Wireless Vulnerabilities & Exploits
Wireless Vulnerabilities & Exploits
WVE ID: WVE-2005-0055
Type: Exploit
Status: Candidate
Classification:
Cryptographic
Design Flaw
Description:
wepwedgie is a tool for determining PRGA sequences for a WEP encrypted network and injecting frames into it.
Discussion:
wepwedge consists of two programs to enable an attacker to inject traffic into a WEP encrypted network. The first program, prgasnarf is used for discovering PRGA (Psuedo Random number Generation Algorithm) and IV (Initialization Vector) combinations. The other program, wepwedgie uses the information collected with prgasnarf to inject traffic into the wireless network.
prgasnarf accomplishes its task by looking for authentication challenges and responses. When a station authenticates with a network using shared-key authentication the AP generates a random number and sends it to the station. The station then encrypts this number with the WEP key and sends the resulting ciphertext to the AP. If the AP is able to decrypt this to the random number that it initially sent, then it deduces that the client has the correct WEP key and that it should be authenticated.
A problem arises because the initial challenge is sent in the clear. When the station encrypts this plaintext it uses WEP to generate a PRGA which is then XOR-ed with the plaintext challenge to produce the ciphertext response. Because the PRGA is XOR-ed with the plaintext it is possible for an attacker who has observed the challenge to XOR it with the ciphertext sent in the response and recover the PRGA used to encrypt it.
After PRGA data has been recovered, an attacker can then use the wepwedgie program to conduct TCP & UDP portscans, ping scans, and firewall rule tests by injecting traffic into the WEP encrypted network.
It should be noted that networks using open authentication, but using WEP for encryption are not vulnerable to this type of attack because there is no challenge/response authentication in use.
Credits
Author:
Anton
Rager
(arager@avaya.com)
: Avaya
References
URL:
http://standards.ieee.org/getieee802/download/802.11-1999.pdf
URL:
http://sourceforge.net/projects/wepwedgie/
Released: 2003-07-01
Submitter
Andrew
Lockhart
(alockhart@networkchemistry.com)
: Network Chemistry
Submitted: Thu Dec 01 12:52:29 -0800 2005
Candidate Date: Thu Dec 01 12:57:50 -0800 2005
