Cracks in the Air Government Computer News (05/07/07) Vol. 26, No. 10, Jackson, William
as it appeared in the May 14, 2007 edition of ACM TechNews.
In a recent lecture at the CIO Council's quarterly IT forum in Washington, D.C., Justice Department information technology security specialist Mischel Kwon gave a sobering assessment of some of the security risks involved in using wireless communications. For example, Wi-Fi technology used in wireless local area networks has a number of vulnerabilities, including rogue access points that can make control difficult, signals that are easy to detect, and encryption standards that are easy to crack. As part of her lecture, Kwon--along with Rob Del Gaizo, a computer science student at George Washington University--demonstrated how hackers crack the encryption standards used in Wi-Fi networks. Kwon and Del Gaizo were able to crack the Wired Equivalent Privacy (WEP) encryption standard in just a few minutes after capturing relatively few packets, though they had much more difficulty breaking the Advanced Encryption Standard used in Wi-Fi Protected Access/2 (WPA/2). However, Kwon and Del Gaizo were eventually able to subvert the encryption standard by attacking the passphrase exchange during the connection process. Given these vulnerabilities, Kwon advised users who set up wireless networks to separate the wired and wireless segments with a firewall and avoid anything involving sensitive information on the wireless side of the network. Kwon and Del Gaizo also demonstrated how to hack Bluetooth, a wireless technology that is becoming common for hands-free cell phone communications and for the on-board computers in cars. The two showed how hackers can use a man-in-the-middle attack to intercept a cell phone call. Similar attacks can also be used to steal data stored on a Bluetooth-enabled device, Kwon and Del Gaizo said. Click Here to View Full Article
