Details of WPA hack revealed
In their paper, Practical attacks against WEP and WPAPDF, Martin Beck and Erik Tews have published details about their attacks on WPA secured networks. The attack is essentially a variant of the chopchop attack used against WEP secured networks, which surfaced in early 2005. The name "chopchop attack" is a nod to the KoreK-developed chopchop tool, which allows the user to decrypt an arbitrary encrypted data packet without having to know the WEP key.
The program slices off the last byte of a WEP packet. Under the assumption that the final byte was the zero byte, it attempts to reconstruct a valid checksum with an XOR link from the last four bytes to a specific value. Then it sends the packet to an access point and observes whether it is accepted. If not, it assumes that the sliced off byte was a 1 – in the worst case it continues this process all the way to 256. This process is then repeated for every other byte in the packet. Once finished, the attacker has the packet in plain text.
While the temporal key integrity protocol (TKIP) usually used under WPA also uses the RC4 algorithm, it also implements a number of security measures, including anti-chopchop functions. The wireless connection is dropped if within 60 seconds if more than two packets with an invalid message integrity check (MIC) are received from a client. Furthermore, the TKIP Sequence Counter (TSC) makes it difficult to replay captured packets, which makes chopchop and other replay attacks significantly more difficult. If the TSC of the received packet is lower than the current counter, it is simply thrown out.
