Download - Academy Publisher

Hackers can sniff the WLAN after preparing these
works. Because WLAN’s data are transmitted in the air,
Hackers can easily get data they want. Such as: AP
name, SSID and MAC address[3]. They can break into
the WLAN by using these information.
(1) SSID Spoofing
Because SSID is shared between AP and clients,
hackers can get SSID easily. This becomes a kind of
method of attacking WLAN. Because AP broadcasts data
to all clients, they can find AP name, channel, SSID and
MAC address in these data. So Hackers can listen these
data and get them easily. Hackers can attack WLAN by
using SSID association. Netstumbler software attack
WLAN by using this theory too.
Sometimes the AP use default SSID value to
communicate with the clients. Then hackers can get the
SSID from the vendors more easily.
(2) MAC Spoofing
As mentioned before, MAC filtering is a kind of
security mechanism of WLAN, but it is insecure.
Hackers can attack WLAN by using this. MAC filtering
provides security with the way only allowed valid MAC
addresses get into the WLAN. These can be set in the
AP. Some MAC addresses can be allowed to use the
WLAN and others can’t be allowed to use the WLAN.
But if a hacker get these messages, he can change his
MAC address to a valid MAC address to break into the
WLAN. They can use some crack software to gain MAC
addresses easily.
(3) Authentication Spoofing of WEP
If clients want to communicate with AP, they have to
pass the WEP authentication. The process of WEP
authentication as follow: AP sends a 128-byte random
string to the client wishing to authenticate. The client
then encrypts the message to the AP. If the message
matches then the AP will allow the client to use the
WLAN, otherwise refuse. In this process, hackers can
acquire both the original plaintext and cipher messages at
the same time. So they can create a fake authentication
message that AP will authenticate a valid user.
Sometimes hackers can acquire the WEP key from
windows register, so the attacking will become more
easily. Because the WEP key is shared between all
communication stations.
WEP algorithm implements on the basis of RSA’s
RC4 encryption algorithm, but RC4 encryption algorithm
has some weaknesses. So hackers can crack WEP key by
using these weaknesses. We will discuss it in the next
section.
Ⅲ. THE ANALYZING OF WEP ALGORITHM
Until now we have know that the security of WLAN
is mostly depended on the security of WEP key. But as
mentioned before, WEP uses RC4 encryption algorithm.
We can crack WEP key by using RC4’s weaknesses.
A. WEP Algorithm
WEP encryption process as follow: The data frame is
check summed (using the CRC-32) to obtain c(M),
where M is the message. M and c(M) are concatenated to
get the plain text P=(M, c(M)). RC4 key stream is
generated by a function of the initialization vector IV
and the secret key =RC4 (IV, K). The cipher text results
from applying the XOR function to the plain text and the
key stream. That is (M, c (M)) XOR RC4 (v, K). At last,
cipher text and IV are transmitted in the forms of
electromagnetic wave.
By WEP symmetrically cryptographic characteristic,
decryption process is the reverse of the encryption
process by using the same WEP key. The receiver uses
IV and WEP Key to generate the key stream. We use
XOR key stream with cipher text to recover the plaintext
P1. The P1 is then split into two parts as message M1
and check sum C1. c(M1) is then computed and
compared with C1, if matches we receive it ,or refuse.
B. The Weaknesses of WEP Algorithm
(1) Invariance Weakness
RC4 is a kind of stream key algorithm widely used.
RC4 is composed of key schedule algorithm (KSA) and
pseudo-random generation algorithm (PRGA). In KSA
process the WEP key is changed to a state array s with
hundreds of plus and swap operation. The process of
PRGA generates a pseudo-random stream. This stream is
used to encrypt the plaintext or decrypt the cipher text.
Some researches indicate that the RC4 algorithm is
vulnerable in the aspect that every 256 keys or less
produce one weak key. This is called invariance
weakness[4]. These weak keys will result in the pseudorandom
have the specific and recognizant prefix. Their
relativity with the key will become low. The data that are
encrypted with these weak keys will become breakable.
(2) IV Weakness
There is another weakness is repeat-used IV, which is
called IV weakness[4]. The input key of RC4 is
composed of 24bytes IV and 40 bytes WEP key. The IV
is used to guarantee that the same plaintext will never
generate the same cipher text. But many wireless cards
reset the IV to 0 each time a card is initialized, and
increment the IV by 1 with each packet. Because of the
invariance of WEP key the data will be encrypted with
the same key stream. Yet in WLAN the IV is transmitted
with plaintext that will be acquired easily.
There is another situation of repeat-used IV. Because
the length of IV is only 24 bytes, every 224 packets will
generate one repeat IV. So we can probably finger out
that how much time will generate one repeat IV. An AP
sends 1500 byte packets at 11 Mbps, and the time is
about 1500*8/(11*10^6)*2^24=18000 seconds, which is
about 5hours.
Hackers can get the plaintext by using these repeat
IVs. If two cipher texts that are encrypted with the same
key stream XOR each other, it will generate the result of
two plaintexts’ XOR because of the function of XOR. If
one plaintext is known, another plaintext that is
encrypted with the same key stream will be acquired
easily. So the function of RC4 encryption is avoided.
Hackers can crack WEP key by using these repeat
IVs. One special formatted IV can be constructed. In this
40