Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss
ALERT: WPA-TKIP isn't secure - use WPA2 instead
1 view
Skip to first unread message
John Navas
May 5, 2012, 10:29:45 AM5/5/12
to
SUMMARY:
WPA-PSK is vulnerable to offline attack.
WPA-TKIP has been cracked.
TO AVOID THESE PROBLEMS:
1. USE WPA-AES or WPA2 instead of WPA-TKIP (or WEP)
2. USE A PASSPHRASE WITH MORE THAN 20 CHARACTERS. Examples:
BAD: "vintage wine"
GOOD: "floor hiking dirt ocean"
(pick your own words, even longer is better)
FOR HIGH SECURITY, USE MORE THAN 32 CHARACTERS.
BACKGROUND:
Weakness in Passphrase Choice in WPA Interface
<http://wifinetnews.com/archives/002452.html>
Practical attacks against WEP and WPA
<http://dl.aircrack-ng.org/breakingwepandwpa.pdf>
A Practical Message Falsi cation Attack on WPA
<http://jwis2009.nsysu.edu.tw/location/paper/A%20Practical%20Message%20Falsification%20Attack%20on%20WPA.pdf>
New attack cracks common Wi-Fi encryption in a minute
<http://www.networkworld.com/news/2009/082709-new-attack-cracks-common-wi-fi.html>
Passphrase Flaw Exposed in WPA Wireless Security
<http://www.technewsworld.com/story/32070.html>
Cracking Wi-Fi Protected Access (WPA)
<http://www.ciscopress.com/articles/article.asp?p=369221>
<http://www.ciscopress.com/articles/article.asp?p=370636&rl=1>
Cracking WEP and WPA Wireless Networks
<http://docs.lucidinteractive.ca/index.php/Cracking_WEP_and_WPA_Wireless_Networks>
WPA-PSK is vulnerable to offline attack.
WPA-TKIP has been cracked.
TO AVOID THESE PROBLEMS:
1. USE WPA-AES or WPA2 instead of WPA-TKIP (or WEP)
2. USE A PASSPHRASE WITH MORE THAN 20 CHARACTERS. Examples:
BAD: "vintage wine"
GOOD: "floor hiking dirt ocean"
(pick your own words, even longer is better)
FOR HIGH SECURITY, USE MORE THAN 32 CHARACTERS.
BACKGROUND:
Weakness in Passphrase Choice in WPA Interface
<http://wifinetnews.com/archives/002452.html>
Practical attacks against WEP and WPA
<http://dl.aircrack-ng.org/breakingwepandwpa.pdf>
A Practical Message Falsi cation Attack on WPA
<http://jwis2009.nsysu.edu.tw/location/paper/A%20Practical%20Message%20Falsification%20Attack%20on%20WPA.pdf>
New attack cracks common Wi-Fi encryption in a minute
<http://www.networkworld.com/news/2009/082709-new-attack-cracks-common-wi-fi.html>
Passphrase Flaw Exposed in WPA Wireless Security
<http://www.technewsworld.com/story/32070.html>
Cracking Wi-Fi Protected Access (WPA)
<http://www.ciscopress.com/articles/article.asp?p=369221>
<http://www.ciscopress.com/articles/article.asp?p=370636&rl=1>
Cracking WEP and WPA Wireless Networks
<http://docs.lucidinteractive.ca/index.php/Cracking_WEP_and_WPA_Wireless_Networks>
Arklin K.
May 21, 2012, 12:45:16 PM5/21/12
to
On Sat, 05 May 2012 14:29:45 +0000, John Navas wrote:
> WPA-PSK is vulnerable to offline attack.
> WPA-TKIP has been cracked.
Hi John Navas,
> WPA-PSK is vulnerable to offline attack.
> WPA-TKIP has been cracked.
I don't know you but you seem to be crontabbing alerts so you might want
to consider making an alert for the WPS vulnerability which negates all
other security on all wi-fi certified routers.
Details here:
http://www.kb.cert.org/vuls/id/924307
Arklin K.
May 21, 2012, 12:46:37 PM5/21/12
to
0 new messages