On Sun, 28 Sep 2003, Shachar Shemesh wrote:But are you sure that you properly understand the threats? For example - do you know whether spammers break WEP encryption (with WEP, there is no question of trying - you either try and succeed, or don't try)? Do you know whether they place a sniffer and forge your MAC address? These are all very simple attacks to carry out, and I don't know whether attackers today, or tommorow, are eager enough. Also, bear in mind that the results of miscalculating the risk might be having to reinstall your broken into home computers.
Hi,
This is eactly the reason why I answered `depends on the
implementation'. There are a few ways to implement a wireless network, and
there is a set of reasonable requirements for security @home, this set is
different than the requirements on a corporate network, and yet different
than those required on a military or similar network.
Personally, I don't like Wifi for anything except a host of self protected machines.
One always needs to weigh the possible threats with what actually weI did. I arrived at the aformentioned conclusion. You may decide that the risk is lower, or that the damages lower. I don't think I have fundementally different data than you, so I can't really assess your conclusions against mine. I just hope that if you get abuse reports, you will let us all know.
are protecting, the possible damage, and counter that with the investment
we need to make, and see what is the price/"performance", and where we
draw the line.
FreeSwan. Free software.In the case of home security for WiFi, I wouldn't invest in a VPN device, be it a firewall (Checkpoint/Cisco/Netscreen SOHO) or any similar device, and add the complexity of VPN clients. Also, I don't know how Linux implements connecting to such entities.
Key exchange? What key exchange? If WEP had key exchange, it wouldn't be so #$(%&!$! broken. Well, maybe it would, who knows? In any case, WEP has no key exchange, which is part of the problem.On the other hand, I don't know how well (if at all) the Linux wireless driver supports the WiFi security module (key exchange, etc)
I don't think there is any problem with the Linux drivers supporting WEP. I just don't think WEP is good for anything., and in this case, it may be possible that while the WiFi security would be optimal for home usage, one may get pushed into using VPN due to lack of Linux support.
There are other options, but they are more annoying to implement,Yes, they are more annoying. It's a pitty, really.
including ssh tunnels for a certain set of ports, and similar stuff.
--ArielI think people here don't appretiate how broken WEP is. Please bear in mind that my memory of the WEP specs is somewhat hazy. In particular, I remeber that 14 bits are non-key (i.e. - transmitted), but it may actually be a different number.
For starters - WEP has no key distribution mechanism. You are supposed to carry a piece of paper from machine to machine and synchronize the key. In order to minimize the effort involved, some companies implement a "password", where the resulting key is a hash on the password. Unfortunetly, the 64bit version of the key has an entropy significantly lower than the stated 50 bits (14 bits are actually transmitted on the wire, and are not part of the actual key), which means brute forcing a 56bit key generated by a password is a trivial task.
Even if you managed to avoid this problem by choosing a key directly, or by using the 128 (114) encryption, things are not very good. WEP promises you the same level of privacy as you would get from a cable network. In particular, it talks about three things:
* An attacker won't be able to connect to your network. * An attacker won't be able to listen to your transportation. * An attacker won't be able to send packets.
In order to achieve that, you select a secret key (50 bits for the 64bit encryption, and 114bit for the 128 bit encryption). Your key is supplemented with a 14 bit "randomly selected" number, which forms the complete key. The data is then encrypted with RC4, and transmitted, along with the 14 bits. In order to initially connect to the network, you need to be able to pass a challange, where you supposedly prove to the base station that you know the secret key.
Guess what? Due to intrisic weaknesses in the wat WEP was designed, coupled with a bad choice of selecting the random 14 bits (in particular - starting at 0 and working your way up one by one), it is possible to do all three things (connect to the base station, listen on packets, and send your own), without ever knowing the secret key. Since the key is not needed, it doesn't matter whether you use 64 or 128 bit encryption. The packets for both look identical in the air anyways.
Not bad enough, you say? Alrighty then! Ron Rivest found that RC4 is not very strong to related keys attack. Related keys is what happens when you have several messages that were encrypted with keys that you know share a few of the bits, and you (the attacker) have the remaining bits. That's right - exactly what happens with WEP. This doesn't say much against the encryption algorithm itself. DES is not very good against related keys either. It's just that the WEP implementation is totally broken. This was followed suit with a program that collects from the air packets, and then does a rather moderate amount of processing (a few minutes), and gets the key. Due to the fact that key distribution in WEP is difficult, it's not even as if you would say "sure, I'll just replace the key every 20 minutes".
In other words - WEP is useless. If someone happens to pass by, and there are plenty of non-encrypted access points around, he is likely to use the other ones. If he is moderatly determent, he/she will likely simply break your encryption and get in. It's a pretty straight forward process.
Now, if you think the threat levels are not high enough - just use WEP. I don't know whether you are right or not. As for me - I'll pass, thank you.
I'll also give one last quote (I don't remeber who the source is, though) - "Wifi complements for it's reduced performance and higher cost by having lousy security. It shows us that the only thing that people really care about is convinience."
Shachar
-- Shachar Shemesh Open Source integration consultant Home page & resume - http://www.shemesh.biz/
================================================================= To unsubscribe, send mail to [EMAIL PROTECTED] with the word "unsubscribe" in the message body, e.g., run the command echo unsubscribe | mail [EMAIL PROTECTED]
