Rest in pieces, WEP: Retire your WEP based WLAN equipment today

I’ve always had this uneasy feeling about WEP secured wireless networks, so when I moved to my current apartment a year ago I purchased WPA enabled devices. Unfortunately this means I cannot use and will not buy a number of nice devices (such as digital cameras with WLAN) secured only by WEP. A lot of equipment still does not do WPA, or perfoms sluggish when using WPA. All those devices should no longer be used. Changing my home network to WPA was sort of painful, but it paid off. 

Because it finally happened: WEP is dead. A paper recently published by Andreas Bittau, Mark Henley (both researching at the University College of London) and Joshua Lackey (Microsoft) describes a new, devastating attack. (Download their research paper here: ) The new attack relies on packet fragmentation and use of the known 8-byte LLC/SNAP headers to speed up decryption.

Basically it is so efficient it renders WEP useless. Totally useless.

The method described in the paper breaks WEP in seconds. That said, mechanisms like EAP, changing WEP keys every few minutes, are useless as well. To proof their point, the paper refers to a tool called “wesside”. The paper claims it can break many WEP networks in seconds. (For the curious: The tool is written for FreeBSD, and relies on low level functions of the Atheros WLAN card. Source is provided here: Rest assured that someone has ported this to other platforms and alternate hardware by now.

To illustrate the gravity of the situation: according to the paper, typically around 76% of WLANs in the London Area are secured by WEP, in the Seattle Area an estimated number of 85% is given. Only 20% (London)/14%(Seattle) of WLANs use WPA, practically no one uses 802.11i

The consequence: Switch from WEP to WPA or 802.11i. Retire all your WEP-only equipment today. Methods relying on frequent change of WEP keys will no longer save you.

Comments (11)

  1. RogerH says:

    Good post, thanks for the tip. I read about WEP being compromised but not this easily!

  2. BlakeHandler says:

    Here’s a nice step-by-step on how to crack WEP

  3. billyboylindien says:

    Does it really differe from the Devine’s methodewho is describ in this tutorial:

  4. alexholy says:

    yes it is different. the video is not in realtime, and he captures huge amount of traffic. the method described in the paper requires just one packet of data, and the time to break the key (even a strong one) is an order of magnitude smaller.

  5. Comme aiment  le faire nos amis anglophones, je vais commencer directement par la conclusion. Cette attaque est une mthode permettant de dclencher une gnration de trafic par un rseau protg par WEP. Point  la ligne. Son utilisation pour casser…

  6. Bonjour tout le monde,On le savait depuis des années, des articles complets mettaient en alerte les DSI…

  7. samples free cute myspace layouts lt font