Tag: tkip

Windows 10 想要拿掉 WEP 與 TKIP...

再 OSnew 上看到「Windows 10 to disallow WEP encryption」這個消息，裡面題到了 Windows 10 打算要幹掉無線網路的 WEP 支援。裡面是引用了「Windows 10 features we’re no longer developing」這則消息，可以看到除了 WEP 以外，還有 TKIP 也打算拔掉：

Since the 1903 release, a warning message has appeared when connecting to Wi-Fi networks secured with WEP or TKIP (which are not as secure as those using WPA2 or WPA3). In a future release, any connection to a Wi-Fi network using these old ciphers will be disallowed. Wi-Fi routers should be updated to use AES ciphers, available with WPA2 or WPA3.

之前去日本的時候還是有不少飯店用 WEP 啊，看起來總算有動力要淘汰了...

新的 RC4 攻擊：實戰化

在 Twitter 上看到對 RC4 的新攻擊，可以直接攻擊 TLS 與 WPA-TKIP，沒有 workaround：「All Your Biases Belong To Us: Breaking RC4 in WPA-TKIP and TLS」。

對 TKIP 可以在一個小時內打下來：

In practice the attack can be executed within an hour.

對於 TLS 則是 75 個小時有 94% 成功率，實際測試時只用了 52 個小時就順利攻下來：

We also attack TLS as used by HTTPS, where we show how to decrypt a secure cookie with a success rate of 94% using 9·227 ciphertexts. This is done by injecting known data around the cookie, abusing this using Mantin's ABSAB bias, and brute-forcing the cookie by traversing the plain-text candidates. Using our traffic generation technique, we are able to execute the attack in merely 75 hours.

When we tested the attack against real devices, it took merely 52 hours to successfully perform the attack.

看起來唯一的解法是停用...