NetStumbler.org Forums

Go Back   NetStumbler.org Forums > Software > Unix/Linux
Reload this Page WEP fragmentation attack
Register Search Today's Posts Mark Forums Read

Reply
 
LinkBack Thread Tools Display Modes
Old 09-23-2005   #1 (permalink)
sorbo
Registered Member
 
Join Date: Oct 2004
Posts: 4
WEP fragmentation attack
It is possible to send arbitrary data [any length and content] on a WEP network after having eavesdropped a single data packet.

http://darkircop.org/frag-0.1.tgz

The idea is:
Sniff first 8 bytes of cipher-text on packet with IV X.
XOR cipher-text with 8 bytes of clear-text:
AA AA 03 00 00 00 08 {00/06} depending if IP/ARP.
Send data in 802.11 fragments of 4 data bytes + 4 CRC32 bytes all encrypted using the PRGA recovered and with IV X.
sorbo is offline   Reply With Quote
Old 09-23-2005   #2 (permalink)
renderman
Drunken Stumbler
 
renderman's Avatar
 
Join Date: Jun 2002
Location: Anywhere but Utah
Posts: 1,794
Quote:
Originally Posted by sorbo
It is possible to send arbitrary data [any length and content] on a WEP network after having eavesdropped a single data packet.

http://darkircop.org/frag-0.1.tgz

The idea is:
Sniff first 8 bytes of cipher-text on packet with IV X.
XOR cipher-text with 8 bytes of clear-text:
AA AA 03 00 00 00 08 {00/06} depending if IP/ARP.
Send data in 802.11 fragments of 4 data bytes + 4 CRC32 bytes all encrypted using the PRGA recovered and with IV X.
I take it that this is what was released at toorcon last week. Been looking forward to checking it out.
renderman is offline   Reply With Quote
Old 09-23-2005   #3 (permalink)
renderman
Drunken Stumbler
 
renderman's Avatar
 
Join Date: Jun 2002
Location: Anywhere but Utah
Posts: 1,794
Great, now your going to make me buy an atheros card

Intriguing method. Any reason it could'nt be ported to a MIPS platform?
renderman is offline   Reply With Quote
Old 09-23-2005   #4 (permalink)
Dutch
Humourless EuroMod.
 
Dutch's Avatar
 
Join Date: Mar 2004
Location: City of Mermaids, Denmark
Posts: 6,813
Quote:
Originally Posted by sorbo
It is possible to send arbitrary data [any length and content] on a WEP network after having eavesdropped a single data packet.

http://darkircop.org/frag-0.1.tgz

The idea is:
Sniff first 8 bytes of cipher-text on packet with IV X.
XOR cipher-text with 8 bytes of clear-text:
AA AA 03 00 00 00 08 {00/06} depending if IP/ARP.
Send data in 802.11 fragments of 4 data bytes + 4 CRC32 bytes all encrypted using the PRGA recovered and with IV X.
Great work sorbo, lotsa information presented in a wellwritten researchpaper.
And damn you too - I want to play with this, but have to little time for new projects.
Could somebody please invent a TimeAddingMachine. Just 1 additional hour a day would be helpfull

Dutch
__________________
All your answers are belong to Google. SEARCH DAMMIT!
Warning. Warning.
Low C8H10N4O2 level detected. Operator halted....
Dutch is offline   Reply With Quote
Reply

« Airsnarf in Auditor Linux | Wireless MADWIFI drivers for use with Aeroplay »

Thread Tools
Display Modes
Linear Mode Linear Mode

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
vB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



Google
 
Web NetStumbler.org

All times are GMT -7. The time now is 05:11 AM.

Contact Us - NetStumbler.org - NetStumbler.com - Online Backup - Archive - Top

Powered by vBulletin® Version 3.6.8
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO 3.0.0 ©2007, Crawlability, Inc.


All messages express the views of the author and are for entertainment purposes only. Netstumbler.org cannot be held responsible for the authenticity of the content or the actions of its members. By using this site and its services, you warrant that you will not post any messages that are discriminating, obscene, hateful, threatening, or otherwise violates any laws and you release Netstumbler.org from any future claims of any kind whatsoever including, but not limited to, addiction and loss of productivity. All forum messages, private messages and any other content are properties of Netstumbler.org. Even if publicly available, personal or copyrighted information are not to be posted without the consent of the owner. Distribution of licensed and copyrighted materials in any way not endorsed by the copyright owner is strictly prohibited. You may not use this site and its resources to spam other sites or individuals or perform any action that violates any law. Items sold or bought in the For Sale forum are sold as is and no warranty or insurance of any kind is provided. Netstumbler.org cannot be held responsible for the outcome of any transactions and no warranty of any kind is provided, either express or implied. Vulgar words are not allowed in the subject lines ; they may be used in the message body in any forum. The Administrator, Super Moderators and Moderators of Netstumbler.org have the right to remove, edit, move or close any thread for any reason and to reveal your identity and other known information in the event of a complaint or legal action arising from any message posted by you.