Once thought safe, the WPA standard used by countless wireless routers has been revealed to be vulnerable- but only in theory, for now.
Security researchers say they’ve developed a way to partially crack the Wi-Fi Protected Access (WPA) encryption standard that is used to safeguard data on many wireless networks.
Researcher Erik Tews was to demonstrate the attack at the PacSec conference in Tokyo in mid-November. Cracking WPA encryption could be exploited to read data being sent from a router to a laptop, or to send bogus information to a client connected to the router.
Tews and coresearcher Martin Beck found a way to break the Temporal Key Integrity Protocol (TKIP) key, which WPA uses, in a relatively short 12 to 15 minutes, says Dragos Ruiu, the PacSec conference’s organizer.
In this particular attack, however, they have not managed to crack the encryption keys used to secure data sent from the PC to the router.
WPA, widely used on today’s Wi-Fi networks, is considered superior to the original WEP (Wired Equivalent Privacy) standard, which most security professionals now deem insecure. Retail store chain T.J. Maxx was in the process of upgrading from WEP to WPA encryption when it experienced one of the most widely publicized data breaches in United States history, in which hundreds of millions of credit card numbers were stolen over a two-year period. The new WPA2 standard is considered safe from the recently developed attack.
“Everybody has been saying, ‘Go to WPA because WEP is broken,’” Ruiu says. “This is a break in WPA.”
If WPA is significantly compromised, it would be a blow for business customers who have been increasingly adopting it, says Sri Sundaralingam, vice president of product management with wireless network security vendor AirTight Networks. Although customers can use other Wi-Fi technology such as WP A2 or virtual private network software that will protect them from this attack, many devices will still connect to the network via WPA, or even by way of the thoroughly cracked WEP standard, he says.
Click for more details:
Tags: WPA
