WEP: Dead Again, Part 1 by Michael Ossmann
Source.
14/12/2004
Introduction
This article is the first of a two-part series that looks at the new
generation of WEP cracking tools for WiFi networks, which offer
dramatically faster speeds for penetration testers over the previous
generation of tools.
In many cases, a WEP key can be determined in seconds or minutes.
Part one, below, compares the latest KoreK based tools that perform
passive statistical analysis and brute-force cracking on a sample of
collected WEP traffic.
Next time, in part two, we'll look at active attack vectors,
including a method to dramatically increase the rate of packet collection
to make statistical attacks even more potent.
Is WEP that bad?
Many security folks and even more wireless folks these days are saying
that WEP isn't all that bad.
They say that if you use modern equipment that filters weak Initial
Vectors (IVs) and change your keys frequently (or at least once in a while),
nobody wil ever crack your WEP.
Sure, maybe some next-generation WEP attacks will arise one day that will
change everything, but WEP is okay today for all but the most sensitive
networks. Well, that next-generation is already here, heralded by highly
functional tools that make WEP look weaker than Barney Fife on guard duty,
sleeping on the job.
Let's take a look at some of the new tools that should be in every
penetration tester's bag of tricks, rather then delving into the details
of why the various attacks work. Time and time again, the industry has
shown that it will not reject broken securi y safeguards until attacks are
actually demonstrated in the real world.
Here's how to quickly turn some heads.
The way things were
Since the summer of 2001,
WEP cracking has been a trivial but time consuming process.
A few tools, AirSnort perhaps the most famous, that implement the
Fluhrer-Mantin-Shamir (FMS) attack were released to the security
community -- who until then were aware of the problems with WEP but did
not have practical penetration testing tools.
Although simple to use, these tools require a very large number of packets
to be gathered before being able to crack a WEP key.
The AirSnort web site estimates the total number of packets at five to ten million,
but the number actually required may be higher than you think.
The first caveat to this old approach is that only encrypted packets count.
As wireless access points transmit unencrypted beacons several times per
second, it is easy to be fooled into believing that you have a larger
number of useful packets than you really do.
If you use Kismet for network discovery and sniffing,
it breaks down the packet count for you, displaying the number
of "Crypted" packets separately from the total number, as shown below:
Figure 1
Figure 1. Kismet in action.
The second thing working against your packet collection efforts
is that only certain "interesting" or "weak" IVs are vulnerable to attack.
Kismet also tells you how many of these have been gathered, although it may
not use the same counting methodas the various cracking tools.
To make matters more difficult, wireless manufacturers responded to the FMS
attack by filtering out the majority of weak IVs that their access points
and wireless cards transmit.
Unless your target network is using old equipment, chances are you'll have
to collect no less than ten million encrypted packets to crack a WEP key
using these older tools.
In early 2002, h1kari released a tool called dwepcrack
(part of the bsd-airtools package) that improved upon the existing
implementations of the FMS attack.
Although dwepcrack did a good job of advancing the practical
implementation of statistical WEP cr ptanalysis, its improvements were
only incremental.
Tools that changed everything
On August 8th, 2004, a hacker named KoreK posted new WEP statistical
cryptanalysis attack code (soon to become a tool called chopper)
to the NetStumbler forums.
While chopper is functional, it is not currently maintained, and the
attacks have since seen better implementations in aircrack and WepLab.
However, the KoreK attacks change everything.
No longer are millions of packets required to crack a WEP key;
no longer does the number of obviously "weak" or "interesting" IVs matter.
With the new attacks, the critical ingredient is the total number of
unique IVs captured, and a key can often be cracked with hundreds of
thousands of packets, rather than millions.
Aircrack
The first tool in our new WEP cracking toolbox
is aircrack by Christophe Devine.
Implementing KoreK's attacks as well as improved FMS,
aircrack provides the fastest and most effective statistical attacks available.
To give aircrack a try, simply collect s many packets as possible
from a WEP encrypted wireless network,
save them as a pcap file, and then start aircrack from the command line.
Figure 2
Figure 2. aircrack succeeds.
How many packets does it take?
The number of packets required for success with aircrack varies greatly.
As a rule of thumb, shoot for a minimum of 200,000 for a 64 bit key
and 500,000 for a 128 bit key,
and remember to count only encrypted packets with unique IVs,
not total packets.
aircrack comes with a handy packet capture tool
called airodump that keeps a running tally of unique IVs
(the counting method is imperfect but soon to be fixed) and is capable
of handling very large capture files.
