How easy is to break WEP?

5 12 2006

I would like to start this post with an apology. It’s been a little more than a month without any post or updates. This is due to the fact that I have just started a new job at Ernst & Young. Now I am part of the Security & Technology Solutions practice within the Technology and Security Risk Services group (which is part of Risk Advisory Services). Besides the “cool corporate names”, I am now working on Security Advisory, Pen Testing and eventually Audit. I am very proud to have joined the team and I can say that E&Y have an excellent group of professionals delivering first class services! You can take a look at the group webpage at

Ok… enough “cheap marketing”…:)

I have been doing a little research on wireless. Everybody says that it is pretty easy to break WEP, and even knowing how that works I have never tried a “live” test.

I spent some time playing around with some different tools, including KisMAC (a type of wireless Swiss knife tool for MACs), airodump, aireplay and aircrack. I was a little surprised on the results.

40 bit WEP keys can be broken very easily. The main thing is that an attacker don’t need a lot of data packets (that are collected when a client is actively using the network) to perform an FMS attack (which is a statistical test that you can use to figure out the key). 128 bit key on the other hand require quite a bit of traffic. An average of 700k to 1 million packets is required. For you to have an idea, I tried to break a 128 WEP key on a Centrino 1.6Ghz 1024MbRAM laptop with Backtrack with 500k keys and 47 minutes went by without figuring out the key. The same computer took 17 seconds to find the key with 1 million packets.

AircrackHow much traffic are 1 million packets? The traffic capture was about 2,5 Gb… an attacker can either wait for the user to download the latest episode of south part over Kazaa (that will take a while – maybe a week) or have the alternative of injecting packets on the network. Injecting packets is about replaying an encrypted packet on the network and generating replies, since that packet is a valid one. These replies will be errors, but they will be “fresh” or “new” packets with new IVs, thus valid for a FMS attack. The way you do this is by using attributes as size to figure out if a packet captured on transmission is a packet prone to injection. The most common type is an ARP request, which is done for example when a client is sending a DHCP request. It has 68 bytes of size. What you do is run a tool called aireplay that listens for packets with 68 bytes of size (you can virtually try to “guess” any packets, but arp requests are a good choice because are easy to find and every request generates at least two responses – on from the DCHP and an error from the client) and, when one is captured, it replays it on the wireless network.

To “force” a client to do an arp request what an attacker can do is to spoof a deauth packet from the AP to the client. The client will disconnect from the network and connect again, generating the arp request that will be replayed. The aireplay will capture that and will replay the arp request, making both the client and the DHCP server exchange 2 packets for every packet aireplay injects on the network. You should be running a sniffer tool that can be either wireshark/ethereal or airodump to capture all this traffic. In my tests, I took almost 1h30min to generate 1 million packets.

Bottom line was: I could crack wep, but I had to use 2 laptops (one to capture the traffic – wireless card in monitor mode using airodump) and other to do the aireplay attack. The aireplay had to use a prism chipset card (I had to buy one on e-bay, couldn’t find it anywhere) to be able to reinject packets and KisMAC didn’t work…

My conclusion is that WEP is vulnerable, but you have to be fairly skilled to break it. Not that a script kiddie can’t break WEP by reading the numerous tutorials on the web, but I doubt someone that is not a geek will spend time to break in the neighbours network. We can have hackers war driving all around, but what is the point of doing that when internet access costs you so little!? You probably spend more on gas than with the internet bill…

Companies, of course, are other subject. But they can afford to have a RADIUS with decent authentication protocol running and thin APs that are manageable and upgradeable, meaning that they can upgrade to WPA/WPA2 easily.

Given those two scenarios I caught myself wondering what is the big fuzz about wireless security. My impression is that we have achieved a reasonable level of security with the latest standards… at least for now…. 😀



32 responses

15 02 2007

Good posts daniel !!!

keep it up !!!..

6 05 2007

3Des was a nightmare for my atm company at first. Converting old machines, determing if some clients were worth converting over for. But you know, in the end, this is best for the entire industry. Articles like this are great!

29 08 2007
Information security

If the goal is to crack a home network from the curb, who’s going to be monitoring the wireless network for a flood of ARPs?

Even with a corporate network, is an attack of this sort likely to be noticed? Running a spoofed mac id and pounding the network for say 5-10 seconds (to spread it out a bit), is anyone going to notice that host A seemed excessively curious about host B (at the ARP level, not at the IP firewall level?)

25 09 2007

looks like some good testing, but your conclusion that “Given those two scenarios I caught myself wondering what is the big fuzz about wireless security. My impression is that we have achieved a reasonable level of security with the latest standards… at least for now…. ” is pretty week.

WEP is not a reasonable standard for wireless security because a. it is too vulnerable to automated and commonly available attacks as you noted (sorry charlie, but an hour and a half is quick) and b. crackers probably dont do it for “free internet”. if that were the case, they would just find an unencrypted network to surf on. also, it doesnt require two machines nor does it require a Prism card unless you use very specific methods ie packet injection and real time cracking like you tested. in todays world with downloaded music/videos, rich websites, online games, DRM, spyware, large email attachments, and the like, there is plenty of data flying around on high-speed home and small business networks to get ~1million packets in a reletively short period of time (like you said, internet has gotton cheap in some places). even if it does take a week, most people don’t change their passwords- especially their router password- that quickly. if they do, they likely dont use WEP.

heres a scenario that i would bet the horse is all too common. a cracker lives in an apartment complex or a compact neighborhood (increasing signal range has been a big demand by the consumer market) and leaves their computer sniffing packets from everyone around them. over about two weeks, they have cracked a quarter of the vulnerable. after two months, they have cracked 9/10 (due to varying usage and signal strength). once they crack the password, they have two or three things- 1. the contents of all that data they’ve been storing while capturing packets. 2. access to your home network and any machines on it incl. possibly digital devices. 3. your password to your computer (if not, assuming you run windows, there are a million exploits.) now they have access to your computer all togther. use turbo tax? bummer. use websites for financial transactions or inquiry? drag.. cheating on your wife? uh oh.

when you start auditing, you will be brought through the exercise of “whats the risk”, and in this context, you should answer “intercepted data” not “bandwidth”.

11 09 2009

Hi! I was surfing and found your blog post… nice! I love your blog. 🙂 Cheers! Sandra. R.

27 04 2010

good presentation and good idea.

7 04 2012

decryt this its a wep key..

15 08 2013

“How easy is to break WEP? | Daniel’s Blog” ended up being a terrific post. In case it had even more photos it would definitely be quite possibly a lot better. Regards ,Raphael

27 09 2017
27 09 2017
27 09 2017
27 09 2017
27 09 2017
27 09 2017
27 09 2017
27 09 2017
27 09 2017
27 09 2017
27 09 2017
27 09 2017
27 09 2017
27 09 2017
27 09 2017
27 09 2017
27 09 2017
27 09 2017
27 09 2017
27 09 2017
27 09 2017
27 09 2017
27 09 2017
27 09 2017

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: