Comments on: WPA is the new WEP, and by that we mean useless

By: Francis

Francis — Fri, 07 Nov 2008 16:16:04 +0000

Someone mis-interpreted a press release. Its still secure. They basically said its now 100% quicker to brute force WPA. So from a million years its now half a million years to brute force.

By: Bob DeSilets

Bob DeSilets — Fri, 07 Nov 2008 15:16:45 +0000

So, ok, you can get data from the stream. But I still haven’t seen anything that indicates that the encryption keys have been compromised.

By: Bill Taroli

Bill Taroli — Fri, 07 Nov 2008 00:00:13 +0000

Well, most enterprise shops I know of have thrown in the towel on bothering to secure WiFi. Instead, they leave the WiFi *open* and firewall the entire subnet the AP’s are on. Then you must use normal VPN solutions to access the interior network. So it’s privately operated, but you can’t reach anything useful from it directly. And you don’t have the overhead of the encryption on the air. Yeah, you need to use VPN, but at least THAT hasn’t been hacked.

By: Galvatron

Galvatron — Thu, 06 Nov 2008 22:08:25 +0000

oh man i know a who lrestraunt bize that ues wpa2 and 3 lol there so fubard an yeah wpa is still cracakbe an hasbeen for a whike theres a utube video on how to do it

By: Andrew

Andrew — Thu, 06 Nov 2008 21:50:16 +0000

Correction – perfect for keeping your neighborhood CEO off your network. You’ve probably already been owned by your neighbor’s 12-year-old daughter.

By: Chris

Chris — Thu, 06 Nov 2008 21:36:02 +0000

Wiring the entire house was never a bad idea to begin with. Sure it can be a pain in some cases but it’s pretty much better in every scenario that doesn’t include shopping online while in the bathroom.

By: Interphero

Interphero — Thu, 06 Nov 2008 20:45:43 +0000

Of course this had to happen shortly after I was telling someone to use WPA or WPA2 because WEP is useless. Does anyone know whether the method that “tricks the router into sending him a large amount of data” is also applicable to WPA2? If so, is AES in WPA2 the only thing preventing this attack from working on WPA2?

By: argonnj

argonnj — Thu, 06 Nov 2008 19:33:30 +0000

Wiring the entire house with ethernet doesn’t sound like a bad idea anymore.

By: Derek

Derek — Thu, 06 Nov 2008 18:13:09 +0000

I have yet to find a router or computer that can’t handle WPA2 AES, so I don’t really see what the big deal is.

By: Ilias

Ilias — Thu, 06 Nov 2008 18:12:59 +0000

This is an attention-grabbing claim (yet to be proven) on a protocol as of 3-4 years ago. If you want to feel secured you use WPA2. You would not shop online using 56bit DES SSL connection today, but you would 10 years ago. WPA2 is the one meant to be secure and the real headline will be to break that one.

(repost to correct a typo…)

By: Ilias

Ilias — Thu, 06 Nov 2008 18:11:41 +0000

This is an attention-grabbing claim (yet to be proven) on a protocol as of 3-4 years ago. If you want to feel secured you use WPA2. You would not shop online using 56bit DES SSL connection today, but you would 20 years ago. WPA2 is the one meant to be secure and the real headline will be to break that one.

By: common sense says

common sense says — Thu, 06 Nov 2008 18:05:51 +0000

there is a huge problem with that line of thinking. after the proof of concepts are written and demonstrated, it takes only a matter of days, perhaps weeks, until someone writes a tool the automate the entire process. at this point, it really does become a trivial effort for anyone–not just security experts–to compromise your data.

By: Sam

Sam — Thu, 06 Nov 2008 16:40:49 +0000

Now, now, do the boys at TheBoxOTruth know you’re using their images? (That was my favorite article of theirs)

By: Dtest54

Dtest54 — Thu, 06 Nov 2008 16:38:56 +0000

no big deal for most users, not that many hackers out to hack my personal wifi.

for larger users it could be a problem. also a way for IT guys to stay employed now.

By: TimaPhillips

TimaPhillips — Thu, 06 Nov 2008 16:37:16 +0000

Doubtful anyone other than a dedicated hacker would bother with this.

By: leetgnnr

leetgnnr — Thu, 06 Nov 2008 16:33:56 +0000

What about WPA with radius authenetication?

By: Ian

Ian — Thu, 06 Nov 2008 16:28:12 +0000

MAC filtering is pretty much useless too, as most tools will report client MAC addresses fairly easily. Then it’s just a matter of spoofing the MAC and voila, circumvented.

By: ryaninc

ryaninc — Thu, 06 Nov 2008 16:23:52 +0000

This is why I use MAC address filtering on my network. Makes it a pain to add a new device, but it’s great security.