Personally, I find it easier to use Kismet
most of the time and simply estimate the number of unique IVs
based on the number of "Crypted" packets reported by Kismet.
The number of encrypted packets with unique IVs is typically
more than 95% of the total number of encrypted packets.
How long does it take?
I often find that aircrack determines a WEP key within a few seconds,
but the execution time is highly variable.
Shorter execution times require more unique IVs, more luck,
and the lowest successful "fudge factor,"
a setting that tells aircrack how wildly
it should guess when trying new keys.
The higher the fudge factor, the more keys aircrack will try,
increasing both the potential time of execution and the likelihood
that the attack will succeed.
The fudge factor has a default value of two but may be set
to any positive integer.
The default setting may be a good place to start,
but trying several different settings is frequently fruitful
if the initial attack does not succeed.
I have encountered some data sets that could be cracked
with a fudge factor of one,
several that could only be cracked with three, four, or higher,
and one data set that could only be cracked
with a fudge factor of 31 or higher.
The higher the fudge factor,
the more branches aircrack will take.
This generally results in a longer execution time
unless a successful crack happens early in the process.
The following graph shows the time of execution as reported by aircrack
(not counting file loading and parsing)
for a particular data set with various fudge factors.
Blue dots represent the time required for a successful crack
and red dots represent the time spent in a failed attempt.
Figure 3
Figure 3. aircrack execution times.
If the default fudge factor (two) fails,
I usually double it for each subsequent attack on the same data set.
By terminating any attack that takes longer than five or ten minutes,
I have had good luck finding a successful fudge factor fairly quickly.
One of the nice features of aircrack is that it works
for both 64 bit and 128 bit WEP keys by default.
If you know the key length of the target network,
giving the length to aircrack as a command line option can speed up
the process.
WepLab
Although not quite as successful in my tests,
Jose Ignacio Sanchez's WepLab provides an alternative implementation
of the KoreK attacks that can be nearly as effective as aircrack,
with a little experimentation.
Similar to aircrack's fudge factor, WepLab
provides a probability adjustment with its --perc command line option.
The default --perc setting of 50% is fairly aggressive
and results in relatively few branches,
while higher settings increase the number of branches taken.
In addition to excellent statistical attacks,
WepLab provides brute force and dictionary cracking attacks
that can be very effective.
This combination of techniques makes WepLab an essential tool.
Comparing the tools
WepLab and aircrack are certainly impressive,
but are they the best tools in the box?
To find out, I performed a series of tests comparing
the ability of several statistical WEP cracking tools.
To set up the test, I configured a wireless access point with
a random 128 bit WEP key,
generated a great deal of traffic,
and collected about 25 million encrypted packets.
I then carved up the capture into shuffled subsets of various lengths
and tried to crack each subset with each tool, measuring the number
of seconds for every successful crack (including file load times).
Trials that lasted more than ten hours were terminated.
The results surprised me quite a bit.
128 bit Cracking Time in Seconds
Data Weak Unique | aircrack AirSnort WepLab dwepcrack
Packets IVs IVs aircrack (4) | WepLab (95) WEPCrack
23457438 8560 16775533 Failed 245 92 Failed 244 Failed Error
21016149 1807 16775167 Failed 249 41 Failed 247 Failed Failed
19584364 9340 16275925 Failed 230 114 Failed 229 Failed Failed
15690079 8694 12860342 Failed 184 90 Failed 179 Failed Error
15628308 5505 12361369 Failed 176 70 Failed 174 Failed Failed
11743639 8473 11743639 Failed 154 69 Failed 153 Failed Error
11739339 3037 11693841 Failed 150 Failed Failed 151 Failed Failed
7829104 1001 5031233 Failed 74 Failed Failed 77 Failed Error
7799213 5225 7779299 Failed 87 37 Failed 101 Failed Failed
4175159 1554 4069824 52 51 Failed Failed 54 Failed Failed
3914568 767 3914568 Failed Failed Failed Failed Failed Failed Error
3914553 3958 3914553 48 49 Failed Failed 56 Failed Error
3884657 1490 3864743 48 46 Failed Failed 52 Failed Failed
978652 986 978652 Failed Failed Failed Failed 11 Failed Error
978633 371 978633 Failed 12 Failed Failed 13 Failed Error
977219 264 974902 Failed 9 Failed Failed 13 Failed Failed
684992 143 684992 8 8 Failed Failed 11 Failed Error
683605 238 681288 Failed 18 Failed Failed 13 Failed Failed
587184 117 587184 Failed 27 Failed Failed Long Failed Error
489293 103 489293 8 7 Failed 5 5 Failed Error
489286 115 489286 15 16116 Failed Failed Long Failed Error
391465 78 391465 5 13 Failed Failed Long Failed Error
391433 78 391433 Failed 6 Failed Failed 6 Failed Error
293596 65 293596 Failed 5 Failed Failed Long Failed Error
293579 65 293579 Failed Failed Failed Failed Failed Failed Error
Table 1. 128 bit WEP Cracking Times (in seconds).
