Different Types of Attack
Chapter 4 provides an
overview of the different types of attack that a Wi-Fi LAN must defend against.
Some types of attack are quite obvious, but many are subtle and done in
unexpected ways. These subtle attacks are the most dangerous because they
exploit our assumptions about where the vulnerabilities lie. We focus on attack
concepts. Later, in Chapter
15, we provide a much more detailed and technical analysis for certain known
attacks that have been successful against early Wi-Fi systems.
As we build our defenses, it is important to understand the
types of attack we may encounter. The technical approach of an attack can vary
from crude to sophisticated, but the fact that an attack is crude doesn't make
it ineffective. For example, if someone steals your laptop while it is logged
onto the network, they have made a successful, albeit crude and detectable,
security attack. More sophisticated methods of attack, however, allow an
attacker to gain access without being detected—and these methods are more
dangerous. Detecting a security breach is a close second in importance to
preventing the breach. For example, if a security breach were detected
immediately and appropriate responses taken, service might be disrupted but the
damage might be considerably reduced. By contrast, if an intruder were allowed
to break in multiple times over an extended period, the consequences could be
catastrophic. The smarter the attacker is, the more careful they will be to
avoid detection.
Classification of Attacks
Attacks can be classified into four broad categories: snooping,
modification, masquerading, and denial of service. In practice, an attack may
employ several of these approaches. Almost all attacks start with snooping, for
example.
|
More formally, attack methods are classified as "passive" and
"active." Passive attacks include eavesdropping. Active attacks are subdivided
into "forgery," "message modification," and "denial of service." We use a
simpler list of four categories for use in the explanations
here. |
Snooping, as the name
suggests, is simply accessing private information. This information could be
used for an advantage, such as getting company secrets to help your own business
or stock purchase decisions. It could also be used for active assaults such as
blackmail. Encryption can be used to make snooping difficult. The attacker is
required either to know the secret encryption key or to use some clever
technique to recover the encrypted data.
Modifications to data can be
achieved in some nonobvious ways. When thinking about modification attacks, most
people consider an attacker modifying e-mails with malicious content or changing
the numbers in an electronic bank transfer. While such high-level modifications
have been accomplished, there are more subtle ways to modify data. For example,
if you can intercept a wireless transmission and change the destination address
field (IP address) on a message, you could cause that message to be forwarded to
you across the Internet, instead of to its intended recipient. Why would you
want to do this? Because the message on the wireless link is encrypted and you
can't read the content, but if you can get it forwarded across the Internet, you
will receive the decrypted version. The IP header is easier to attack because it
is a known format.
Masquerading is the term used
when an attacking network device impersonates a valid device. It is the ideal
approach if an attacker wants to remain undetected. If the device can
successfully fool the target network into validating it as an authorized device,
the attacker gets all the access rights that the authorized device established
during logon. Furthermore, there will be no security warnings. Even an
eagle-eyed IT manager scanning the traffic records won't see anything amiss
unless the attacker does things that a normal user wouldn't do, such as trying
to access system areas. There are, of course, nonelectronic attacks based on
masquerading that are equally effective—if you leave your terminal logged in and
go to lunch, anyone can sit down and get your access rights. It is the same
principle.
Denial of service (DoS) is
quite unlike the other three categories both in technique and goals. While the
other three extend extra privilege to the attacker, a DoS attack usually blocks
out everybody, including the attacker. The object of a DoS attack is to cause
damage to the target by preventing operation of the network. In 2000 the largest
attack yet publicized occurred with a distributed DoS attack against several
major Web commerce sites. The attack blocked access to the sites for hours. This
attack originated from thousands of remotely controlled computers throughout the
world whose owners were largely unaware of their participation. The attackers
used these "zombie" computers to generate large amounts of traffic directed
toward their victims, preventing them from servicing valid requests. Why did
they do it? Perhaps to gain bragging rights—this is classic ego hacking culture.
A more sinister reason might be to gather experience and data for some larger
future event.
