WEP is dead ?
David.Dominick at delta.com
Tue Aug 7 05:28:36 EST 2001
Well the sad thing is that we have been telling them this all along. WEP is
not dead, it was never alive. Hardly any security engineers that I know have
even considered using WEP because even before the crack came out WEP was far
too easy to break. Heck all you had to do if you don't want to crack it is
capture the snmp password and turn off the WEP on the AP yourself!
Now there are tools for script kiddies to circumvent WEP without disabling
Yet the pat answer from IEEE and the WEP boyz is, "the Berkeley report was
far too complex to be widely implemented, and that WEP should not be used by
itself to protect sensitive data."
Typical response of people who don't understand computers. Once the crack
was discovered and a script was written to perform it, it took about 5
seconds for that script to appear on the newsgroups that these people would
be well served to subscribe to.
If one of these IEEE people would bother to read Phrack or any of the
thousands of newsgroups, maybe we could get a solution that worked.
Several of us have been saying for a long time that you should not let your
BRIDGE provide your security.
Good luck all.
Enterprise Security Engineering
From: Jean Tourrilhes [mailto:jt at bougret.hpl.hp.com]
Sent: Monday, August 06, 2001 2:19 PM
To: Samba/Wavelan mailing list
Subject: WEP is dead ?
WEP is not going too well lately :
This attack is on the key schedule of RC4, so pretty close to
the core of the encryption mechanism.
Note that 802.1x still use WEP for the encryption (it just use
dynamic key instead of static key), so won't fix this problem. And
Radius/LEAP is only an authentication, not encryption.
IPsec anyone ?
More information about the wireless