Although aircrack was successful with the greatest number of data sets,
it did not perform as well as I expected with the default fudge factor.
In fact, beyond about four million packets,
its success rate with default options noticeably declined with the
addition of more packets.
This problem was easily remedied, however, by increasing the fudge factor.
A fudge factor of four was successful in nearly every case.
In the few cases in which a fudge factor of four did not work,
I was able to find a successfu setting in the five to twenty range.
WepLab's nearly complete failure with default options was surprising,
but a little experimentation
resulted in a --perc setting of 95%
that rivaled even aircrack's best results.
For some data sets, WepLab was more successful than aircrack;
for others, aircrack was the winner.
Overall, both tools yielded outstanding results with minor tweaking,
though aircrack edged out WepLab in the smaller data sets.
AirSnort's success rate matched my expectations quite closely,
cracking nearly every key with ten million or more packets
but failing most of the time when using a smaller data set.
AirSnort's speed beat out aircrack and WepLab in every case.
Of course, an extra minute or two is rarely a concern,
so the superior cracking ability of the KoreK attacks
with far less required input puts WepLab and aircrack
well above AirSnort in my book.
The most unexpected results were the total failures of WEPCrack
and dwepcrack with all data sets.
WEPCrack came up with as many as eleven out of thirteen correct bytes
but always included incorrect bytes in its final result.
Lacking a process to verify the correctness of a key,
WEPCrack produced a false positive result every time.
dwepcrack failed in every case, complaining of either "insufficient ivs,"
the inexplicable error, "unable to find a valid data packet in logfile,"
or, for my largest data set, "File too large."
As the tests were performed under Linux,
perhaps dwepcrack would be more successful in its native BSD environment.
Don't ignore the obvious
WepLab and aircrack make statistical attacks alarmingly easy,
but many keys can be cracked without going to such lengths.
The simple fact is that most people don't choose strong encryption keys,
in part because vendors make it so easy to use weak ones.
Because of this weakness, a great number of WEP encrypted networks
are vulnerable to dictionary or brute force attacks
that only require the capture of a single encrypted data packet to attempt.
The simplest brute force attack involves trying every possible binary key,
a process that is completely impractical for 128 bit keys
but may be worth trying for 64 bit keys
if you have a few supercomputers lying around.
WepLab and dwepcrack provide the ability; you provide the CPU cycles.
WepLab and WepAttack both provide two dictionary attack methods,
one based on the more common MD5 hashing technique
that many access points use to turn a passphrase into a binary WEP key,
and the other using null terminated raw ASCII WEP keys,
employed by a few devices.
Knowledge of the target network hardware may help to determine
which method would be preferred for a particular environment.
Because both of the above tools can use any dictionary
in a text file or standard input,
powerful password cracking utilities such as John the Ripper
may be used to generate the word list.
Combined with John's ability to apply rules
(various capitalizations, appending numbers, etc.)
to a basic dictionary,
these tools result in a successful crack surprisingly often.
Although both performed dictionary attacks successfully in my tests,
WepLab executed faster while WepAttack provided the convenience of
multiple simultaneous attack modes.
If a dictionary attack fails,
an optimized brute force attack based on the vendor's passphrase method
may be fruitful.
For devices that use null terminated ASCII keys,
WepLab offers a brute force attack that only tries ASCII bytes,
resulting in a somewhat smaller
(though still generally too large)
key space.
For the more common MD5 hashed passphrases,
dwepcrack can execute an optimized brute force attack for 64 bit keys.
This method, devised and first implemented by Tim Newsham,
dramatically reduces the potential key space from 2^40 to 2^21 possible keys,
resulting in an extremely fast attack.
The complete toolbox
Featuring the most effective statistical attacks available,
aircrack may be the single most important tool in the box.
WepLab is also essential, providing several techniques
including an excellent alternative implementation of the KoreK attacks.