In principle, DoS attacks could be mounted for commercial
reasons. Bringing down a sales Web site in the run-up to the holidays could
inflict financial damage on a competitor. However, it is unlikely that any
serious retailer has actually used such tactics. An attack by an ex-employee
with a grievance is more plausible. DoS attacks are hard to prevent on the
Internet and usually rely on causing the receiving server to exhaust its buffer
resources so it cannot accept any valid connections for a period of time.
Unfortunately for us, DoS attacks on Wi-Fi LANs are easy to mount and almost
impossible to prevent.
The enemy can successfully use some of these attacks without
having access to your secret network keys. However, in most cases the damage
that can be done without knowing the keys is quite limited. If the attacker
can find out your keys, then you move into a
different category of danger. Unauthorized modifications to Web sites and the
stealing of databases full of credit card details occur because someone has
broken the keys. As we look at the types of attack that can be made against
Wi-Fi LANs, we'll consider these cases separately: first, attacks against the
network without the keys, and second, attacks to try to uncover the keys
themselves.
Attacks Without Keys
Getting the keys is the ultimate success for an attacker, but
it's surprising how much information can be obtained without ever needing to
compromise the keys. In some cases it's possible to completely breach security.
In this section we look at a few of the activities attackers might perform as an
alternative to key attacks.
Snooping
First, consider snooping. Let's imagine you are an attacker
within range of your target—a Wi-Fi LAN that is using secret keys and hence is
encrypting messages in some way. Let's also assume you have a modified Wi-Fi
card designed to intercept data. You have a lot of knowledge about IEEE 802.11
protocols as well as higher-level protocols like TCP/IP. "You" may be a very
clever person with a PhD in communications…or in this context, "you" may be a
sophisticated program running on the laptop of a total moron. Either way, the
question is, what can be seen?
First of all, you can see and read all the information coming
from the access points. Therefore, you know the network name (or SSID).
If the network name is something obvious like "accounts_department," you can get
an idea of what the users on the network might be doing. You have most likely
identified the manufacturer of each access point by looking at its MAC address,
and you may even know the model number based on the capabilities or proprietary
information that each includes in its beacons. If that model has any hidden
flaws, that information might be useful. Some security advisers propose
disabling SSID broadcasts; but while this step may reduce "war driving" attacks
(see Chapter 3), it
provides only a short-term advantage, as the information will be discovered as
soon as a new user connects to an access point.
As an attacker, you may also see quite a bit of data going to
and from an access point. By watching for a while, you will be able to count how
many wireless devices are connected to each access point (just by looking for
different MAC addresses). You will also be able to identify the manufacturer of
the wireless adapter in each case from the first three bytes of the MAC address.
If the network is using WEP, you might be able to see whether everyone is using
the same key (shared) or whether each device has a separate key by looking at
bits in the IEEE 802.11 header. That information could be useful later.
So far, it has been easy. But when you capture any of the data
packets, you cannot interpret them because they are encrypted. We are not
considering attempts to decrypt the packets here because that is an attack on
the secret key and is covered in the next section. So if you are not going to
try to crack the code, can you do anything useful?
You can, using a technique called traffic analysis. Traffic analysis is the study of message externals,
for example, frequency of communication and size. So, the first thing is to
watch the size of the packets. You should be able to identify which protocol
they are using by checking the length. For example, certain TCP/IP messages,
such as acknowledgment frames, have a fixed length and occur with a typical
regularity. This applies to other protocols, too, so the length of the packets
can tell you the network protocol in use. Let's suppose it is TCP/IP. You can
look out for messages such as DHCP discover messages that are used to give IP
addresses to the network.
You can also get information from the timing of messages. By
watching messages go to the network from a user and timing when messages come
back, you can probably guess whether that user is browsing the Web or working on
a local server. Even the amount of data being sent around might give a clue as
to what is happening. For example, a sudden increase in activity might mean that
the payroll is being prepared or that a shipment is being prepared.
