to WEP all those years ago is going to happen to GSM now. The methods have been known, the theory is established but the breaking point is when freely available tools are published that makes it possible for anyone to perform the attacks even without really understanding what is going on.

The recent news about WPA2 being cracked generated a lot of discussion, mostly highly technical – which means that you don’t have to worry too much about WPA2 being insecure as the attack isn’t really viable and relies on the ‘attacker’ already being authenticated with the network. There are easily ways to do the same thing with good old ARP spoofing.

Independent researchers have made good on a promise to release a comprehensive set of tools needed to eavesdrop on cell phone calls that use the world’s most widely deployed mobile technology.

“The whole topic of GSM hacking now enters the script-kiddie stage, similar to Wi-Fi hacking a couple years ago, where people started cracking the neighbor’s Wi-Fi,” said Karsten Nohl, a cryptographer with the Security Research Labs in Berlin who helped spearhead the project. “Just as with Wi-Fi, where they changed the encryption to WPA, hopefully that will happen with GSM, too.”

The suite of applications now includes Kraken, software being released at the Black Hat security conference on Thursday that can deduce the secret key encrypting SMS messages and voice conversations in as little as 30 seconds. It was developed by Frank A. Stevenson, the same Norwegian programmer who almost a decade ago developed software that cracked the CSS encryption scheme protecting DVDs.

It seems that with this suite of tools and the right hardware kit it’ll be a LOT easier to snoop on GSM transmissions. This includes cracking the secret key for SMS messages as well as being able to listen to voice streams.

The rainbow tables required for the crack are rather large at 1.7TB but it allows the attack to be pulled off in a mere 30 seconds. And thankfully they are being offered freely rather than on a paid for basis. They are planning to push out a torrent for the files, which as long as people keep seeding it, will work well.

It has been designed to work seamlessly with 1.7TB worth of rainbow tables that are used to crack A5/1, a decades-old encryption algorithm used to protect cell phone communications using GSM, which is used by about 80 percent of the world’s mobile operators. A small confederation of researchers announced last year they were setting out to create the voluminous index, which exploits known weaknesses in the encryption formula.

Distributing the rainbow tables has proved to be a challenge to the project participants. Stevenson said people in Oslo, where he’s located, are welcome to exchange a blank hard disk for one that contains the data. Eventually, the group expects to make the tables available as a BitTorrent.

The GSM Alliance, which represents almost 800 operators in 219 countries, pooh poohed the universal snooping plan by characterizing the attack as theoretical and saying encryption wasn’t the only protection preventing eavesdropping on real-time communications.

That’s where another tool, called AirProbe, comes in. An updated version of the program, also to be distributed Thursday, works with USRP radios to record digital signals as they pass from an operator’s base station to a GSM handset. Combined with refinements in the open-source GNU radio, it works by pulling down voluminous amounts of data in real time as it travels to the targeted cell phone and storing only those packets that are needed to snoop on a call.

In all honestly I’m not really familiar with GSM protocols, encryption or their weaknesses as it’s not an area I’ve ever ventured into, so if any of you have any input on the above claims I’d be interested to hear it. Has this attack been possible for a while? Is it really a risk, or just another mostly theoretical attack depending on many factors to pull it off?

Either way it’s a pretty interesting story and I’ll be seeing where it goes.

Source: The Register

WEP fell long ago and there’s a myriad of WEP Cracking tools available. In 2008 it was reported flaws had been found in WPA and it was partially cracked.

These factors of course shifted a lot of people to WPA2, which has now been found to have certain flaws.

Perhaps it was only a matter of time. But wireless security researchers say they have uncovered a vulnerability in the WPA2 security protocol, which is the strongest form of Wi-Fi encryption and authentication currently standardized and available.

Malicious insiders can exploit the vulnerability, named “Hole 196″ by the researcher who discovered it at wireless security company AirTight Networks. The moniker refers to the page of the IEEE 802.11 Standard (Revision, 2007) on which the vulnerability is buried. Hole 196 lends itself to man-in-the-middle-style exploits, whereby an internal, authorized Wi-Fi user can decrypt, over the air, the private data of others, inject malicious traffic into the network and compromise other authorized devices using open source software, according to AirTight.

The researcher who discovered Hole 196, Md Sohail Ahmad, AirTight technology manager, intends to demonstrate it at two conferences taking place in Las Vegas next week: Black Hat Arsenal and DEF CON 18.

It’s a pretty interesting attack and leverages a man-in-the-middle style exploit to decrypt data from the wire and inject malicious packets onto the network.

The researched Md Sohail Ahmad is going to demo the exploit at 2 upcoming conferences (Black Hat and DEF CON 18) so I’ll be looking out for the slides and videos on that. We’ll have to wait and see if this is another ‘mostly theoretical‘ attack – or something that can actually be implemented in the wild.

The Advanced Encryption Standard (AES) derivative on which WPA2 is based has not been cracked and no brute force is required to exploit the vulnerability, Ahmad says. Rather, a stipulation in the standard that allows all clients to receive broadcast traffic from an access point (AP) using a common shared key creates the vulnerability when an authorized user uses the common key in reverse and sends spoofed packets encrypted using the shared group key.

Ahmad explains it this way:

WPA2 uses two types of keys: 1) Pairwise Transient Key (PTK), which is unique to each client, for protecting unicast traffic; and 2) Group Temporal Key (GTK) to protect broadcast data sent to multiple clients in a network. PTKs can detect address spoofing and data forgery. “GTKs do not have this property,” according to page 196 of the IEEE 802.11 standard.

These six words comprise the loophole, Ahmad says.

The upside is that the attack is limited to people who can genuinely authenticate to the network first, the downside that means large organizations using WPA2 in trouble – as generally most damage comes from the inside.

It’s also something to think about when connecting to ISP/public Wi-fi hotspots using WPA2 encryption.

I’m sure there will be more news about this soon.

Source: Network World (Thanks Austin)

Oh dear, poor Google seem to be catching all kinds of flak over their Wifi Data Collection.

The UK Met are already investigating them and they are being pulled to pieces in Germany too with France also weighing in. The latest to jump on the bandwagon is Australia which is stating they have breached the Australian Privacy Act.

It seems they might have dropped the ball big time with this one, although with the amount of money they have I doubt whatever legal restitution is served it won’t dent the coffers severely.

The Australian Privacy Commissioner has ruled that Google ran afoul of the country’s privacy laws when its Street View cars collected personal data from open Wi-Fi networks.

“On the information available I am satisfied that any collection of personal information would have breached the Australian Privacy Act,” said Privacy Commission Karen Curtis in a statement.
Click here to find out more!

“Collecting personal information in these circumstances is a very serious matter. Australians should reasonably expect that private communications remain private.”

Under the Privacy Act, Curtis is unable to sanction a company when she initiates an investigation. But she ruled that Google must publicly apologize, conduct “privacy impact assessments” of any new Street View data collection in Australia that includes personal information, and regularly consult with her about “personal data collection activities arising from significant product launches” in Australia.

Google has already apologised on their Google Australia blog here, which is a step in the right direction. They stated:

We want to reiterate to Australians that this was a mistake for which we are sincerely sorry. Maintaining people’s trust is crucial to everything we do and we have to earn that trust every single day. We are acutely aware that we failed badly here.

Google themselves have stated they’ve collected this data in 30 different countries, so it’ll be interesting to see how many similar cases pop up.

The Australian Federal Police have launched a separate investigation into Google’s Wi-Fi data collection. And since this and other investigations may still be ongoing, Curtis said she would not comment in more detail.

In May, with a blog post, Google said that its world-roving Street View cars had been collecting payload data from unencrypted Wi-Fi network, contradicting previous assurances by the company. The post said that the data was collected by “mistake” and that the data has not been used in any Google products, and the company grounded its Street View fleet.

A month before, in response to a complaint from the German privacy commissioner, a Google blog post said that in scanning Wi-Fi networks its Street View cars were collecting only the SSIDs that identify the networks and MAC addresses that identify particular network hardware, including routers. Google uses this data in products that rely on location data, such as Google Maps.

Google has said it collected payload data in 30 separate countries, and though investigations are still underway in many, the company announced on Friday that after speaking to regulators, it is sending its Street View Cars back on the road in Ireland, Norway, South Africa, and Sweden. This cars will resume their 360 degree picture taking next week, but they will no longer collect any Wi-Fi information.

The Street View cars will be hitting the street again and collecting data (but no-more Wi-fi info). Personally I’d love the maps to contain Wi-fi data, free/open connections nearby your current location would be a great help for the urban warrior.

Best to rely on the old 3G or Wimax dongle then I guess.

Source: The Register

What’s Unique about inSSIDer?

• Use Windows Vista and Windows XP 64-bit.
• Uses the Native Wi-Fi API.
• Group by Mac Address, SSID, Channel, RSSI and “Time Last Seen.”
• Compatible with most GPS devices (NMEA v2.3 and higher).