AirSnort may be worth trying if you have a lot of packets to work with,
but its position as statistical attack leader has been usurped.
WepAttack is a nice addition for dictionary attacks,
and dwepcrack provides the most fruitful brute force technique.
The only other essential ingredient is a method to collect packets;
while most of these tools include packet gathering
as a built-in ability or ancillary program,
I personally prefer Kismet for this function.
All of these tools are available in the Auditor Security
Collection live Linux CD-ROM.
Concluding part one
Looking at the outstanding success rate of aircrack and WepLab
in the 500,000 to 1,000,000 packet range, it is clear that
a new era is upon us.
Vendors' efforts to limit the transmission of weak IVs have been
blown away, and the time required to collect packets for a successful
statistical attack has been reduced twentyfold.
If you thought WEP was okay, think again.
All of the tools discussed so far are completely passive,
receiving data but transmitting nothing.
In part two, we will look at active WEP attacks,
including a method to dramatically increase the rate of packet collection,
making statistical attacks even more potent.
Fasten your seat belts.
Notes:
Because a majority of the tools refer to 64 bit and 128 bit key lengths,
this article adopts the convention.
It is important to realize, however,
that the secret portion of a 64 bit key is only 40 bits
and the secret portion of a 128 bit key is only 104 bits.
All tests were performed with a 1.6GHz Pentium-M laptop
running Gentoo Linux (2.6.8.1 kernel).
Linux was chosen for the tests in order to accommodate the greatest
number of tools.
Some of the tools are also available for OS X, Windows, and/or various BSDs.
In addition, there are a few tools for the other platforms that are not
available for Linux.
None of these, however, appear to implement the KoreK attacks
except for the current development version of KisMAC.
Tool information and links:
aircrack
- version: 2.1
- sample invocation: aircrack -n 128 packets.pcap
- sample invocation: aircrack -f 4 -n 128 packets.pcap
- source: http://www.cr0.net:8040/code/network/aircrack/
AirSnort
- version: 0.2.6
- sample invocation: airsnort
- 128 bit crack breadth: 2 (default)
- source: http://airsnort.shmoo.com/
Auditor Security Collection
- version: 081004-01
- source: http://remote-exploit.org/?page=auditor [got it]
- download here
dwepcrack
- version: 0.4
- sample invocation: dwepcrack -s -w packets.pcap
- sample invocation: dwepcrack -b packets.pcap
- source: http://www.e.kth.se/~pvz/wifi/
- notes: also tried binary from Auditor Security Collection with identical results
John the Ripper
- version: 1.6
- source: http://www.openwall.com/john/
- wiki : en.wikipedia.org/wiki/John_the_Ripper
Kismet (scanning tool)
- version: Kismet-2004-10-R1
- source: http://www.kismetwireless.net/
WepAttack
- version: 0.1.3
- sample invocation: john -w:words.txt -rules -stdout | wepattack -m n64 -f packets.pcap
- source: http://wepattack.sourceforge.net/
WEPCrack
- version: 0.1.0
- sample invocation: pcap-getIV.pl -b 13 -f packets.pcap; WEPCrack.pl
- source: http://wepcrack.sourceforge.net/
WepLab
- version: 0.1.3
- sample invocation: weplab -rpackets.pcap --key 128 testers.pcap
- sample invocation: john -w:words.txt -rules -stdout | weplab -y --key 64 --attacks 1 testers.pcap
- source: http://weplab.sourceforge.net/
Ideally, the input data sets would come from a variety of source networks
with varied hardware and WEP keys.
Although the results are not fully comprehensive,
the spot checks against various networks generally agree with the test results.
|
WEP: Dead Again, Part 2 by Michael Ossmann
Source.
08/03/2005
New
url.
Introduction
In part one we examined
the latest generation of passive WEP cracking tools
that use statistical or brute force techniques
to recover WEP encryption keys from captured wireless network traffic.
This time, in the second and final article,
we take a look at active tools that use 802.11 transmissions
to attack WEP networks.
All of these active wireless attack techniques
discussed in this article require the ability
to inject arbitrary packets onto a wireless network.
Although a variety of injection methods are available,
most require Linux, are unsupported,
and use hacked drivers that have support and availability problems.
All of them require at least one wireless PCMCIA card
based on the Prism2 chipset
(such as the Senao 2511-CD-PLUS).
Fortunately, the Auditor Security Collection
[ref 1] live cd-rom
can save you a number of headaches
as it includes ready-to-use drivers for several active attack tools.
