The other day I was on my balcony at home, trying to get my laptop to catch some signal from my own router (damn load-bearing walls), when I decided to open NetStumbler. I was blown away. My neighborhood looks like a wireless network festival: WLAN_XX, SpeedTouch, Ono... And the saddest part: 90% are still using WEP encryption. At this point in the movie, having your shiny 3 Megabit ADSL connection (I wish I had Jazztel's 20!) protected with WEP is like locking your front door with a toothpick.

Lately I've been tinkering a lot with the new version of the BackTrack 2 live-CD distro and my old reliable PCMCIA card with the Atheros chipset (it is essential that it supports packet injection, if you have an Intel Centrino you are sold out on Linux unless you fight with the ipw2200 driver patches). So I've decided to write this article to show you how absurdly easy it is to bust WEP encryption nowadays.

The myth of WEP security

The problem with WEP (Wired Equivalent Privacy) isn't that the key is short or long. The problem lies in its mathematical design, specifically in the RC4 encryption algorithm and how it handles Initialization Vectors (IVs). Basically, if we capture enough data packets (unique IVs), we can deduce the key using statistical attacks, like the famous PTW attack.

A couple of years ago you could spend hours waiting for network traffic to capture the necessary IVs. Today, thanks to injection tools, we can force the router to spit out packets like crazy and get the key in literally 10 minutes.

Let's get down to business: Injection is the key

We assume you've booted up with your BackTrack 2 and your wireless card is recognized as wifi0.

The first thing is to put the card in monitor mode to be able to "listen" to everything flying through the air:

airmon-ng start wifi0

This will create a virtual interface for us, usually ath0. Next, we use airodump-ng to locate our "victim" (your own router for testing, please, let's not be jerks) and see what channel it broadcasts on and what its MAC address (BSSID) is.

airodump-ng ath0

Once we have the channel (let's say 6) and the BSSID (for example, 00:11:22:33:44:55), we launch airodump again to save the captured packets to a file, filtering only by that network:

airodump-ng -c 6 --bssid 00:11:22:33:44:55 -w captura_wep ath0

Here comes the black magic. We open another terminal to launch the fake authentication attack and then the traffic injection (ARP Replay). This will make the router generate artificial traffic at full speed:

aireplay-ng -1 0 -a 00:11:22:33:44:55 ath0
aireplay-ng -3 -b 00:11:22:33:44:55 ath0

If all goes well, you will see in the airodump-ng window how the #Data column (the IVs) starts to skyrocket. When it goes over 20,000 or 30,000 (which with a good signal takes a couple of minutes), we open a third terminal and launch the cracker against the file we are capturing:

aircrack-ng -z captura_wep*.cap

The -z parameter invokes the PTW attack. And boom. KEY FOUND!.

The future (if there is one) of wireless networks

Honestly, seeing how WEP keys fall on the screen is impressive the first time, but it leaves you with a pretty weird feeling. The amount of companies and individuals that right now are exposed to any kid with a LiveCD and a tutorial intercepting their Messenger, reading their plain text POP3 emails, or using their connection to download porn on eMule is terrifying.

WEP is dead. Dead and buried. The industry is pushing us towards the WPA standard, and more specifically to WPA2 with AES encryption. I've been doing some tests and, unless you use ridiculous dictionary passwords that can be brute-forced, WPA2 seems to be quite a bit more robust. We'll see how long it takes them to find its weak spots. For now, my advice: log into your router's config panel, disable WEP, configure WPA, set a long alphanumeric key, and turn off the SSID broadcast. For pure digital hygiene.