New attack cracks common Wi-Fi encryption in a minute | Hacker News Reader

New attack cracks common Wi-Fi encryption in a minute

thestandard.com

22 pointsilamont15 comments

But still a remarkable majority still depends on WPA/TKIP, thinking it's safe. Around my vicinity the ratios of various security methods are roughly: WPA/TKIP: 65% WEP: 20% WPA2/CCMP: 10% Open/MAC : 5% (data obtained thru airodump-ng)

It's not that they think it's safe, it's that they have no idea what 'it' is.

AT&T just brought the internet into my new business. The default router they use has wireless which they left turned on with just WPA protection despite it having an option for WPA2. There will be WPA systems aplenty for some time.

(I turned the wireless off and blew open the firewalls. I only want packets to come and go through their router. I'll do the rest with systems I trust.)

Out of curiosity, how many of you just leave your access point open?

I named mine "aireplay-ng" and gave it 32bit wep as a courtesy to any of my hacker brethren.

I used to, but I got too nervous about all the plaintext passwords and sensitive information that could be sniffed out of the air by a bored teenager. Enabling WPA isn't perfect, but it provides at least a single layer of protection which is probably good enough for most environments, similar to locking the door to your house.

If you use DD-WRT you can set up a second virtual access point that can use your internet connection without having access to your local network.

How? I wanted to do that, but could only find a very complicated method that involved editing the startup files on the router.

It's in the settings panel for "Wireless" if you have v24 of the firmware.

My access point is wide open but SSID broadcast is disabled. Considering the number of visible open APs in my apartment building, that's probably enough to keep the random bandwidth leach or mischievous wardriver away.

Oh cool, they successfully attacked a system using an outdated encryption standard. In case you haven't gotten the memo yet, it's time to switch to AES.

I kind of want some example source code for, uh, security testing.

Anyone else get redirected to a fake virus scan from this page?

End URL was: ://live-virus-scanner7.com/1/?sess=pGTyyjzxMS02JmlwPTIxNy4zNS44My4yMjMmdGltZT0xMjU1MgAMPQdN

No, the page seems totally ok. Perhaps just your computer made the redirection?

Sounds like you've got spyware: http://www.2-spyware.com/remove-livevirusscanner7com.html

It's you - it's a browser 'helper' object. I generally use Spybot Search & Destroy for removing this kind of thing.

Reply on news.ycombinator.com