Beware of network disruptions that can be caused by active attacks.
Using these tools may have unpredictable effects
in various environments.
In my testing, I have encountered a few systems
that had to be rebooted in order to function again
after being bombarded with injected packets.
Rapid traffic generation
If you've spent much time sniffing wireless networks
(and, if you are reading this article, I bet you have)
then you probably have noticed
that the source and destination MAC addresses
are plainly visible for every packet
even when the packet contents are encrypted with WEP.
This allows you to uniquely identify hosts on the wireless network
as well as hosts on a bridged, wired LAN.
If you've never tried traffic analysis of an encrypted wireless network,
I highly recommend the exercise.
Find a busy network, fire up Ethereal [ref 2],
and try to answer as many of the following questions as you can:
- * How many access points share the same ESSID?
- * Does the access point bridge or route traffic?
- * Is EAP used? If so, what EAP type?
- * Is open system or shared key authentication in use?
- * What is the MAC address of the default gateway?
- * What are the NIC vendors for wireless hosts?
- * What are the NIC vendors for wired hosts?
- * What is the vendor of the access point?
- * Can you find a DNS transaction?
- * Can you find a TCP three-way handshake?
- * Can you find an HTTP transaction?
- * What hosts transmit/receive the most bytes/packets?
- * Does any traffic occur with a distinct periodicity (like POP3 every 5 minutes)?
- * Can you find any ARP traffic? (hint: frame.pkt_len==68 and wlan.da==ff:ff:ff:ff:ff:ff)
No wireless network based on WEP provides protection against replay attacks.
With the right tools, you can take any captured packet
and reinject it back onto the network.
The packet will be correctly encrypted
even though you have no idea of its contents.
Then again, you may have a pretty good guess
as to its contents based on traffic analysis.
You might choose something that is likely to be an ARP request,
hoping that it will generate a response from another host on the network.
If you're right, you could replay the same packet
hundreds or even thousands of times per second,
forcing that host to spew an enormous stream of responses,
individually encrypted with different IVs.
This method described is exactly the method used by aireplay,
a tool that comes with aircrack [ref 3].
A screenshot of aireplay is shown below in Figure 1.
As we discovered in part one,
both aircrack and WepLab [ref 4]
are capable of cracking WEP keys after collecting
just a few hundred thousand packets.
With a successful aireplay attack,
you can generate that many packets in just a few minutes.
Therefore, people who say
that re-keying every 10 minutes makes WEP unbreakable are dead wrong.
Per-session, per-user keys also don't stand a chance against this attack.
WEP is truly dead. . . again.
Figure 1. Aireplay at work.
The Auditor Security Collection live cd-rom
makes it relatively easy to try aireplay
because it includes aircrack's patched hostap driver by default,
but you will need two wireless cards
with at least several inches distance between their antennas.
You may find it easier to use two laptops,
one with a Prism2 card to replay captured packets,
and a second to capture all the new traffic that is generated.
Be prepared to spend some time finding an appropriate packet to replay;
you may need to save individual packets with Ethereal and feed them to aireplay.
Another tool that implements a similar attack
has been around for much longer in the BSD world.
Part of OpenBSD's Wnet,
reinj performs the same attack as aireplay
and does it all with just one Prism2 card
(as does the latest beta of aireplay).
Whichever tool you use to generate traffic,
I recommend WepLab or aircrack for cracking the WEP key.
Encrypted packet injection
Most of the WEP attack tools on the scene today
focus on cracking WEP keys,
but there are also other WEP vulnerabilities that can be exploited.
WEPWedgie [ref 5], a tool released in 2003 by Anton Rager,
allows an attacker to craft an arbitrary plaintext packet
and inject it into the wireless network without knowledge of the WEP key.
The receiving stations accept the packet
as if the sender used the correct key to encrypt the packet.
The way WEPWedgie is able to accomplish this
is by reconstructing the key stream that was used to encrypt a particular plaintext.
With knowledge of some plaintext and the resulting ciphertext,
a simple XOR operation yields the keystream that results from a particular IV.
And because WEP allows the same IV to be used over and over again,
WEPWedgie can use the keystream
to correctly encrypt and inject any number of packets
whose contents are limited only by the length of the known keystream.
There are a number of ways that an attacker can discover
the ciphertext for a known plaintext,
but the method used by WEPWedgie's prgasnarf
is to listen for shared key authentication.