Unfortunately, it is possible to learn a whole lot about the types of things
going on in a network just by watching packet lengths and noting timing without
looking inside the packets. However, you cannot see anything really useful, such as the message content. Like the
voyeur watching the neighbor's window when the blind is down, you'll see shadows
that tell you whether someone is "in the room," but nothing more.
So, by itself, snooping an encrypted LAN can only provide
information about how, when, and by which devices the network is being used.
This information by itself is of limited use; but combined with other
information the attacker might gain from other methods or sources, it can be
very helpful. So now let's look at the prospects for combining snooping and
modification.
Man-in-the-Middle Attack (Modification)
Suppose two people are communicating—traditionally in security
literature, they are called Alice and Bob. Alice receives messages from Bob and
Bob receives from Alice. Suppose there is an attacker able to intercept and cut
off the communications. Suppose that the attacker can imitate Bob while sending
to Alice and imitating Alice while sending to Bob. In this case Alice and Bob
are subject to a "man-in-the-middle" attack, as shown in Figure 4.1. Such attacks can be used to modify messages in
transit without detection.
There are (at least) two ways to modify a message: you can
modify it on the fly or you can capture, modify, and replay the message, a
technique known as store and forward.
Modification on the fly is really hard. You would need to send a burst of radio
transmission at just the right moment to cause the receiver to interpret a bit
incorrectly. Because of the sophisticated modulation used in Wi-Fi LANs, bits
are not sent individually but in groups coded together, making it very difficult
to change a single bit at a time. Therefore, we will, for the moment, assume
that any modification occurs due to a store-and-forward approach by the
attacker; on-the-fly modification might be possible in theory, but we won't
cover the topic any further.
The store-and-forward method is called a man-in-the-middle
modification attack. The principle is simple enough in wired networks: an
attacker cuts the wire, receives all the data, and is careful to send it on so
the two devices at the ends don't know their data is being intercepted. There
is, for example, a man-in-the-middle attack possible at every forwarding router
in the Internet, which is one reason the Internet is treated as totally
insecure.
In Wi-Fi LANs a man-in-the-middle attack is a little more
difficult to mount because there is no wire to cut. The enemy must stop the
receiver from getting the message on the initial transmission so he can then
forward it after exercising his evil intent. The procedure could work something
like this. To become a man-in-the-middle between mobile device (Mob) and the
access point (AP), the enemy must:
-
Listen for a message from Mob to AP.
-
Read in the message up to the checkword at the
end.
-
Transmit a sudden burst of noise to corrupt the checkword—this
causes AP to drop the message as invalid, but the attacker now has a copy of the
valid message.
-
Forge an acknowledge message with AP's address and send it to
Mob; now Mob thinks the message has been received by AP.
-
Recalculate the correct checkword and send the captured message
to AP; AP thinks it came from Mob.
-
Wait for an acknowledgment message from AP and send a burst of
noise so Mob ignores it and doesn't see two acknowledgments for the same
packet.
Clearly, this procedure is not simple, but it is absolutely
feasible and would effectively put the attacker in the middle of the
communications. Neither the access point nor the mobile device would have any
idea that the communications were intercepted.
Another approach—and one that is much more likely to
occur—would be for the enemy to set up a bogus access point. The bogus AP
identifies a real AP in advance. When an unwitting mobile device sees the bogus
AP and tries to associate, the bogus AP simply copies all the messages it
receives to the valid AP, substituting its own MAC address. Similarly, it copies
all the messages received from the good AP back to the mobile device. By this
method, it doesn't need to know the encryption keys because the MAC address
fields that it modifies are not encrypted. As a result, all the data between the
mobile device and the good AP goes through the bogus AP en route.
Once the enemy is established in the middle of a communication,
he has the opportunity to mess with the data. Remember that this intervention is
possible even when the data is encrypted and without the enemy knowing the
secret keys. The question is, what can modification achieve without the attacker
knowing the keys?
