New attack cracks WEP in record time

Your home or office WiFi network may be even less secure than you think. Researchers have now shown that they can break 104-bit WEP, a common 802.11b/g/n security mechanism, in as little as one or two minutes. A team at the Technische Universität Darmstadt said that they can grab the key with a 95 percent probability of success in as little as two minutes using a 1.7GHz Pentium-M machine to do the calculations.

Here's how the attack works: in order to find the key, a would-be attacker has to have enough traffic to analyze. Therefore, the researchers forced the protected network to start generating packets. Once they have 40,000 packets to analyze, they have a 50 percent success rate in grabbing the key; an additional 20,000 packets nudges the success rate up to 80 percent. Reaching the 95 percent threshold requires 85,000 data packets. As they were able to generate 764 packets per second, they were able to hit the 85,000 mark in 1:51. At this time, the researchers' tool, aircrack-ptw (source code)—which they say is similar to aircrack-ng—does not work on 256-bit WPA.

The attack itself is nothing new. As early as 2001, researchers demonstrated vulnerabilities in the RC4 stream cipher that forms the basis for WEP. It wasn't long before 40-bit WEP was cracked; by 2004, 104-bit WEP could be broken with as few as 500,000 recovered packets.

The news here is not that WEP isn't especially secure—that fact is already well-known. What is important to note is the speed with which someone with a Centrino laptop and the proper tools can compromise a WEP-protected network.

If you want the most–secure wireless network possible, WPA2 is the way to go. It's part of the 802.11i standard, which specifies security mechanisms for 802.11 networks. Enterprise users can use an authentication server, while home or small business users can use a passphrase. Neither WPA nor WPA2 are subject to known cryptographic attacks, but WPA2 is recommended due to the additional security it offers, including support for infrastructure and ad-hoc networks, preauthentication, and the CCMP encryption mechanism.

Mozilla add-on flies the coop

Social networking tools are being integrated into every facet of our Internet lives, whether we like it or not. The latest evidence of this trend comes from Mozilla—yes, you read that right—who announced this week an experimental project that will add social tools to Firefox. "When people think of tools for social interaction, e-mail and instant messenger are at the top of their list, not web browsers," wrote one of the Mozilla Labs team members on the Mozilla Labs Blog. The lab is working to change that with a new project called "The Coop," which will allow users to share interesting links with each other through a sort of browser buddy list.

The current mockup of The Coop involves a listing of friends down the side of the web browser, complete with avatars and a listing of each friend's "recently added Flickr photos, favourite YouTube videos, tagged web sites, composed blog posts, updated Facebook status," among other things. It would ultimately serve as an aggregator for all of the web-based information about that particular friend, pulling from multiple sources to show what that person is interested in on the web at any given time. Sharing content with a friend in the list involves dragging a link, photo, video, or something else to that person's avatar in the list, which the browser will then transmit to him or her. On the receiving end, the friend will see the sender's avatar "glowing," indicating that the sender had just sent something to check out.

For now, The Coop is merely in its (very early) stages of development and is not available yet to the public to test. The blog page links to a prototype on the Firefox Add-ons page, but clicking the link currently leads nowhere. According to the product page wiki, the initial proof-of-concept of The Coop will include basic functionality such as setting up information for various services, adding friends, and support for URL dragging, with the hope of adding more functionality (such as groups and previews for received URLs) in future revisions.

WiFi (again) flies the friendly skies

When AirCell won an FCC spectrum auction last July, CEO Jack Blumenstein said that WiFi would soon be coming to a plane near you. "Receiving this exclusive air-to-ground broadband license is a historic event in the airborne telecommunications industry," he said. "In just over a year, the flying public will have the ability to use their own WiFi-enabled laptops and PDAs to communicate just like they do on the ground." The project looks to be on schedule, with deployments scheduled for early 2008. Frequent fliers will once again be able to access the Internet while in the air, a feature that US airlines have not offered for nearly a year.

The AirCell system will cover the continental US on launch, and should shortly expand to cover Mexico, Canada, and the Caribbean. It will provide DSL speeds over standard WiFi links aboard the plane, though the Wall Street Journal reports that VoIP calls will intially be blocked.

Given the prevalence of WiFi, it seems almost amazing that in-flight options are so limited. Boeing launched a service called Connexion all the way back in the dark ages of 2001, but it was costly and sometimes slow. Connexion folded last year. Wireless networking was also supposed to be a hallmark of the new Boeing 787, used for both Internet access and in-flight entertainment, but that system too was axed back in January.

Since then, times have been tough for network-addicted travelers. AirCell managed to pick up the bandwidth formerly used by in-flight phone services and has installed towers across the country that will communicate with planes that are above 10,000 feet. The system is a modified 3G cellular link between the ground station and the WiFi antenna aboard the plane. Keeping this connection alive poses a special challenge, but the company claims it is up to the task. "Obviously, connecting to a plane moving 600 miles an hour, flying up to seven miles above the Earth’s surface, requires some special technical capability," AirCell says, but notes that "AirCell’s patented airborne technology was demonstrated last year with resounding success."

The Journal says that the system is expected to cost $100,000 to install, but that airlines will recoup some of that cost through revenue-sharing agreements with AirCell.