Re: WEP, Why are we bashing it?

From: Mac Mason <mac@cs.hmc.edu>
Date: Thu Jul 01 2004 - 20:16:37 AKDT

Well, most of my bashing is a result of not liking the idea of an
encryption standard that's time-dependant; especially if my AP is going
to be turned on most of the time (as one of mine would tend to), then
it's possible for it to be cracked. Therefore, I don't like it.
By way of example, what if you had to stop and restart an ssh session
every few hours in order to avoid it being broken into?
    --Mac

On Thu, Jul 01, 2004 at 07:08:30PM -0700, Wesley Brown wrote:
> Hello all,
>
> I have been keeping up with the discussion of wireless networking for awhile and I am somewhat concerned. Everyone keeps insinuating or flat out saying that WEP is not worth a spit as far as encryption on wireless. I have read the whitepapers on this and I understand the concept behind its weakness. I have also played around with the tools used to capture wireless traffic and crack WEP. In my experience and with my research on the web, capturing enough packets to crack a 128bit WEP is an exhausting experience. After 14 hours of sniffing my own wireless network I had maybe two percent of what I needed to crack the key. I wasn't slacking either, I was downloading distros and surfing the web the whole time on another laptop.
>
> From my understanding it takes a great deal of time to crack WEP even from a massive wireless network (multiple users online at once).
>
> However, I have one case I would like to share with everyone. I have a friend, someone I work with in the Army and he came to me one day with his problem. He had a wireless router and it was encrypted. Suddenly one day he noticed that his speeds were considerably slower so he checked his router. There in the DHCP table was a line assigning an IP to a computer that was not his. This computer name was in Arabic or someting AND his neighbors were Middle Eastern. I guess they found his WAP and set up a computer to capture enough packets to crack the WEP. I am sure this had to take close to a week, but we can never be sure.
>
> I would love to hear other peoples experiences, maybe I will change my mind about WEP. But I really don't think that a wardriver is going to invest the time to crack my WEP when he could drive down the street and access an open one with no problem. I recommend a multifacited solution to wireless security... Don't broadcast your SSID, do MAC filtering, no DHCP, and WEP encrypt. Plus if you make it uncomfortable for someone to hang out outside your home they won't, hence no wardrivers.
>
> Just my two cents.
>
> Wesley Brown
>
>
> ---------------------------------
> Do you Yahoo!?
> New and Improved Yahoo! Mail - 100MB free storage!
>
> ---------
> To unsubscribe, send email to <aklug-request@aklug.org>
> with 'unsubscribe' in the message body.
>

-- 
Julian "Mac" Mason                            mac@cs.hmc.edu
Computer Science '06                          (909)-607-3129
Harvey Mudd College
-- Attached file included as plaintext by Ecartis --
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (SunOS)
iD8DBQFA5OGj1AphoTGXiN0RAk96AJ4jdF9s4gupRq3mgGXPMBprC8Z6cACeNX2y
9CJ7xWPBAYbgDACH/0Ni2KI=
=Gnnu
-----END PGP SIGNATURE-----
---------
To unsubscribe, send email to <aklug-request@aklug.org>
with 'unsubscribe' in the message body.
Received on Thu Jul 1 20:16:40 2004

This archive was generated by hypermail 2.1.8 : Thu Jul 01 2004 - 20:16:42 AKDT