There is really very little that can be accomplished by
modifying individual messages, unless you have some knowledge about the contents
of the messages before they were encrypted. The enemy has some information about
most packets because the TCP/IP header has a fixed format and some of the fields
have fixed or obvious values (such as the length field). The attacker might like
to modify the destination IP address to try to get the data sent out over the
Internet (to him). This is a really hard attack to accomplish, however, and it
is quickly detected by the sender because it would be hard (but not impossible)
to get a response back.
More can be achieved if the attacker is allowed to replay captured messages. For example, suppose the
attacker spots an ICMP message going from the mobile device to the network
server. An ICMP message is a short
administrative message sent between devices in a TCP/IP network. The attacker
could guess what the ICMP message type is from the length. Many ICMP messages
require a response from the server that the enemy will also see (although it is
still encrypted). Remember that the enemy can't read either message but can make
an educated guess at much of the content. Furthermore, if the enemy can send the
same encrypted ICMP message again, the server might come back with a response
every time—thinking it came from the valid device.
Now the attacker can play games. The ICMP message contains a
checkword. If the attacker changes a single bit and resends the message, after
decryption the checkword will indicate an error and the message will be thrown
away. The attacker will notice that there was no reply from the server. So what
if the attacker can modify both a data bit and some of the checkword bits? If he
is allowed to try over and over, maybe tens of thousands of times, eventually
the enemy will find a combination that gets a response from the server again. By
playing this game, an attacker could eventually decode the message. At the end
of several hours, he has found out the IP address of the mobile device and the
server. For a fuller description of this attack, see Borisov et al. (2001).
Although this is a potentially successful attack, it's no big deal. A lot of
work would be required for a relatively small amount of information. However,
even a small crack cannot be considered acceptable in a security system. As in a
dam wall, small cracks can lead to real breaches and eventually the collapse of
the system.
Active attacks are sometimes difficult to carry out, and they
run the risk of being detected. Nonetheless, against some systems, WEP being one
of them, active attacks can accomplish a great deal for the attacker. However,
the new security methods of WPA and RSN are resiliant to such attacks. This is
one reason why most attackers will try to get the keys. With the exception of
DoS attacks, attacks without keys are generally used only as a step toward
determining the keys. Once an enemy has the keys, your only hope is to detect
the intruder, shut down the network, and change the lock.
Attacks on the Keys
The problem with keys in general is that there are so many ways
to get at them. Let's take a simple case of a burglar who wants to break into a
bank vault. The walls are thick steel and so the burglar has concluded that the
only viable way in is through the vault door, which needs a key. What are the
options? Well, here are a few:
-
Find where the key is stored and steal it.
-
Get a job in the bank and finagle a few moments of access to
the key; make an impression to copy later.
-
Point a gun at the manager and make him unlock the vault.
-
Make lots of different keys and try them all.
-
Pick the lock.
The list goes on, and a real burglar would have a few more to
suggest as well. All of these attacks have an analogy in Wi-Fi LAN security, and
by no means do they all involve clever cryptography. Let's get the most obvious
one out of the way first. The simplest way to get a key is to look over the
shoulder of a person as she enters a password or simply to ask a disgruntled
employee to tell you. It is well known that thieves are able to observe and
remember sequences of digits typed into a phone when a victim uses a calling
card. This is a problem whenever you expose your key information to people.
Humans are a weak link in security.
One solution is to keep the keys inside the computer and not
visible to the human operator. The problem with this approach is that, if the
computer is stolen, the key goes with it and the thief can get access by
masquerading as the valid user until the theft is discovered. In general, the
best protection comes from choosing good passwords and changing them
regularly.
One-Time Passwords
A clever solution that avoids human weakness is the use of the
one-time password. As the name suggests, the
idea is that each and every time you log on or connect, you use a new
password—hence each password is only used once. In a typical case, the user has
a credit card-sized gadget that displays a set of digits. The display changes
once per minute to a new number. Back at headquarters is a special server,
running off an accurate clock, which knows which number is being displayed by
the card at any point in time. When the user logs on, she types in the number
currently displayed and the server checks that it is valid. However, five
minutes later, if the same password is entered, the server will reject it. The
idea is that the password, if memorized, is of very limited value and the card
stays with the user even if the computer is stolen—quite a clever system.
One-time passwords incorporate a concept called liveness that
is vital to good security. Liveness is simply
the inclusion of something that changes in time so you can detect whether
someone is using old (and hence probably copied) information.
Burying the Keys
If you try to hide the key information from the user, it is
still vulnerable to eventual discovery by a sufficiently dedicated attacker.
This is particularly true if the enemy has physical access to the equipment
where the key is stored. For example, if the enemy can take a laptop home and
work on it, and if he has sufficient technical skills, he can probably get the
key, no matter how deeply it is buried in the software or hardware of the
device. As an example, a large corporation in the United States had Wi-Fi
wireless LAN adapters custom-made so the WEP key was programmed into the flash
memory of the adapters before shipment and was never visible to the software on
the computer. Despite this precaution, eventually someone was able to
reverse-engineer the key value and publish it on the Internet. At that moment,
the security of all the cards the company possessed plummeted to nothing.
Another example involves the cracking of the password on a
mobile phone SIM card (Kocher et al., 1999). SIM
cards are thumbnail-sized smart cards used in European and some U.S. cellular
phones. The benefits of a smart card are its self-contained memory and built-in
microprocessor. Therefore, the key can be stored inside and is not accessible
from the outside. When you want to check whether a password is correct, you send
it to the microprocessor in the card. The microprocessor does the check and
simply tells you "correct" or "incorrect." It would seem an ideal solution
because no one, including the manufacturer, can read the password once it leaves
the factory. And yet attackers did find several ways to crack the passwords.
In one particularly clever approach, they obtained a copy of
the program that the little microprocessor used. They had realized that the
specific instructions that the processor executed depended on the value of the
password. When the password byte presented was correct, it took one path; and
when it was wrong, it took another. Astonishingly they realized that they could
guess which type of instruction was being executed simply by carefully measuring
the electrical current consumption used by the smart card. This meant they could
try each byte of the password one at a time until they saw the card perform the
"equal" test. It was like cracking a ten-digit combination lock when the lock
beeps every time you enter one digit correctly. They cracked the code in very
little time. Now, of course, smart cards have been modified so the instruction
operation is not signaled by the current consumption, but this story once more
illustrates the ingenuity of attackers.
A third example when burying the key failed concerns the
protection of DVD movies. To stop people from reading DVD movies into their
computers, the contents on the discs are encrypted. However, a DVD player
obviously has to know the keys in order to decrypt and play the contents.
Therefore, each DVD manufacturer has to sign up to very tough licensing
restrictions, and those who have access to the encryption key must use special
care to keep it safe. Did this work? No. As you might expect, only a couple of
years passed before programs appeared that could decrypt a DVD. A Finnish
teenager reverse-engineered a ROM chip from a DVD player and determined not only
a valid key but also the previously unknown proprietary encryption algorithms.
There is little the industry can do now because they can't change the key
without making obsolete millions of consumers' DVD players. They have resorted
to taking aggressive legal action against anyone who tries to distribute the
program (Salkever, 2000).
One of the main lessons of these examples is the well-known
security policy that you should change the master keys from time to time. We
will discuss how often is appropriate in the later section on network
configuration.
Wireless Attacks
Most of the things that have been said so far about protecting
keys apply regardless of the type of security system you are using. They are not
specific to wireless. Wireless, of course, introduces a whole new set of
opportunities for attackers trying to get keys because it is so easy to access
the data streams, even though they may be encrypted. Imagine a hacker ten years
ago, before the advent of wireless LAN. The hacker would like to get access to
the network inside a corporation. It's very risky because access to the building
is restricted; and even after the attacker got inside, there would be limited
time to sample the data. "Wouldn't it be great," the hacker dreams, "if I could
get in there and install a radio transmitter that sent all the data outside,
where I could pick it up in safety." Today, not only has the hacker's dream come
true but also someone else (the corporation) has already bought the equipment
and installed it! Life's not usually like that.
