Why is anyone still using WEP?
Wireless internet access is everywhere these days. Everyone from restaurants and bars to the average Joe Homeowner has some sort of wifi network set up. The problem is that they set up these networks without giving security a second thought (or even a first thought in most cases). I was at the TRISC conference last month and heard SimpleNomad say that he doesn’t pay for internet access anywhere any more because there’s always an unsecured or poorly secured wireless network wherever he goes. Lately, I’ve been testing that and he’s absolutely right. I’m the only person on my block not running either an open network or a WEP “protected” network. I was even at a local hospital the other day and their “secure” internal network was using WEP.
For those of you just catching up, WEP is an almost 10 year old wireless protocol whose intent was to encrypt your wireless transmissions. The problem is that WEP uses a user-defined key along with an “initialization vector” (IV) to generate the RC4 traffic key used to encrypt your data. If I can gather enough of these IV’s, then I can figure out what the key is and your network is now pwned. I can speed up this process by injecting my own packets and I can get your key in under 3 minutes. How’s that for security?
So, why is anyone still using WEP? It was deprecated as a wireless privacy mechanism back in 2004. It is easily cracked and provides slightly more security than running an open wireless network. All that and when you buy a new wireless router it’s most likely still pre-configured with WEP enabled. On some of these older models better encryption standards such as WPA or WPA2 aren’t even options. With much of the wireless network setup falling into the hands of novice users, some of the responsibility lies with the router manufacturers for even allowing them to use WEP. The rest, in my opinion, is on the users themselves, who put up these networks without being educated enough to do so. You wouldn’t put a door on your home without making sure the locks worked, would you? How about buying a car where everyone with that model vehicle had your same key? I think you get the picture.
June 10th, 2008 at 1:46 pm
I think WEP still has a place for public WiFi if you have a separated network with no other nodes and internet access only. Mostly because if they are in an untrusted zone, then you want some level of security and you don’t want to have to handle complaints because their laptop doesnt support WPA. On our network a non-trusted zone that is for visitors to the office and random devices like iPhones… We use WEP because it is slightly better that an open network and there is no support burden, it just works.
June 10th, 2008 at 2:09 pm
Sure, if you don’t care about the security of your “customers” then by all means set up a WEP access point. WEP may provide them the peace of mind of having an “encrypted” connection, but because of how easily it is cracked, you’d probably be better off providing an Open wireless network. At least then the customer doesn’t have the fascade of security and it’d “just work” even better than WEP.
The point here is that you either have a secure access point or you don’t. Because of the protocol flaws, WEP should fall into the unsecure category and should ALWAYS be treated as such. Not supporting WPA is a vendor problem and should not be an excuse for settling on WEP encryption.
June 10th, 2008 at 5:53 pm
Well, I ain’t giving bandwidth away here, so a little deterrent is better than nothing… I disagree with having an Open access point and for us it is for short term access.