AirTight Plays Up WPA Crack Threat

I’m a little taken about at AirTight’s marketing campaign: A crack in WPA’s security model discovered by German academics isn’t the end of WPA security. In fact, it’s more likely the end of any reason to use TKIP, the weaker of the two encryption algorithms available in modern WPA/WPA2 compliant Wi-Fi systems, that was developed entirely to enable older 802.11b devices to have a forward-upgrade path back in 2003 to a newer security model. See my article from 7 November 2008, “Don’t Panic over WPA Flaw, But Do Pay Attention.”

AirTight’s advertisement for a webinar and white paper asks a different question. The subject line, “Is WPA Encryption Broken Forever?” No, because it’s not broken now. The company goes on to ask, “I this the tip of the iceberg?”, which is much more reasonable.

The marketing release says, “Roughly 90 days ago, the WLAN industry was abruptly shaken when two German researchers announced a crack in TKIP (Temporal Key Integrity Protocol), an encryption protocol used with the WPA wireless security standard.” Not so much. There was a lot of interest, and once details came out, everyone relaxed. The vulnerability can be patched, but the correct solution is to leave TKIP in favor of AES-CCMP, something already recommended years ago for all enterprises and security-minded organizations.

AirTight writes, “Researchers were able to exploit this new vulnerability and inject arbitrary packets in the TKIP protected client in as little as 15 minutes. This method potentially creates hooks for new exploits in what was once considered the accepted security upgrade from WEP.” The first part of that? Not so much, either. Researchers were able to inject non-arbitrary packets: They had to create packets of the same length as those that were being used as a model, and packets were only a few bytes long. Arbitrary packet injection without any explanation implies the ability to, well, inject any data into a packet. That’s just not the case.

The last sentence, “creates hooks for new exploits” is a reasoned statement that’s worth considering. There are likely other flaws in TKIP that haven’t been exploited that could provide a way to claw out more data or inject longer packets that could do some harm. TKIP’s model is a repaired version of WEP, and thus TKIP inherited some of the weaknesses. The WPA flaw that the folks in Germany wrote about could be repaired by a couple of minor changes in how bad packets are handled, and a faster TKIP key rotation.

With little security news, AirTight may be trying to make a little hay, but they should keep that to a small pile.

Sundance honors `Push,’ `We Live in Public’
(AP)
NY Times on In-Flight Internet