Tech Support > Computers & Technology > Internet & Broadband > How secure is wep?
How secure is wep?
Posted by smiley on March 27th, 2008


I understand that using wep as an wireless sercuity is like leaving a
door open. is this true if it is how would change it?

Posted by Alan on March 27th, 2008


In message
<4a5a5a54-c9e5-483c-a552-ca3567a0d23c@u69g2000hse.googlegroups.com>,
smiley <smile.its.smiley@gmail.com> wrote
It's a lot better than using nothing but Google for WPA or WPA2. I use
the latter on my XP machine but had to download a WPA update from the
Microsoft site.

Use a decent key - download a random key generator such as can be found
at
http://www.soroban.co.uk/wepkeygen.htm
--
Alan
news2006 {at} amac {dot} f2s {dot} com

Posted by drummie on March 27th, 2008


WEP is not very secure at all. It's a bit like leaving your front door
opening and hoping no one comes in.
Most routers have WPA/WPA2 settings which is more secure than WEP.
Generate a security key on the router or download a key generator.

Drummie


"smiley" <smile.its.smiley@gmail.com> wrote in message
news:4a5a5a54-c9e5-483c-a552-ca3567a0d23c@u69g2000hse.googlegroups.com...


Posted by Mortimer on March 28th, 2008


"drummie" <nospamr@ntlworld.com> wrote in message
news:mbVGj.27121$%N1.16547@newsfe3-gui.ntli.net...
WEP is more secure than having no security at all. It will deter casual
visitors who are scanning for available networks in the area and who will
use an unsecured network if one is available.

But WPA is much more secure.

Sadly there are some PCs with older wireless adaptors (either plug-in or
built-in) which can only use WEP. My girlfriend's Sony laptop (about 2003
vintage) is one of those: when I was setting up her router it pained me to
have to set it up with WEP. Of course I could have opted not to use the
built-in adaptor and use a Cardbus adaptor such as a Netgear WG311 instead,
but that makes the PC less portable because the card sticks out of the side
of the laptop.



Posted by Colin Wilson on March 28th, 2008


You can download a fully automated linux distribution that will
display the WEP key of any network within range. Allegedly.

Not sure whether it hacks WPA as well (possibly brute force ?)

Posted by R. Mark Clayton on March 28th, 2008



"Colin Wilson" <REMOVEEVERYTHINGBUTnewsgroup@phoenixbbsZEROSPAM.c o.uk> wrote
in message news:MPG.225645701810ec3098a6b8@news.individual.ne t...
With all the computers in all the world it would probably still take all the
time in the world - which is the whole idea...



Posted by Gordon Henderson on March 28th, 2008


In article <4a5a5a54-c9e5-483c-a552-ca3567a0d23c@u69g2000hse.googlegroups.com>,
smiley <smile.its.smiley@gmail.com> wrote:
WEP isn't that secure, but it's better than nothing. It will stop the
casual sniffer and make them more likely to move on to someone else,
if all they're looking for is free bandwidth.

If you can, use WPA or WPA2, but if your Access Point is older
and supports WEP only, then most will also support MAC addres
authentication. It's fiddly to use, but adds a 2nd barrier. It won't stop
people breaking the WEP key and snooping data - such as unencrypted email
usernames and passwords, but it might stop them stealing your bandwidth.
It's still possible to fake a MAC address though, but you need to break
the WEP first and them wait for a station to stop using the netowrk
before taking over their MAC, but you've got to be really determined
(or desperate) to go that far...

Gordon

Posted by Peter Crosland on March 28th, 2008


Gordon Henderson wrote:
AFAIK MAC codes are transmitted un-encrypted so they add nothing to
security.

Peter Crosland

g6jns@yahoo.co.uk



Posted by Mike Scott on March 28th, 2008


R. Mark Clayton wrote:
was mentioned a while back that could crack a poor wpa key quite quickly.


--
Mike Scott (unet <at> scottsonline.org.uk)
Harlow Essex England

Posted by Andy Burns on March 28th, 2008


On 28/03/2008 10:30, Mike Scott wrote:

There's some FPGA based hardware (called a cowpatty), that together with
large (40GB) rainbow tables, can do dictionary attacks (1 million words
against 1000 popular SSIDs) at a huge rate of knots

http://www.churchofwifi.org/

Don't think it can do brute forcing yet though so use non-dictionary WPA
keys and SSIDs.


Posted by Nozza on March 29th, 2008


On Fri, 28 Mar 2008 10:50:22 +0000, Andy Burns
<usenet.jan2008@adslpipe.co.uk> wrote:

For the unimaginative - like me! - you can always visit

https://www.grc.com/passwords.htm

which creates keys.


