cracking wep with windows xp pro sp2
there is a video counterpart to this which is in the format of me describing what i am doing and how to carry out all the actions in this paper from start to finish. it will be available as soon as i can secure my web site adequately and will only ever be available to registered taz members. this paper should be considered the pre-reading for the video tutorial.
this is part one in a two part paper on cracking wep with windows xp. this first part covers sniffing wireless traffic and obtaining the wep key. part two will cover associating with a wireless ap, spoofing your mac address, trying to log on administratively to the ap and further things you can carry out on the wlan once authenticated successfully.
what is wep: wired equivalent privacy (wep) is often mistakenly thought of as a protocol designed to 100% protect wireless traffic, when this is not the case. as its name suggests it was designed to give wireless traffic the same level of protection as a wired lan, which when you think about it is a very hard thing to set out to do. lan�s are inherently more secure than wireless lan�s (wlan) due to physical and geographical constraints. for an attacker to sniff data on a lan they must have physical access to it � which is obviously easier to prevent than to prevent access to traffic on a wlan. wep works at the lower layers of the osi model, layers one and two to be exact, so it therefore does not provide total end to end security for the data transmission. wep can provide a level of security between a wireless client and an access point or between two wireless clients. wep standards: wep is commonly implemented as a 64 bit or 128 bit encryption. these encryption strengths can sometimes be referred to as 40 bit or 104 bit due to the fact that each data packet is encrypted with an rc4 cipher stream which gets generated by an rc4 key. this rc4 key for say a 64 but wep implementation is composed of a 40 bit wep key and a 24 bit initialization vector (iv) � hence the 64 bit rc4 key, however the actual wep part of it is only 40 bits long, the iv taking up the other 24 bits, which is why a 64 bit wep key is sometime referred to as a 40 bit wep key. this resultant cipher is �xor�d� with the plain text packet. to decrypt the packet the wep key is used to stream� at the other end to decrypt the whole packet i will also go over the iv�s in more detail later on
data to encrypt the whole generate an identical �key but more about this later on, as well.
failures of wep: we have heard everyone say wep is easy to crack and should not be used, can be cracked in 10 minutes etc but why is this? well in my opinion wep is seriously flawed for the following reasons: 1) initialization vectors are reused with encrypted packets. as an iv is only 24 bits long it is only a matter of time before it is reused. couple this with the fact you may have 50 + wireless clients using the same wep key and the chances of it being reused improve even further. an iv is sent in clear along with the encrypted part of the packet. the reuse of any encryption element is always a fundamental flaw to that particular encryption and as an iv is sent in clear this further exposes a significant weakness in wep. as more rc4 cipher steams are found and more iv�s are deciphered and the closer we get to discovering the wep key. this is what forms the foundation of wep cracking. 2) the algorithm used to encrypt a wep �hash� is not intended for encryption purposes. the original purpose of the cyclic redundancy check (crc-32) was to detect errors in transmission, not to encrypt data. 3) the most significant flaw in my opinion is the mass use of the wep key. everything using that particular ap will need the same wep key hence all the resultant traffic will be using the exact same wep key as well. the one not so obvious side-affect of this is when it comes to administering the network. if you have 60 wireless clients all using the same wep key, do you really want to go and periodially change them all�..it is easier to leave it as it is. i am guilty of doing this on a network i used to administer a few years ago as i am sure others are who still use wep. wireless standards: the institute of electrical and electronic engineers (ieee) defined specifications for wireless traffic back in 1997. the protocol they came up with is the 802.11 standard. nowadays 802.11 has many different implementations for wireless traffic. the most common ones are: 1) 802.11 � this specifies that the wireless traffic will use the 2.4ghz frequency band utilizing either frequency hoping spread spectrum (fhss) or direct sequence spread spectrum (dsss). the fhss is a protocol whereby the traffic �hops� to predefined frequencies and is commonly used to reduce the effects of noise or interference in the transmission. dsss is also a protocol used to reduce noise interference by combining the signal with a higher data rate bit sequence (commonly called a chipping code) which separates the data up in to a logical sequence and attaches a form of crc to the packet before transmitting. 2) 802.11a � this provides data transmission in the 5ghz band at a rate of anything up to 54mbps. unlike the original 802.11 specification this uses orthogonal frequency division multiplexing (ofdm) to encode the traffic instead of
fhss or dsss. ofdm is a method of transmitting digital data by splitting it up in to smaller �chunks� and transmitting them at the same time but on different frequencies, which is why the data transfer rate is quite good. 3) 802.11b � came along in 1999 with the intention of allowing wireless functionality to be similar to that provided by ethernet. it transmits data in the 2.4ghz band at 11mbps using dsss only. is sometimes called wi-fi. 4) 802.11g � this works in the 2.4 ghz band at a rate of 20mbps or more and came along in 2003. it uses ofdm like 802.11a and transmits data in a very similar way. however unlike 802.11a it is backward compatible with 802.11b. a point worth noting here is if you have an 802.11b wireless adaptor you will not be able to receive 802.11g traffic. if you do want to get in to wep cracking it is well worth your while investing in a dual band card. i will talk about wireless adaptors more later on. how do we crack wep: well cracking wep is fairly easy to understand if you have followed what i explained above. we briefly touched on iv�s and wep encryption and how they tie in together. to put it very simply, if you can decipher the iv algorithm you can decrypt or extract the wep key. as i stated before wep very kindly transmits the iv in clear, so if we can run a mathematical equation against it we can find and decipher the rc4 stream that encrypted the whole packet in the first place. the wep �key� is the missing value [key] from this mathematical equation. remember the ap or the client has this key to use when decrypting the packet and is what we must find by running a complicated algorithm against the encrypted packet. if you think about it like this it may become clearer: you have an algorithm that is produced by concatenating a randomly generated 24 bit iv with your wep key � you also have an rc4 key stream - the two are then �hashed� together to encrypt the packet. the iv is the hub of the whole process as this is they only thing that has used your wep key. if we run a statistical anyalisis against the iv to try and decrypt the packet, we can find the key used at the begining of the process. when you try to decrypt them, every time you crack a piece of the algorithm the corresponding plain text part of the packet is revealed, once the whole packet is decrypted you know the algorithm used to encrypt that particular packet � a crude way of describing it but as simple as i can make it. any attacker can passively collect encrypted data, after a while due to the limitations explained earlier; two iv�s that are the same will be collected. if two packets with the same iv are xor�d, an xor of the plain text data can be revealed. this xor can then be used to infer data about the contents of the data packets. the more identical iv�s collected the more plain text data can be revealed. once all the plain text of a data packet is known, it will also been known for all data packets using the same iv. so before any transmission occurs wep combines the keystream with the payload
using an xor process, which produces ciphertext (data that has been encrypted). wep includes the iv in clear in the first few bytes of the frame. the receiving ap / client uses this iv along with the shared secret key (your wep key) to decrypt the payload of the frame. xor is a mathematical algorithm which i am not even going to attempt to explain. this site explains it very well though: http://mathworld.wolfram.com/xor.html so in short � the more identical iv�s we can get the more plain text data we can reveal and the closer we get to obtaining the key used to encrypt the data in the first place. as it is not pre-determined when we are going to receive identical iv�s it is impossible to say how many iv�s need to be collected but more about that later. software used: for this attack i am going to use aircrack-ng for windows which can be obtained from here: http://tinyshell.be/aircrackng/wiki/index.php?title=aircrack-ng whilst here download cygwin1.dll and paste it in to the same folder as aircrackng. there is a copy of cygwin1.dll included already but the one available from the tinyshell site is a later version of it. the peek.dll and peek5.sys files also need to be in the same directory as aircrack. they are available here: if you download winaircrack - which is a gui version of what i cover in this paper - copy the peek.dll and peek5.sys files across to where you have aircrack stored. you will get a peek driver not found message if you dont do this. once it has downloaded you have to option of pasting the directory path of it in to your command prompt path so you can start the application straight from the command line without having to �cd� to the correct directory. for example i copied this in to my path: c:\documents and settings\nokia\desktop\aircrack-ng-0.3-win\aircrack-ng-0.3-win\bin in the bin folder is airodump and aircrack-ng � so now i can just type airodump straight in to the command prompt to run the application. to add something to your path: right click my computer > properties > advanced > environment variables > under system variables highlight path > edit > enter the directory path using a ; to separate it from any existing entries. you also need to go to wild packets to pick up a new driver for your card. http://www.wildpackets.com/ i have found that the most common cause of stress when trying to crack wep is incompatible hardware. the airopeek driver from wild packets is not compatible with all types of hardware. there is a list of supported adaptors and the relevant driver you need to use on the web site. for this crack i am using an atheros based netgear wag511 dual band adaptor which you can get from here for �35.99. this card works with whax, auditor and backtrack pretty much straight out of the box. it is also a dual band so you don�t have to worry about sniffing traffic on a
�g� wlan when you have a �b� wireless adaptor. it is my preferred wireless adaptor and has not let me down yet. most cards that are atheros based will have the atheros logo on the side of the box, use one of these if possible. **some people i know have confused the netgear wg511 which does not work, with the netgear wg511t which does work so try not to fall in to this trap** cards that i can 100% say to stay away from are ones that use the prisimgt chipset. connexant cards are also a complete waste of time (which i found out the hardway) so please do not even think about buying one of these if you want to crack wep. see this list to check what chipset your card uses: http://www.linux-wlan.org/docs/wlan_adapters.html.gz so you should now have: aircrack-ng cygwin1.dll � in the same directory as aircrack peek.dll and peek5.sys in the same directory as aircrack relevant drivers from wild packets for your adaptor added aircrack-ng to your path got an adaptor that works with all of the above! so what�s next? now we need to install the driver you have downloaded. **warning � the next procedure will overwrite your existing windows driver, so make sure you have the disc or a backup of it before carrying on.** the peek driver will not let you use your wireless adaptor in the conventional way. you won�t be able to associate to an ap with it or browse the internet etc. 99% of windows drivers a designed to make your wireless adaptor reject any 802.11 traffic not destined for it. the peek driver puts your adaptor in to a promiscuous mode to allow it to sniff all 802.11 traffic that is compatible with your adaptor. to install the driver open up your device manager and right click on your wireless adaptor > update driver > install from a specific location > don�t search, i will chose the driver to install > have disk > browse to where you have downloaded the driver > double click. windows may display a prompt warning you that the driver is not digitally signed, if ths happens click continue anyway. once the driver is installed we are ready to crack wep. **if you get an error message saying �the specified destination contains no information about your device�, you have either downloaded the wrong driver or more likely your wireless adaptor is not compatible with what we need it to do.** cracking wep: cracking wep is by now means a skilful thing to do, as all the hard work was done by chris devine who is the excellent coder of aircrack, all we need to do is collect the data and start the program. if you have questions about aircrack a good place to post them is on the netstumbler linux forums as i believe the author
checks here quite often. alternatively you can email the author at devine [at] iie [dot] cnam [dot] fr � whether he will reply or not i don�t know but i wouldn�t have thought he will appreciate you emailing him with stupid questions � use the forum for these! airodump so open a command prompt and type airodump � or if you have not added it to your path you will need to cd to the right directory. a new window opens now which will search for all installed wireless adaptors, give it a numerical signature and display the following: code: usage: airodump