WLAN Vulnerabilities

There are a number of security vulnerabilities in 802.11 that have
unfortunately been discovered by malicious hacker exploits. These vulnerabilities
constitute passive types of attacks that are designed to
decrypt traffic with respect to algorithms based on statistical analysis
and active attacks designed to decipher network traffic. An active attack
is basically accomplished by confusing the access point to give up to the
attacker information it should not. This is the reason why default passwords
and settings should always be changed as soon as you deploy your
WLAN.


The most significant problem rests with WEP, which was itself
designed to make a wireless network nearly as secure as the wired Ethernet.
The biggest problems result from using the same WEP key over
and over again. The more you use the same keys, the greater the chance
an attacker will learn this piece of information so that he might ultimately
use it against you for the purpose of accessing your WLAN. The
vulnerability here rests in the fact that the same key is used for extended
time periods, and nobody really thinks to change it. When you think
of a WEP key, you should remember to change the key as often as you
might change your logon password.


The initialization vector (IV) constitutes the 24-bit field transmitted in
clear text as part of WEP. This 24-bit information initializes the RC4
algorithm key string. The IV is basically a short field used for encryption.
The IV is meant to protect your information, but a short IV ultimately
gets repeated many times over the network when there is a great deal of
traffic. The problem is that an attacker may easily use this information
to intercept your wireless data channel, find your key stream, and then
use this information to decipher the encrypted data on your WLAN.
Since the IV is actually an element from the RC4 encryption key, once
the hacker has intercepted this bit of information and can intercept
every packet key. Since the RC4 key is weak in and of itself, this could
indicate the precursor of a significant attack. In fact, this attack could
easily be run a script kiddie because once the secret key is recovered, it
is possible to analyze only a small portion of the wireless network traffic
and be able to have full access to the WLAN.


There isn’t any protection for the actual composition of the encryption
that WEP has to offer except that the MAC portion of the 802.11
standard uses the CRC element described earlier as a form of privacy
protection.