The problem for the attacker is that the data is encrypted and
she needs the keys. Assuming you don't change the keys, she has as much time as
she wants to capture sample messages and analyze them. What to do next?
First, let's look at a couple of assumptions we need to make
about what the attacker knows. To do this, we need to introduce some common
terms:
-
Plaintext: The data before
encryption—this is what we want to protect
-
Ciphertext: The encrypted
version that the enemy can see over the radio link
-
Keys: The secret value that is
used to encrypt/decrypt the message
-
Cipher: The algorithm and
rules used to perform the encryption and decryption
To summarize, the ciphertext is created by processing the
plaintext with the ciphersuite using the keys (see Figure 4.2). This process is sometimes written as a
formula: Ciphertext = Cipher (Key, Plaintext).
Okay, coming back to our attacker. We know that she has a copy
of the ciphertext because that can be snooped directly. We know that she doesn't
know the key because getting it is her objective. What about the cipher and the
plaintext?
One of the rules of modern cryptography is that you should
assume that the attacker knows the algorithm used for encryption. Most attack
methods rely on finding weaknesses in the underlying algorithm or in its
implementation. If, however, the attacker does not know the algorithm, an attack
is almost impossible. So it might seem that keeping the algorithm secret is a
good idea. This type of thinking, also known as security by obscurity, has been adopted in some
security systems. For example, the encryption algorithm used in most European
cellular phones is a secret and may be different from one mobile phone operator
to another. However, security experts feel that keeping the algorithm secret is
a bad idea for (at least) two reasons:
-
It is impossible to keep a secret forever, no matter how hard
you try. People have to know the algorithm in order to implement it, and sooner
or later someone will be bribed, get drunk at a crypto conference (yes, it could
happen), or have their laptop stolen. Sooner or later, the secret will come out,
and the bad guys might get the secret. That leaves all of us users vulnerable
without knowing it.
-
The other disadvantage of keeping the cryptographic algorithm a
secret is that this approach doesn't allow legitimate researchers to look for
flaws. If there is a flaw, it is better that a researcher finds it and alerts
everyone before an attacker finds and exploits it. The weaknesses of IEEE 802.11
WEP were found and publicized in this way. The equipment manufacturers may not
be pleased by such publication. They tend to argue that it is better to keep
flaws quiet and fix them in the background. However, this is a dangerous
approach—you can be sure that if only 1% of people know about the flaw, the
hacker community is included in the 1% along with the manufacturers. So by
publication, the public is well served.
So, now we are assuming that the attacker knows the ciphertext
and the cipher. Does she have the plaintext? This might seem like a silly
question because if she has the plaintext, why does she need to crack the code
at all? However, consider that the objective is not to crack a single message;
it is to get the keys so every message can be
read. The hacker may know the plaintext of a single message and use that to
attack the keys. So let's ask that again—could the enemy get a sample of the
plaintext?
In fact, there are quite a few ways in which this might be
done. The first way has already been mentioned: protocol headers. In IEEE
802.11, the MAC header is not encrypted, but all the rest of the message is (for
more discussion, see Chapter
5). If you are using a protocol such as TCP/IP, this means that the header
portion of the TCP/IP message is part of the plaintext that is converted to ciphertext. The danger is that the header always occurs
in the same place (at the start of the packet) and that some of the fields have
fixed values, or values that can be easily guessed. This means that an attacker
immediately has some knowledge about the plaintext. Furthermore, some IP
messages are of a known format, such as DHCP discover messages used in assigning
network addresses. These are encrypted but can be identified from their length.
In these cases, an attacker might correctly guess the entire plaintext.
It gets worse! If a person is accessing a Web site, and the
attacker can guess which Web site, he can get the plaintext just by going to the
same site. Suppose that someone goes to a popular news Web site. The home page
is downloaded and sent encrypted across the wireless link. If the attacker can
correctly guess which frames are which, he has the plaintext as well as the
ciphertext. Guessing which frames are which is not as hard as you might think
because the number of bytes in certain parts of the home page, such as pictures,
provides a clue. The last method for getting plaintext is the simple approach of
sending e-mail. If an attacker knows the e-mail address of a user at the target,
he could send the user a message that at some point might be read. The attacker
has a chance to identify when his message is read from the length.