How can inSSIDer help me?

• Inspect your WLAN and surrounding networks to troubleshoot competing access points.
• Track the strength of received signal in dBm over time.
• Filter access points in an easy to use format.
• Highlight access points for areas with high Wi-Fi concentration.
• Export Wi-Fi and GPS data to a KML file to view in Google Earth

InSSIDer is licensed under the Apache License, Version 2.0. The source code is freely available from the public Subversion repository at http://www.metageek.net/svn/trunk.

You can download inSSIDer here:

Inssider_Installer.msi

Or read more here.

It may clear things up for some people who get overwhelmed by all the jargon, especially with the recent news hitting the mainstream about WPA being partially cracked.

Users have every right to be perplexed by wireless security standards. Faced by an alphabet soup of AES, RADIUS, WEP, WPA, TKIP, EAP, LEAP and 802.1x, many users don’t secure their wireless networks at all. Now that earlier wireless security standards such as Wi-Fi Protected Access and Wired Equivalent Privacy are being cracked, it’s time to examine what all the terms mean and think about changes.

Just about a month ago, in early November, the news came out that the first cracks were appearing in WPA, or Wi-Fi Protected Access, a very popular wireless security standard. The compromise that was accomplished by some researchers was not a real killer, but the affected version of WPA (and the associated encryption process, TKIP, or Temporal Key Integrity Protocol), was always meant as a stopgap standard.

So here you go, the acronyms, hope it’s useful to someone :)

• WEP (Wired Equivalent Privacy)—The old, original, now discredited wireless security standard. Easily cracked.
• WEP 40/128-bit key, WEP 128-bit Passphrase—See WEP. The user key for WEP is generally either 40- or 128-bit, and generally has to be supplied as a hexadecimal string.
• WPA, WPA1—Wi-Fi Protected Access. The initial version of WPA, sometimes called WPA1, is essentially a brand name for TKIP. TKIP was chosen as an interim standard because it could be implemented on WEP hardware with just a firmware upgrade.
• WPA2—The trade name for an implementation of the 802.11i standard, including AES and CCMP.
• TKIP—Temporal Key Integrity Protocol. The replacement encryption system for WEP. Several features were added to make keys more secure than they were under WEP.
• AES—Advanced Encryption Standard. This is now the preferred encryption method, replacing the old TKIP. AES is implemented in WPA2/802.11i.
• Dynamic WEP (802.1x)—When the WEP key/passphrase is entered by a key management service. WEP as such did not support dynamic keys until the advent of TKIP and CCMP.
• EAP—Extensible Authentication Protocol. A standard authentication framework. EAP supplies common functions and a negotiation mechanism, but not a specific authentication method. Currently there are about 40 different methods implemented for EAP. See WPA Enterprise.
• 802.1x, IEEE8021X—The IEEE family of standards for authentication on networks. In this context, the term is hopelessly ambiguous.
• LEAP, 802.1x EAP (Cisco LEAP)—(Lightweight Extensible Authentication Protocol) A proprietary method of wireless LAN authentication developed by Cisco Systems. Supports dynamic WEP, RADIUS and frequent reauthentication.
• WPA-PSK, WPA-Preshared Key—Use of a shared key, meaning one manually set and manually managed. Does not scale with a large network either for manageability or security, but needs no external key management system.
• RADIUS—Remote Authentication Dial In User Service. A very old protocol for centralizing authentication and authorization management. The RADIUS server acts as a remote service for these functions.
• WPA Enterprise, WPA2 Enterprise—A trade name for a set of EAP types. Products certified as WPA Enterprise or WPA2 Enterprise will interoperate (EAP-TLS, EAP-TTLS/MSCHAPv2, PEAPv0/EAP-MSCHAPv2, PEAPv1/EAP-GTC & EAP-SIM)
• WPA-Personal, WPA2-Personal—See Pre-Shared Key.
• WPA2-Mixed—Support for both WPA1 and WPA2 on the same access point.
• 802.11i—An IEEE standard specifying security mechanisms for 802.11 networks. 802.11i uses AES and includes improvements in key management, user authentication through 802.1X and data integrity of headers.
• CCMP—Counter Mode with Cipher Block Chaining Message Authentication Code Protocol. An encryption protocol that uses AES.

Enjoy!

Source: eWeek

Well WEP came down long ago, it was only a matter of time before the standard that succeeded it fell too – WPA. The big news last week was that WPA has been cracked finally, it’ll be discussed this week at the PacSec Conference.

