Cracking the WPA Security Standard

Fourth, you may already have defenses in place to protect you from this attack. Companies using Wireless Intrusion Detection and Prevention technology, like that provided by AirTight Networks or Motorola’s AirDefense unit, should have some protection from this attack right away. These systems can definitely identify MAC spoofing that would be used as part of an attempt to inject traffic.

Location detection tools could also be useful: Since the attacker has to pose as an access point, the system should throw up immediate warnings if it looks like an access point suddenly moved. 

Presumably, WIPS vendors are right now cooking up new detections as well to help find and correlate any Michael errors that must occur as part of the attack. Since Michael errors are rare (it’s pretty hard to accidentally change data payload without changing the checksum hash), a regular stream of Michael errors happening every 61 seconds or so should be easy to detect and send out an alert. 

As a temporary workaround solution, TKIP enjoyed a remarkably good run without coming under serious threat. However, with this first attack now published (and early-generation tools using the attack, like aircrack-ng, available in the wild), undoubtedly TKIP will come under significantly more scrutiny in the months to come. 

Consequently (fifth), even though the encryption is not yet broken, wireless administrators should start re-evaluating the use of WPA and TKIP.  Many companies are already faced with some wireless upgrades to come into compliance with PCI 1.2, which last month finally put a timeline in place for retiring WEP as a security measure on wireless networks carrying sensitive data. For those companies needing to finally retire old scanners, bar code readers or other wireless mobile devices used for transactions, make sure to look for AES support on your next equipment investments.

Fortunately, most enterprise-grade equipment bought in the last four years will have support for AES. However, some patches may be necessary to get common client devices up to speed. Windows Mobile devices running versions prior to WM 6.1 may not offer AES support, so mobile administrators should investigate whether an upgrade is available. 

Also, those who use the Windows XP and the Zero-Config wireless tool (but have not yet installed Windows XP SP3) will also need to install a patch to add AES support.

eWEEK Labs Senior Technical Analyst Andrew Garcia can be reached at agarcia@eweek.com.