Alternatively, the e-mail might persuade the user to click a link to the home
page of a Web site that the attacker knows.
Because there are so many ways for attackers to guess or obtain
samples of plaintext, we have to assume that they can obtain all three
components: the ciphertext, the plaintext, and the cipher. Once they have all
three, they can start an attack on the keys.
Attacking the Keys Through Brute Force
The first thing anyone thinks about when it comes to working
out the keys is the brute force attack. We'll look at this because the
statistics are fun. Basically, the brute force
method means that an attacker tries every possible key until he finds a
match. Given that he knows the ciphertext and protocol, he would start with a
key value of all zeros, decrypt the message, and see whether it matches the
plaintext (or any fragments he has). If he keeps adding 1 to the key value, in
principle, he will sooner or later hit on the right key because all possible
keys will have been tried. Well, "sooner or later" is probably "later or never" in any real encryption system. In fact, if an
attacker felt lucky enough to stumble on the key this way, he should buy a
ticket for the state lottery. The odds of winning are considerably higher for
the lottery.
The time taken for a brute force attack depends on the key
size, or more correctly the key entropy (see Chapter 2). This is one of the reasons that
government export controls tend to be set according to key length. For example, it used to be that you could
not export any security technology from the United States with a key length of
more than around 40 bits. This was one reason why in the original IEEE 802.11
standard, WEP used a 40-bit key.
To crack a 40-bit key using brute force, you would, on average,
have to try 239 times, which equals 550 billion different keys. That's a
big number, but it's not impossible. Say you have a supercomputer that can
conduct one test per microsecond; you could crack the key in about a week.
Because the 40-bit key is crackable, many security systems use
larger keys—128 bits is common. In an attempt to strengthen security, some
wireless LAN manufacturers brought out IEEE 802.11 systems using 104-bit keys, a
length that was eventually adopted as a de facto standard. Most Wi-Fi systems
support 104-bit keys, although strictly this has never been part of the IEEE
802.11 standard. The use of a longer key really renders brute force attacks
completely ineffective, assuming the underlying cryptographic algorithm has no
weaknesses. Let's suppose supercomputers become faster and we can try a hundred
keys in a microsecond. With a 104-bit key, you would still need (on average)
3,200,000 billion years to find the right key. Yes, 3 million billion years—and
if that doesn't put you off, then you must be an avid lottery player. If you
want to check the calculation yourself, here is the formula:
Ave Time = 2103 / (num tries per sec) / (num secs
per year)
Dictionary Attacks
Given that you can so easily defeat brute force attacks by
adding a few bits to the key, any attacker with an IQ in the double digits will
look for another approach. Here's the idea: Instead of trying every possible
key, try only those keys that you think the user is likely to use. For example,
the attacker could assume that the key is made up entirely of letters and
numbers, as is typical for user-chosen passwords. As we discussed in Chapter 2, this reduces key
entropy. A 104-bit key is now only as effective as a 78-bit key because only 6
bits of every byte are used. However, 78 bits is still uncrackable using brute
force so the attacker must narrow down further. This approach to reducing the
number of keys to test brings us to the idea behind a dictionary attack (Bishop, 2002;
Salkever,
2000).
In a dictionary attack, the enemy uses a huge dictionary, or
database, containing all the likely passwords. This will certainly include every
word in the English language and may contain other languages as well. It will
contain thousands of place names and proper names. It will contain words
extracted from every street address in the United States (for example). Every
name registered in the phone book, including first and last names, will be
there. Every common pet name, strings of digits for every zip code, the date of
every day in the year, and on and on.
The creation of such a database might seem like a formidable
task, but the hacker community shares material, and bit by bit more data is
added to the dictionary. Of course, in the end there will be millions of entries
in the dictionary—but remember that the enemy is reducing the key space from
multiple gazillions, so getting it down to a few million is a real
advantage.
