Download - Academy Publisher

ISBN 978-952-5726-09-1 (Print)
Proceedings of the Second International Symposium on Networking and Network Security (ISNNS ’10)
Jinggangshan, P. R. China, 2-4, April. 2010, pp. 039-042
Security Research on WEP of WLAN
Peisong Ye 1 , and Guangxue Yue 2
1
College of Mathematics and Information engineering, JiaXing University, ZheJiang JiaXing, China
Email: yepeisong@sina.com
2
College of Mathematics and Information engineering, JiaXing University, ZheJiang JiaXing, China
Email: guangxueyue@163.com
Abstract—Wires Equivalent Privacy (WEP) is used to
improve the security of wireless LAN (WLAN). By
analyzing the weaknesses of WEP and RC4, we design a
simulative platform including software and hardware to
crack WEP keys. The results show that the WLAN based
on WEP is insecure. At last we give some improvements to
enhance the WLAN security.
Index Terms—WLAN, Security, 802.11, WEP, RC4
I. INTRODUCTION
Because of the convenience of Wireless LAN
(WLAN), it develops quickly. But the security of the
WLAN becomes more important at the same time.
Compared to wire LAN hacker can break into WLAN
more easily because wireless data with electromagnetic
wave are transmitted on air. Although WLAN 802.11b
protocol provides some security mechanisms, they have
some weaknesses and hacker can attack WLAN easily by
making use of these weaknesses.
In section II we briefly introduce some basic concepts,
system structure, some basic security knowledge of
WLAN and some methods of attacking WLAN used by
hackers. The security mechanism of WLAN 802.11b
protocol includes: Service Set Identifier Association
(SSID Association), MAC filtering and Wired
Equivalent Privacy (WEP). Attacking methods include:
SSID spoofing, MAC spoofing and authentication
spoofing of WEP. In section Ⅲ we analyze the
weaknesses of WEP and RC4 algorithm. In section Ⅳ
we crack the WEP key by making use of the weakness of
WEP. And we also design a scenario of cracking WEP
key by using this weakness. In section Ⅴ we introduce
some methods of WLAN security enhancement. These
methods including: WEP improvement, Message
Integrity Check and 802.1X/EAP.
II. THE SUMMARIZATION OF WLAN SECURITY
A. Basic Concepts of WLAN
WLAN is the outcome of combining computer net and
wireless communication. WLAN expands the wired
LAN. The mobility of connection is the most merit of
WLAN, and it also overcomes the restriction of wires.
Users can acquire information anywhere at any moment
in the WLAN environment.
The range of WLAN is about 10 to 100 meters. It
typically uses Spread Spectrum modulation technologies.
© 2010 ACADEMY PUBLISHER
AP-PROC-CS-10CN006
39
There are two forms of SS (Spread Spectrum) schemes:
FHSS (Frequency Hopping Spread Spectrum) and DSSS
(Direct Sequence Spread Spectrum).
There are two types of WLAN: infrastructure network
and Ad-hoc network. Infrastructure network needs an AP
(Access Point), which is used as a bridge between clients
and wired LAN. Ad-hoc network is comprised of some
coordinative clients, which communicate with each
other. We will discuss infrastructure network in this
paper.
IEEE 802.11[1] is WLAN’s standard protocol. Its
scope is limited to physical and MAC layer. There are
802.11a, 802.11b and 802.11g protocols. 802.11b
protocol is used most widely now. The bandwidth of
802.11b’s physical layer is 2.4G Hz. It uses DSSS
technology and its speed is 11Mb/s.
B. Basic Knowledge of WLAN Security
WLAN’s data are transmitted in the air in the form of
electromagnetic wave, so its security is more important.
802.11b provides some security mechanisms: Service Set
Identifier Association (SSID Association), MAC filtering
and Wired Equivalent Privacy (WEP)[2].
AP will allow a client access the net if the client
provides a right and same SSID with AP. If the client’
SSID is different with the AP’ SSID, the AP will refuse
the client to use the net. So the SSID can be seen as a
simple password for providing an authentication
mechanism. It can provide some security.
The mean of MAC filtering is that the administrator
maintains a list of MAC addresses which some of them
are admitted to the WLAN and others are not. This
method can filter the physical address.
WEP is used to protect the data in WLAN. WEP uses
RSA’s RC4 symmetry encryption algorithm to encrypt
the data. Another function of WEP is also to prevent
unauthorized access to WLAN.
Although 802.11b provides three security
mechanisms, they are insecure. In the next section we
will discuss that how hackers attack the WLAN by
making use of these mechanisms.
C. Methods of Attacking WLAN
Reconnaissance is the first thing hackers have to do
before attacking the WLAN. Hackers drive around in a
car equipped with wireless gears looking for unsecured
WLAN to break in. They have to prepare some
equipment to finish this work. For example: Laptop or
PDA, 802.11b wireless card, antenna, GPS receiver and
vehicle.