Petr Matousek Martin Schmiedecker Popular Books

Petr Matousek Martin Schmiedecker Biography & Facts

Aircrack-ng is a network software suite consisting of a detector, packet sniffer, WEP and WPA/WPA2-PSK cracker and analysis tool for 802.11 wireless LANs. It works with any wireless network interface controller whose driver supports raw monitoring mode and can sniff 802.11a, 802.11b and 802.11g traffic. Packages are released for Linux and Windows. Aircrack-ng is a fork of the original Aircrack project. It can be found as a preinstalled tool in many security-focused Linux distributions such as Kali Linux or Parrot Security OS, which share common attributes as they are developed under the same project (Debian). Development Aircrack was originally developed by French security researcher Christophe Devine, its main goal was to recover 802.11 wireless networks WEP keys using an implementation of the Fluhrer, Mantin and Shamir (FMS) attack alongside the ones shared by a hacker named KoreK. Aircrack was forked by Thomas D'Otreppe in February 2006 and released as Aircrack-ng (Aircrack Next Generation). Wi-Fi security history WEP Wired Equivalent Privacy was the first security algorithm to be released, with the intention of providing data confidentiality comparable to that of a traditional wired network. It was introduced in 1997 as part of the IEEE 802.11 technical standard and based on the RC4 cipher and the CRC-32 checksum algorithm for integrity. Due to U.S. restrictions on the export of cryptographic algorithms, WEP was effectively limited to 64-bit encryption. Of this, 40 bits were allocated to the key and 24 bits to the initialization vector (IV), to form the RC4 key. After the restrictions were lifted, versions of WEP with a stronger encryption were released with 128 bits: 104 bits for the key size and 24 bits for the initialization vector, known as WEP2. The initialization vector works as a seed, which is prepended to the key. Via the key-scheduling algorithm (KSA), the seed is used to initialize the RC4 cipher's state. The output of RC4's pseudo random generation algorithm (PRGA) follows a XOR operation in combination with the plaintext, and produces the ciphertext. The IV is constrained to 24 bits, which means that its maximum values are 16,777,216 (224), regardless of the key size. Since the IV values will eventually be reused and collide (given enough packets and time), WEP is vulnerable to statistical attacks. William Arbaugh notes that a 50% chance of a collision exists after 4823 packets. In 2003, the Wi-Fi Alliance announced that WEP had been superseded by Wi-Fi Protected Access (WPA). In 2004, with the ratification of the full 802.11i standard (i.e. WPA2), the IEEE declared that both WEP and WEP2 have been deprecated. WPA Wi-Fi Protected Access (WPA) was designed to be implemented through firmware updates rather than requiring dedicated hardware. While still using RC4 at its core, it introduced significant improvements over its predecessor. WPA included two modes: WPA-PSK (WPA Personal) and WPA Enterprise. WPA-PSK (Wi-Fi Protected Access Pre-Shared Key), also known as WPA Personal, used a variant of the Temporal Key Integrity Protocol (TKIP) encryption protocol. It improved security by implementing the following features: A 56-bit cryptographic message integrity code (MIC) called Michael, compared to the 32-bit CRC-32 used in WEP. An initialization vector (IV) sequencing discipline designed to prevent replay attacks. A key mixing function to defeat a class of attacks on WEP. A rekeying method to prevent key reuse. TKIP allocated 48 bits to the IV compared to the 24 bits of WEP, so the maximum number is 281,474,976,710,656 (248). In WPA-PSK, each packet was individually encrypted using the IV information, the MAC address, and the pre-shared key as inputs. The RC4 cipher was used to encrypt the packet content with the derived encryption key. Additionally, WPA introduced WPA Enterprise, which provided enhanced security for enterprise-level networks. WPA Enterprise employed a more robust authentication mechanism known as Extensible Authentication Protocol (EAP). This mode required the use of an Authentication Server (AS) such as RADIUS (Remote Authentication Dial-In User Service) to validate user credentials and grant access to the network. In 2015, the Wi-Fi Alliance recommended in a technical note that network administrators should discourage the use of WPA and that vendors should remove support for it and rely instead on the newer WPA2 standard. WPA2 WPA2 (Wi-Fi Protected Access 2) was developed as an upgrade to the original WPA standard and ratified in 2004, and became mandatory for Wi-Fi certified products in 2006. Like WPA, WPA2 provides two modes: WPA2-PSK (WPA2 Personal) and WPA2 Enterprise. Unlike WPA, WPA2-PSK uses the more secure Advanced Encryption Standard (AES) in CCM mode (Counter-Mode-CBC-MAC Protocol), instead of TKIP. AES provides stronger authentication, encryption and is less vulnerable to attacks. A backward compatible version, called WPA/WPA2 (Personal) still made use of TKIP. WPA2-PSK replaces the message integrity code Michael with CCMP. Timeline of the attacks WEP In 1995, before the WEP standard was available, computer scientist David Wagner of the Princeton University discussed a potential vulnerability in RC4. In March 2000, a presentation by Dan Simon, Bernard Aboba, and Tim Moore of Microsoft provided a summary of 802.11 vulnerabilities. They noted that denial of service deauthentication attacks are possible because the messages are unauthenticated and unencrypted (later implemented by the aireplay-ng tool). In addition, they wrote that because some implementations of WEP derive the key from a password, dictionary attacks are easier than pure brute force. In May 2001, William A. Arbaugh of the University of Maryland presented his inductive chosen-plaintext attack against WEP with the conclusion that the protocol is vulnerable to packet forgery. In July 2001, Borisov et al. published a comprehensive paper on the status of WEP and its various vulnerabilities. In August 2001, in the paper Weaknesses in the Key Scheduling Algorithm of RC4, authors Scott Fluhrer, Itsik Mantin, and Adi Shamir performed a cryptoanalysis of the KSA, citing Wagner among others. They stated that they had not conducted an attack against WEP, and therefore couldn't claim that WEP was vulnerable. However, other researchers implemented the attack and were able to demonstrate the protocol's insecurity. In 2004, a hacker using the pseudonym KoreK posted a series of attacks on the NetStumbler.org forum, which were incorporated into the original aircrack 1.2 by Christophe Devine. That same month, aircrack began supporting replay attacks against WEP, which use ARP requests to generate more IVs and make key recovery easier. Later that year, KoreK released the Chopchop attack, an active packet injector for WEP. The name of the attack derives from its inherent working: a packet is intercepted, "chops" off a part of it and sends a modified version to the Access .... Discover the Petr Matousek Martin Schmiedecker popular books. Find the top 100 most popular Petr Matousek Martin Schmiedecker books.