On a similar note - there's password page I like

http://www.pctools.com/guides/password/

And finally there's a password checker at Microsoft

http://www.microsoft.com/protect/you...d/checker.mspx

Noz

Posted by Gotde T Shirt on March 29th, 2008


On Thu, 27 Mar 2008 23:02:23 -0000, Mortimer wrote:

Check which model of WiFi adapter is fitted in the Sony laptop. If it's an
Intel 2100 adapter, there's an updated driver available that adds WPA
capability - get it from the download center (sic) at www.intel.com

Posted by Alan on March 29th, 2008


In message <ir5su31lovtncfctgerd0q5pnrkm2beqsh@4ax.com>, Nozza
<nozza_again_gns@yahoo.co.uk> wrote
Surely you want a utility on your own computer and behind your own
fire-wall to create the password or key? Using a third party machine
runs the risk of someone else knowing what it is.

Telling the Microsoft Corporation your password or key defeats the
whole purpose of having one in the first place!

--
Alan
news2006 {at} amac {dot} f2s {dot} com

Posted by kraftee on March 29th, 2008


Alan wrote:
Microsoft leave enough back doors already, letting them know your wifi
key is small change when compared..



Posted by Nozza on March 29th, 2008


On Sat, 29 Mar 2008 11:55:45 +0000, Alan <junk_reply@amac.f2s.com>
wrote:

I've just generated a password. Can you tell me what it is? Or can
anyone else?


I'm waiting for MS to attempt to hack into my network now.

Noz

Posted by Andy Burns on March 29th, 2008


On 29/03/2008 12:19, Nozza wrote:

The server could have stored it,
any ISP between you and the server could have stored or altered it,
a system like phorm could have stored or altered it.

All the above are unlikely, but why take the risk?

Posted by Nozza on March 29th, 2008


On Sat, 29 Mar 2008 12:51:39 +0000, Andy Burns
<usenet.jan2008@adslpipe.co.uk> wrote:

It claims it doesn't. But even if it did?

SSL - so no.

Convenience. We live in a risky world, and I like to live dangerously.
But securely

Noz

Posted by Alan on March 29th, 2008


In message <6scsu3h9qmbnv00mn98j5lf1lgk7uaei1j@4ax.com>, Nozza
<nozza_again_gns@yahoo.co.uk> wrote


The last 3 keys generated are:

\j])Qf:%-7+"8$qv2|hkv.s0jz6@`iby)]WDU!s]74GV:GXKfhdjL?jYh`('!N;

2C93G3^4eJO-&c;x]_rx$taMszO}*3H#O,HJNsz2"LMKs7?c"q4<h$oSsk~#YwG

7B0C6D4F4A4926CC94E76BC1550D9F058BEDDE2E5A86AD3551 A916CE37340B81

Is one of those your key?

--
Alan
news2006 {at} amac {dot} f2s {dot} com


Posted by Soruk on March 29th, 2008


On Thu, 27 Mar 2008 23:02:23 -0000, Mortimer <me@privacy.net> wrote:
My mother's old laptop runs Windows 2000 (putting XP on this thing would
be like trying to run Vista on a pocket calculator), and unfortunately
2000 doesn't support WPA, even with a Belkin Pre-N PCMCIA card.

--
-- Michael "Soruk" McConnell Eridani Star System
MailStripper - http://www.MailStripper.eu/ - SMTP spam filter
Second Number - http://secondnumber.matrixnetwork.co.uk/

Posted by Ivor Jones on March 29th, 2008



"Alan" <junk_reply@amac.f2s.com> wrote in message
news:O$+8d8BB5i7HFw9I@amac.f2s.com
: In message <ir5su31lovtncfctgerd0q5pnrkm2beqsh@4ax.com>,
: Nozza <nozza_again_gns@yahoo.co.uk> wrote
: >On Fri, 28 Mar 2008 10:50:22 +0000, Andy Burns
: ><usenet.jan2008@adslpipe.co.uk> wrote:
: >
: >>Don't think it can do brute forcing yet though so use
: >>non-dictionary WPA keys and SSIDs.
: >
: >For the unimaginative - like me! - you can always visit
: >https://www.grc.com/passwords.htm
: >which creates keys.
: >On a similar note - there's password page I like
: >http://www.pctools.com/guides/password/
:
: Surely you want a utility on your own computer and behind
: your own fire-wall to create the password or key? Using a
: third party machine runs the risk of someone else knowing
: what it is.

Not really. The grc page for example generates a unique key each time it
is visited, or the page refreshed. Do it a few dozen times or more, how is
anyone going to guess which of the keys generated (if any) you're actually
going to use..? And even if they could by some chance in a few million
guess, they'd still have to be within range of your wireless system to
actually use it.

Ivor