New attack cracks WPA Wi-Fi encryption in just a minute

[Airbot]

Encryption systems used by wireless routers have had a long history of security problems. The Wired Equivalent Privacy (WEP) system was cracked and rendered effectively pointless within a few years of its introduction in 1997. Now, it looks like its WPA successor may soon suffer the same fate, with a pair of Japanese researchers developing a way to break it in just one minute.

more..

 

[zigzag3143]

Aaron Nice post. You think they will ever make wifi encryption bulletproof?

 

[Dwarf]

More reason for wireless users to upgrade their security to WPA-2 if their devices support it.

 

[SquonkSC]

No encryption will be full proof for ever.
Development eventually catches up with it.

By the time the Japanese finished their crack,
we will all switch to WPA3 and off we go again buying new routers.

By the way:
NSA have a supercomputer that cracks all known internet encryptions used to date in a matter of seconds, to a maximum of 15 minutes.
They screen all internet traffic around the globe 24hrs a day.

.
.

 

[rsvr85]

Upgraded BT HomeHub2 to WPA2, thanks for the heads up airbot

 

[masterB]

The attack builds on the so-called "Becks-Tews method"

This may be Tews. I knew he's doing something!

 

[pparks1]

Aaron Nice post. You think they will ever make wifi encryption bulletproof?

No, a coworker once said, "if it's made by man, it can be broken by man". I do think that it holds true.

 

[Dark Nova Gamer]

No, a coworker once said, "if it's made by man, it can be broken by man". I do think that it holds true.

It is true.

 

[sup3rsprt]

Both attacks work on WPA systems that use the Temporal Key Integrity Protocol (TKIP) algorithm. They aren't key-recovery attacks

Some implementations of WPA supports AES too (I'm not referring to WPA2). So no, I wouldn't say WPA is cracked. It makes more sense to say TKIP is cracked, but even this is not really the case (broken maybe, but not cracked).

 

[iseeuu]

Aaron Nice post. You think they will ever make wifi encryption bulletproof?

I try to take a 'reasonable' approach to 'security'. Take my house for example, (please DON'T take my house!). If I wanted a completely secure, break-in proof house, there would be no openings large enough for anyone to enter, no doors or windows, all solid. But then even I could not get in or out, so what would be the point? Yes, I lock my doors at night before going to bed, but any strong person could kick the door frame right off the wall. After all, there is only a little striker plate and two screws securing the door to the wall. The glass windows break easily. So why lock doors and windows? If you make it hard enough (although not impossible) for someone to break-in, they will go somewhere else, where it is easier. And with computers, there is a huge supply of easy targets. So I try not to stress over security, but I do lock the doors.

Robert

 

[SquonkSC]

I try to take a 'reasonable' approach to 'security'. Take my house for example, (please DON'T take my house!). If I wanted a completely secure, break-in proof house, there would be no openings large enough for anyone to enter, no doors or windows, all solid. But then even I could not get in or out, so what would be the point? Yes, I lock my doors at night before going to bed, but any strong person could kick the door frame right off the wall. After all, there is only a little striker plate and two screws securing the door to the wall. The glass windows break easily. So why lock doors and windows? If you make it hard enough (although not impossible) for someone to break-in, they will go somewhere else, where it is easier. And with computers, there is a huge supply of easy targets. So I try not to stress over security, but I do lock the doors.

Robert

+1 agree with you 100%. Paranoia is the worst prison cell of all.

For home use, WPA or WPA2 + strong password, + mac filter + no broadcast, should keep them busy for a while. And then what? They can use my internet connection.
Still some work to do, to get into my router (providing I changed the admin/admin default).
And then get past my windows security (providing I set that up right).

At the end of the day the reward is what? My family pictures? My letter to the IRS asking them if I can pay a little later? The free use of my printer?
They would still have to get into my house to pick up their printouts.


For corporations it's a different ballgame, but getting into their servers should be tenfold more challenging.

.

 

[iseeuu]

+1 agree with you 100%. Paranoia is the worst prison cell of all.

