WepAttack and Void11

[jetcyc]

Hi,

Do you think WepAttack and Void11 poss a serious threat to WLAN?

Any solution to reduce the risk from these tools on WLAN?

[blackwave]

Re: WepAttack and Void11

Originally posted by jetcyc
Do you think WepAttack and Void11 poss a serious threat to WLAN?

No, why would it? Especially with fw updates and new and different technologies being pursued, things are changing quickly enough to stay ahead of the exploit curve for anything that "matters". There is a certain difference from something being annoying, and something being a serious threat.

Originally posted by jetcyc
Any solution to reduce the risk from these tools on WLAN?

Sure, upgrade your fw, stick with technologies that aren't as vulnerable, join mailing lists, learn to configure your ap and network... there are lots of things one can do to avoid these tools from exploiting them.

http://wepattack.sourceforge.net/
WepAttack is a WLAN open source Linux tool for breaking 802.11 WEP keys. This tool is based on an active dictionary attack that tests millions of words to find the right key. Only one packet is required to start an attack.

http://www.wlsec.net/void11/
A free implementation of some basic 802.11b attacks.
Features:

deauth (Network DOS) (flood wireless networks with deauthentication packets and spoofed BSSID; authenticated stations will drop their network connections)
auth (Accesspoint DOS) (flood accesspoints with authentication packets and random stations addresses; some accesspoints will deny any service after some flooding)
Apple Airport aka "UFO" died after ~60sec flooding for about 15min.
Lucent OR1000 survived with minor problems.
OpenBSD 3.1/3.2 HostAP freezed after some flooding.
Linux HostAP driver survived ;-) (max. 1023 authenticated stations).

[jetcyc]

Both tools are exploiting flaws in WEP and management frame

With WEPCrack, a certain number of packets are required before the WEP key can be broken.
However, WepAttach is able to crack WEP key using dictionary with only 1 packet captured. If WEP is used then I do not think there is any patch to this.

With Void11, the management frame do not require authentication before accepting deauth and authen. This is a flaw in th protocol design. Wonder is there any patch to this?

[blackwave]

Originally posted by jetcyc
Both tools are exploiting flaws in WEP and management frame

Can you give examples of what you define as posing a serious threat to WLAN that is not purely academic?

A 30MB wordlist is used for the attack. The decryption of WEP keys is only possible if the key is contained in the dictionary (or at least part of).

... this states that if the wep key is contained in a the dictionary it can be cracked... someone in a semi-secure environment certainly wouldn't be using simple dictionary words.

flood wireless networks
...
flood accesspoints

These are more annoyances than anything else. Why? because they have limited range. It isn't at all like a wired network where these attacks could be launched from BFE... no the attacker has to be within a certain distance, and the further distance they are away the easier they are to locate because of the power they are generating over the larger distance.