The rumors of WEP’s demise are not only true, they’re long over due. Yes, in a significant sense WEP was dead even before it launched a decade or so ago.
WEP—or Wired Equivalent Privacy—was the ill-fated “security” layer around early 802.11b, 802.11a, and 802.11g networks. And yes, it is still supported as a legacy feature in most Wi-Fi routers these days.
NOTE: If you are using WEP, run screaming from it. Upgrade immediately. Turn it off, even. You’re far better off moving your network security up one layer to an IPSec-based VPN technology.(But VPN technology is another topic for another time and column.)
Yes, WEP is a classic example of a failed design by a committee. But rather than just ridiculing it from afar, let’s explore what lessons we can glean from the experience. As an engineer by training, I’ve always felt that, while we shouldn’t embracefailure, we should always examine it and see how we can prevent similar failures in the future.
First, just what’s so bad about it? There have been countless papers published in the past several years providing one WEP design flaw after another. The symmetric session key is shared and extremely difficult to manage. Much of the key itself is transmitted in plaintext over the network for any eavesdropper to intercept. The list goes on. It is currently estimated that any WEP “protected” network can be cracked in about a minute using commonly and freely available tools. Go “Google it” for yourself and see.
More Wireless Security
So, what went wrong? Wasn’t the design committee aware of these problems? Well, I’m not a cryptographer and I wasn’t present in the meetings where the design was debated, so I can only speculate. I have no doubt that any competent cryptographer that was present should be ashamed, and if no competent cryptographers were present, then whoever decided on the committee participants should be ashamed. Perhaps it was the age-old problem of the designers focusing too much on functional specification and not enough on what things can go wrong with a design.
If we compare WEP’s design process with how NIST selected the Advanced Encryption Standard (AES), however, there are vast differences. The AES process invited all comers to submit their encryption algorithms, which were then subjected to an extended period of public scrutiny and open discussion. Finally, the winning algorithm (Rijndael, after the two Belgian cryptographers who invented it) was selected.
Now, I fully realize that a crypto algorithm is different than a cryptographic network protocol, but perhaps using a similar process could have resulted in catching the most egregious of the defects before the standard was ratified? Perhaps that’s too naive an outlook, or perhaps it would have been too slow to enable the product vendors to get their products to market in any reasonable period of time. But I can’t help but think we squandered an opportunity to prevent disaster here.
Yes, disaster is a strong word, but consider what WEP’s failures have resulted in. From its earliest days of existence, WEP has been the whipping boy—sorry, that’s too easy of a pun even for an engineer—of the infosec community. So many “WEP is broken” articles were published that I firmly believe many people avoided Wi-Fi altogether for fear of being compromised by a war driverin a white van in the parking lot with a [famous name brand] potato chip can Yagi antenna. (Those fears weren’t entirely unwarranted.)
Indeed, I am convinced many organizations still fear wireless networks because of all the uproar caused by WEP.
These days, Wi-Fi Protected Access (WPA), in its various shapes and sizes, is readily available and supported, and by all accounts, it is substantially more secure than its predecessor. However, in many ways, the damage has already been done. I’m sure that WPA was slow to gain acceptance because of its association (by perception) to WEP.
In my own travels, I rarely find WPA protected networks in public places. Almost all of the commercial hotspot services have opted to use no network encryption and to move their security inward—leaving the customers responsible for defending their own data.
So, where are the big lessons in this debacle? Here are a few to consider:
- Scrutinize designs rigorously prior to releasing them. I’m a big believer in public scrutiny, but if that’s not feasible, then ensure an independent team thoroughly reviews all designs before they’re released.
- Infrastructure security defects have long-term negative impacts. As such, deciding on how to secure them should be a matter of extreme importance, which may take longer than commercial organizations want, but the longer-term payoffs are worth it.
- We’ve got to demand more of our product vendors. We can’t afford mistakes like WEP to happen.
- Don’t put all your security faith in one mechanism. Even if WPA proves itself to be highly adequate for most purposes, multiple security layers are still a good idea considering the fact that our business data is flying through the air and can be easily intercepted by miscreants who wish us harm.
I’ll bet most of the world is blissfully unaware of the problems in WEP, but we’re all feeling the pain nonetheless. I have no doubt at all that Wi-Fi would be vastly more accepted in enterprises today had it not been for WEP. Let’s not let it happen again.
Article courtesy of eSecurity Planet