For home use, WPA or WPA2 + strong password, + mac filter + no broadcast, should keep them busy for a while. And then what? They can use my internet connection.
Still some work to do, to get into my router (providing I changed the admin/admin default).
And then get past my windows security (providing I set that up right).

At the end of the day the reward is what? My family pictures? My letter to the IRS asking them if I can pay a little later? The free use of my printer?
They would still have to get into my house to pick up their printouts.

Funny, but how true:

:roflmao::roflmao::roflmao:

 

[Antman]

The problem isn't print jobs. It is credit card numbers, et cetera.

 

[SquonkSC]

The problem isn't print jobs. It is credit card numbers, et cetera.

I wish. Maybe they could pay the 3000 debt I have on it.

:roflmao:

 

[Antman]

I wish. Maybe they could pay the 3000 debt I have on it.

Well, not the whole 3k, but I will post this month's payment. You have me feeling guilty. :sarc:

 

[SquonkSC]

Well, not the whole 3k, but I will post this month's payment. You have me feeling guilty. :sarc:

I was wondering, are creditcards in the USA also insured?

A few years back somebody in Paris (France) was ordering stuff on my Visa card. About 4000 euros worth.

I called Visa and I didn't have to pay a dime.

.

 

[Antman]

I was wondering, are creditcards in the USA also insured?

A few years back somebody in Paris (France) was ordering stuff on my Visa card. About 4000 euros worth.

I called Visa and I didn't have to pay a dime.

.

Insured is not the right word. My beautiful wife was the victim of credit card fraud/identity theft before we were married. I could prove the fraud in two cases. One account balance was zeroed out - and later the credit account was withdrawn. The other bank demanded payment in full in spite of the proof - because she had made four payments on the debt.

The credit card companies guarantee payment to the merchant - merchants would not accept the cards otherwise. Most credit agreements waive liability to the cardholder under specific circumstances. Solvency of the credit card company is paramount in America. Consumers are at the mercy of the wind.

 

[iseeuu]

Insured is not the right word.

One would have to read and be able to understand the credit card agreement one agrees to when accepting and using the card to know just what rights you have. Generally, you have a limited time to identify and notify of fraudulent charges to ones credit card or bank account in order to be absolved of the charges. One must be diligent in reviewing credit card and bank statements monthly and in the USA one can receive three free credit reports per year, allowing one to do a review of one's credit history every four months.

Personally, I NEVER use a "Debit Card" because the funds can be stolen from my checking account and cause a boatload of headaches. At least with a credit card, I have 30 days to identify fraudulent charges before I have to make a payment on the card.

Although there are other ways to steal one's financial info, keeping "hackers" and thieves out of my computer and away from my credit card numbers and passwords is not that difficult. A little bit of software and a lot of common sense usually do it.

Robert

 

[SquonkSC]

Insured is not the right word. My beautiful wife was the victim of credit card fraud/identity theft before we were married. I could prove the fraud in two cases. One account balance was zeroed out - and later the credit account was withdrawn. The other bank demanded payment in full in spite of the proof - because she had made four payments on the debt.

The credit card companies guarantee payment to the merchant - merchants would not accept the cards otherwise. Most credit agreements waive liability to the cardholder under specific circumstances. Solvency of the credit card company is paramount in America. Consumers are at the mercy of the wind.

In most European countries the consumer is protected against credit card fraud.

The European court ruled that the banks are responsible because credit card security is a joke.
The banks are well aware of it, nevertheless they chose not to upgrade security because it would cost them a lot more than the losses they suffer from fraud.

I read somewhere that most of the defrauders are caught because they are so stupid to have the ordered goods delivered at their home residence.

edit: the French dude who misused my card was one of them, according to Visa.

 

[Antman]

...Although there are other ways to steal one's financial info, keeping "hackers" and thieves out of my computer and away from my credit card numbers and passwords is not that difficult. A little bit of software and a lot of common sense usually do it.

Robert

Yes, TJX and Home Depot, et al, probably did not ******** common sense.