With such a database, if the enemy can take home a sample of
ciphertext and plaintext and leave it crunching away, the password could be
cracked in a few days rather than a few billion years. The availability of such
attack dictionaries explains why security managers want users to define
passwords that use both upper- and lowercase (in unexpected places), and to
insert digits or other strange characters. The attack works only against
human-readable passwords or keys derived from such passwords in a known way.
Certain security protocols are more susceptible to dictionary
attack than others. It depends to some extent on how the master password, selected by the user, is applied to
the encryption process. For example, a password such as "Vesuvius" would easily
be discovered by a dictionary attack. However, if the key used for encryption
were derived from "Vesuvius" through a number of processing steps, dictionary
attacks would not be easy. Consider the following: A user has chosen the
password "Vesuvius". But before the key is used, the letters are swapped around
in a known way to give "svsuieVu". This new version is used for the key instead.
Both ends of the link know how to swap the bytes around, so it is not a problem
for the friendly devices; but the letter-swapping will foil a simple dictionary
attack. Of course, if the enemy knows the rule for swapping the letters, he can
build this rule into the attack, so you could arrange to use a different
swapping pattern depending on some other information known to both ends of the
link. Swapping the bytes is a simple example and not a practical secure method.
However, there are much more sophisticated ways to obscure the passwords before
use, some of which are used in the new IEEE 802.11 security protocol (see Chapter 10). As a result of
such key derivation, most modern security
systems are not susceptible to dictionary
attack.
Algorithmic Attacks
If the enemy cannot mount a brute force or a dictionary attack,
another approach is to try to break the algorithm—that is, to try to find a flaw
in the way the encryption is performed that might expose the key value. We will
see later that this was the successful attack made on WEP. It is difficult to
describe these algorithmic attacks generally because they depend so much on the
algorithm and understanding the weaknesses often requires that you are a
cryptographic expert. However, there is a straightforward analogy with safe
breaking.
In many B movies involving safe breaking, the master criminal
is seen with a doctor's stethoscope, listening to the front door of a large safe
and carefully turning the dial. When we were kids, we had no idea why anyone
would do that and assumed that the criminal was seeing whether the safe was sick
and hence easy to break into. The use of the stethoscope was never explained, as
if the movie producers assumed all viewers were master safecrackers and would
know what was going on. Years later, we realized that the purpose was to try to
find one digit of the combination at a time by listening to faint clicking
noises coming from the levers inside. This is a prime example of attacking the
algorithm. The safecracker knows how the mechanism (algorithm) works and knows
that it leaks information about the combination due to the noises. In
particular, it leaks information about one digit at a time. By exploiting the
leak one digit at a time, the combination is discovered. Furthermore, the time
required goes up only in proportion to the number of digits, whereas the
difficulty of a brute force attack goes up exponentially with the number of
digits.
The algorithmic style of attack is very similar to that used
against WEP. A weakness in the algorithm allows one byte of the key to be
attacked at a time. Although it takes a while to crack each byte of the key, the
total time is proportional to the number of bytes. This means that it is only
slightly more difficult to crack a 104-bit key than it is a 40-bit key.
Successful attacks against the algorithm are frightening
because, once the method is discovered, it is usually easy to build automatic
tools to find out the keys. And, as has been observed, after the keys are
discovered, your only chance is detection of the intruder.
Summary
In this chapter we have seen that there are many ways in which
attacks can be mounted against security systems. Methods do not need to be
sophisticated to be effective, nor does the person making the attack need to be
a technical expert if he is using a tool written by such an expert. Most
security attacks in the past have come from bad passwords or dictionary attacks.
However, key derivation is helping to reduce this problem. Now attackers must
look for flaws in the algorithms—or at least weaknesses that allow the strength
of the keys to be compromised.
The special vulnerability of Wi-Fi LANs makes them susceptible
to all these attacks and means that the security protections chosen must be
extremely good. By the end of this book, you will see how the new Wi-Fi and IEEE
802.11 security methods are, indeed, that good.
Sections
Archive
Syndication
