Small-Biz
Interesting titbits for small companies
Sunday 12 October 2008, 9:33 PM
Wi-Fi Security Is No Longer Secure
A Russian firm’s use of the latest nVidia graphics cards to accelerate Wi-Fi ‘password recovery’ times by up to an astonishing 10,000% proves that Wi-Fi’s WPA and WPA2 encryption systems are no longer enough to protect wireless data.
This breakthrough in brute force decryption of Wi-Fi signals by Elcomsoft confirms observations that firms can no longer rely on standards-based security to protect their data. As a result, companies using Wi-Fi in their offices may want to cross their fingers. Alternatively, you may want to think of moving on up to a VPN encryption system as well.
Brute force decryption of the WPA and WPA2 systems using parallel processing has been on the theoretical possibilities horizon for some time - and presumably employed by relevant government agencies in extreme situations - but the use of the latest nVidia cards to speedup decryption on a standard PC is extremely worrying, even if totally fascinating. The acceleration technology offloads parts of computational-heavy processing onto the fast and highly scalable processors featured in nVidia’s latest graphic accelerators.
As companies can no longer view standards-based Wi-Fi transmission as sufficiently secure against eavesdropping to be used with impunity, the use of VPNs is arguably now mandatory for companies wanting to comply with the Data Protection Act. This is an interesting step in the evolution of Wi-Fi security, as, it may actually trigger a move back to hard-wired connections in institutions who are concerned about data privacy. I told you so!
The big question, of course, is what happens when hackers secure a pecuniary advantage by gaining access to company data flowing across a WPA or WPA2-encrypted wireless connection. Will the Information Commissioner take action against the company concerned for an effective breach of the Data Protection Act?
- 1 comment |
- Post a comment |
- TrackBack |
- Clip Link
- | Viewed 1240 times
PreviousComments on this post
The acceleration of password recovery times is impressive. However, I don't agree with your conclusion that WPA and WPA2 encryption systems are no longer enough to protect wirleless data.
First off, if we assume that passwords are made up using a character set containing about 95 characters, by adding one additional character to a passphrase, it becomes about 95 times harder to recover. You can potentially undo the effects of the password recovery acceleration by adding a couple of characters to a passphrase. Since the beginning of WPA/WPA2 it has been recognized that weak passphrases are susceptible to attack (http://www.wifinetnews.com/archives/002452.html). How long are the passphrases that Elcomsoft has been able to break? Based on the information you provided I don't think they can break a long, 25 character strong passphrase. On a small network it is certainly easier to have a long passphrase than it is to deply a VPN.
Secondly, WPA/WPA2 has an enterprise mode that typically relies on the same type of certificate authentication that is used by VPNs. The enterprise mode requires the use of a RADIUS server. Deploying a RADIUS server can be a lot less expensive than moving to a VPN encryption system. For instance, the easy to use RADIUS server at http://home.comcast.net/~dzick is free!