After the insecurity of WEP was exposed the majority of routers and Wi-Fi devices default to WPA, so this may be a serious and widespread security issue. Especially as though the initial method and information is public, more refined and efficient cracking methods will come to light – of course we shall report on any WPA cracking tools that we come across.

Security researchers say they’ve developed a way to partially crack the Wi-Fi Protected Access (WPA) encryption standard used to protect data on many wireless networks.

The attack, described as the first practical attack on WPA, will be discussed at the PacSec conference in Tokyo next week. There, researcher Erik Tews will show how he was able to crack WPA encryption and read data being sent from a router to a laptop computer. The attack could also be used to send bogus information to a client connected to the router.

To do this, Tews and his co-researcher Martin Beck found a way to break the Temporal Key Integrity Protocol (TKIP) key, used by WPA, in a relatively short amount of time: 12 to 15 minutes, according to Dragos Ruiu, the PacSec conference’s organizer.

It’s a pretty fast attack on the TKIP, WEP cracking requires a relatively large amount of traffic to get hold of enough weak IVs to crack the WEP key.

If you can break WPA in 12-15 minutes, that’s impressive! It’s not a full key cracking method though, it only yields a temporary key and doesn’t give you full access to everything.

They have not, however, managed to crack the encryption keys used to secure data that goes from the PC to the router in this particular attack

Security experts had known that TKIP could be cracked using what’s known as a dictionary attack. Using massive computational resources, the attacker essentially cracks the encryption by making an extremely large number of educated guesses as to what key is being used to secure the wireless data.

The work of Tews and Beck does not involve a dictionary attack, however.

To pull off their trick, the researchers first discovered a way to trick a WPA router into sending them large amounts of data. This makes cracking the key easier, but this technique is also combined with a “mathematical breakthrough,” that lets them crack WPA much more quickly than any previous attempt, Ruiu said.

From what I understand it allows the attacked to basically hijack the ARP communications on the network, not the full data available.

So it could open up a router or edge device using WPA to be hijacked with ARP spoofing for some man-in-the-middle kind of attack.

Apparently an experimental implementation of the researchers’ attack has been introduced into a development version of the aircrack-ng tool.

Source: Computer World

Another one from the old school, this tool has been around forever since way before wardriving was fashionable and when people still used pringles cans for antenna boosting.

It’s a favourite amongst Windows users, although it can’t do any real hacking (like breaking a WEP key) – it’s extremely fast and effecient in the detection of open WAPs.

What is NetStumbler?

NetStumbler is a tool for Windows that allows you to detect Wireless Local Area Networks (WLANs) using 802.11b, 802.11a and 802.11g. It has many uses:

• Verify that your network is set up the way you intended.
• Find locations with poor coverage in your WLAN.
• Detect other networks that may be causing interference on your network.
• Detect unauthorized “rogue” access points in your workplace.
• Help aim directional antennas for long-haul WLAN links.
• Use it recreationally for WarDriving.

General Requirements

The requirements for NetStumbler are somewhat complex and depend on hardware, firmware versions, driver versions and operating system. The best way to see if it works on your system is to try it.

Some configurations have been extensively tested and are known to work. These are detailed at http://www.stumbler.net/compat. If your configuration works but is not listed, or is listed but does not work, please follow the instructions on the web site.

The following are rules of thumb that you can follow in case you cannot reach the web site for some reason.

• This version of NetStumbler requires Windows 2000, Windows XP, or better.
• The Proxim models 8410-WD and 8420-WD are known to work. The 8410-WD has also been sold as the Dell TrueMobile 1150, Compaq WL110, Avaya Wireless 802.11b PC Card, and others.
• Most cards based on the Intersil Prism/Prism2 chip set also work.
• Most 802.11b, 802.11a and 802.11g wireless LAN adapters should work on Windows XP. Some may work on Windows 2000 too. Many of them report inaccurate Signal strength, and if using the “NDIS 5.1″ card access method then Noise level will not be reported. This includes cards based on Atheros, Atmel, Broadcom, Cisco and Centrino chip sets.
• I cannot help you figure out what chip set is in any given card.

Firmware Requirements

If you have an old WaveLAN/IEEE card then please note that the WaveLAN firmware (version 4.X and below) does not work with NetStumbler. If your card has this version, you are advised to upgrade to the latest version available from Proxim’s web site. This will also ensure compatibility with the 802.11b standard.

You can download NetStumbler 0.4.0 here:

NetStumblerInstaller_0_4_0.exe

Or read more here (tutorial here).