The 802.11 standard defines two types of authentication,
"open system authentication"
(which you can think of as "no authentication")
and "shared key authentication"
(which you can think of as
"the most misguided authentication mechanism ever devised").
In shared key authentication,
the AP transmits 128 bytes of plaintext,
and then the station encrypts the plaintext
and transmits the resulting ciphertext using the same key
and cipher that are used by WEP to encrypt subsequent network traffic.
Believe it or not, this horrifying scheme
is still being recommended by certain vendors [ref 6] as a security enhancement,
but it is less common in practice than open system authentication.
Once a keystream has been captured
(hint: spoofed deauthentication),
WEPWedgie provides a number of interesting packet injection attacks.
A simple one sends a ping to a target of your choice.
The other attacks provide a method of port scanning targets
on the wireless network using a chosen source address.
As long as the target network has Internet connectivity,
you can use the address of a host you control on a remote network
and sniff the results of your scan on that host.
Interpretation of the results is up to you.
Figure 2. Wepwedgie injecting pings.
To try out WEPWedgie,
you'll need a system running a Linux 2.4 kernel,
a Prism2 card, and Abaddon's AirJack [ref 7] driver.
Unfortunately the Auditor CD's 2.6 kernel isn't supported by AirJack,
so you'll have to prepare a system on your own.
You might find the Wi-Fi Dog of War [ref 8] instructions helpful
to get AirJack working.
Single packet decryption
KoreK, the individual who brought us
the improved algorithms used in aircrack and WepLab,
released a tool a few months ago on the NetStumbler forums
that enables an attacker to decrypt individual packets
without knowledge of the WEP key.
Called chopchop [ref 9],
this tool replays a single encrypted packet,
modifying one byte at a time.
By monitoring the access point to find out if it accepts the modified packet,
chopchop is able to determine the plaintext value
of that particular byte and move on to the next.
Within several seconds (and thousands of replayed packets),
chopchop can decrypt an entire packet.
It doesn't matter what encryption key was used,
or if a separate key is used for each user,
or if the key changes every hour or minute;
any packet can be decrypted.
Figure 3. Chopchop decrypting a single packet.
You can use the Auditor CD and a single Prism2 card to try chopchop.
Use the switch-to-wlanng script that Auditor provides,
pop the card out and then back in again,
and the linux-wlan-ng driver will be working,
complete with KoreK's injection modificatios.
The next generation
Since the release of chopchop,
the task of acquiring a valid keystream for encrypted packet injection
has become trivial for all WEP encrypted networks.
Joshua Wright is working on a new version of WEPWedgie
that incorporates the chopchop attack and works with newer drivers.
Christophe Devine's upcoming version of aireplay,
already released as a beta,
uses the same technique to allow the forgery of any ARP request.
Various people are working to improve wireless drivers,
including implementation of packet injection with a wider variety of hardware
(prism54 is reported to work already),
and construction of an abstraction layer for packet injection.
Conclusion
Some vendors continue to sell products
that completely lack reasonable wireless security features.
In just two months since the publication of part one of this article,
I've encountered multiple brand new devices,
including Wi-Fi VOIP phones
and and acces point provided by a cable Internet provider,
that provide no encryption capability other than WEP.
As long as this continues,
white hats and black hats alike will keep improving the attack techniques
that render WEP even worse than useless.
For the most part,
the newer WEP attack tools exploit vulnerabilities
that were described in theory four or more years ago.
Perhaps people will learn from the history of WEP the lesson
that theoretical vulnerabilities
will become real vulnerabilities.
Until they do,
you can use these penetration testing tools
to assess the weaknesses of your own network
and maybe even convince someone that change is needed.
Tools and links
[1] Auditor Security Collection:
http://remote-exploit.org/?page=auditor
[2] Ethereal:
http://www.ethereal.com/
[3] aircrack:
http://www.cr0.net:8040/code/network/aircrack/
[4] WepLab:
http://weplab.sourceforge.net/
[5] WEPWedgie:
http://sourceforge.net/projects/wepwedgie/
[6] Linksys recommends shared key authentication:
http://www.linksys.com/splash/wirelessnotes.asp
[7] AirJack:
http://sourceforge.net/projects/airjack/
[8] Wi-Fi Dog of War Mini How-To:
http://www.geekspeed.net/~beetle/download/wifi_dog.html
[9] chopchop:
http://www.netstumbler.org/showthread.php?t=12489
About the author
Michael Ossmann is a security administrator for Exempla Healthcare.
|
