

WPA2 wireless security cracked - npongratz
http://www.sciencedaily.com/releases/2014/03/140320100824.htm

======
coreymgilmore
Wireless networking is/has always had potential for infiltration. It is
inherent since the signal is broadcast out without any regard to who is
listening. This security flaw, using brute force, is a good, if slow, way to
exploit the open nature of WiFi. They do not specify any timing for breaking a
psk so I assume this isn't very fast. And the article doesn't state if the
brute force can only be attempted while the back door is temporarily open.
Security threat yes. How long to break, who knows.

A great reason to use wired when you can!

~~~
sown
I've wondered about using SSH socks proxy on my devices to help get around
this. Even if they break WPA2 they'd deal with SSH traffic only.

For example, it seems reasonable that I could have my laptop or phone use a
ssh tunnel and it can only go to my wireless router. The router will only
accept SSH traffic with a certificate and route traffic to an SSH somewhere on
my wired network, or from the router itself.

At work I do something similar. I setup a firefox profile (firefox
-ProfileManager -no-remote) to use SOCKS proxy on some port and setup SSH to
connect to an EC2 instance I have lying around (ssh -i cert.file
ec2-user@ec2.machine -ND 8888). This way I can browse sort of in private. :p

FYI: Some sites like craigslist or redfin reject ec2 traffic.

~~~
noonespecial
This is a perfect use case for openvpn. I use it whenever I connect to a
public wifi to spare me worrying about how secure it may or may not be.

------
thaumaturgy
I'm confused; I thought this was a known flaw in WPA2 (see e.g.
[http://www.aircrack-ng.org/doku.php?id=cracking_wpa](http://www.aircrack-
ng.org/doku.php?id=cracking_wpa)). Can anybody explain what's new about this?

~~~
loucal
yeah, this is interesting to me as well. I first heard of this method about a
decade ago. The bibliographic info says:

Achilleas Tsitroulis, Dimitris Lampoudis, Emmanuel Tsekleves. Exposing WPA2
security protocol vulnerabilities. International Journal of Information and
Computer Security, 2014; 6 (1): 93 DOI: 10.1504/IJICS.2014.059797

I got on the Inderscience website to see what they charge for a subscription
to this journal, but when I clicked the 'Subscription Price' link it hung, and
now the whole site is strangely down for me...

Perhaps expensive journals are having trouble finding original content in our
culture of openness?

~~~
r-u-serious
> Perhaps expensive journals are having trouble finding original content in
> our culture of openness?

Apparently: [http://www.nature.com/news/publishers-withdraw-more-
than-120...](http://www.nature.com/news/publishers-withdraw-more-
than-120-gibberish-papers-1.14763)

~~~
loucal
yeah, its back up, a year of just that journal costs 706 Euros = 959.45 USD
currently. Wow.

------
gaelow
Behold! Some "researcher" just updated his Wifiway for the first time in the
last 2 years and realized it comes now with a `crack WPA2` feature! "What's
this all about?" He asked to a couple of fellow "researchers". "Oh yeah, it
seems we can capture the handshake and try to bruteforce the PSK now. And
there is a couple of deauth attacks to force the handshake too!" Now the two-
step get-rich-quick scheme, as a fellow slashdot user commented, comes to
play:

(1) Publish Paywalled Article Exposing Security Holes in Commonly-Used
Security Protocol

(2) Profit!

------
vicaya
Is this something new or the good ole' hole196?

[http://arstechnica.com/business/2010/07/wifi-
hole196-major-e...](http://arstechnica.com/business/2010/07/wifi-
hole196-major-exploit-or-much-ado-about-little/)

------
adenner
Are there any wifi standards that are actually "secure" that are available for
soho users? (Short of the ssh/open VPN solution)

------
yuhong
Deauth is a not a new attack.

