TKIP WPA

ATTACK
09CS6048 Maj A S Sidhu
Project Guide
Prof A K Majumdar
PREVIEW
 WHY TKIP ATTACK?
 UNDERSTANDING TKIP
 TKIP EXPLOIT
 ATTACK TOOL
 PROPOSED COUNTERMEASURES
 PROPOSED FINAL SOLUTION
WHY TKIP ATTACK?
 WEP DECLARED AS VULNERABLE
 TKIP (PART OF WPA) IN VOGUE SINCE 2003
 BEING THOUGHT OF AS NON VULNERABLE
 NO MAJOR ATTACKS
 FIRST CONSIDERABLE ATTACK ON TKIP
 NO SOLUTION PROPOSED YET
UNDERSTANDING TKIP
WPA WAS INCORPORATED IN A MANNER THAT IT
CAN BE USED IN DEVICES USING WEP WITH ONLY A
SOFTWARE/ FIRMWARE UPGRADE
VULNERABILITIES IN WEP
 FLAWED IMPLEMENTATION OF IVs
 SHORT IV ( 24 BIT)
 IVs REPEATED (STATIC KEY)
 VULNERABILITY IN KEY SCHEDULING
WPA
 STANDARD BASED, INTEROPERABLE SECURITY
ENHANCEMENTS THAT STRONGLY INCREASE THE LEVEL OF
DATA PROTECTION AND ACCESS CONTROL FOR EXISTING
AND FUTURE WIRELESS LAN SYSTEM.
 USER AUTHENTICATION
 802.1X
 EAP
 TKIP (TEMPORAL KEY INTEGRITY PROTOCOL) ENCRYPTION
 RC4, DYNAMIC ENCRYPTION KEYS (SESSION BASED)
 48 BIT IV
 PER PACKET KEY MIXING FUNCTION
 FIXES ALL ISSUES FOUND FROM WEP
 USES MESSAGE INTEGRITY CODE (MIC)
 ENSURES DATA INTEGRITY
TKIP FEATURES
 IMPLEMENTS A KEY MIXING FUNCTION THAT
COMBINES THE SECRET ROOT KEY WITH THE
INITIALIZATION VECTOR BEFORE PASSING IT TO
THE RC4 INITIALIZATION.
 IMPLEMENTS A SEQUENCE COUNTER TO
PROTECT AGAINST REPLAY ATTACKS.
 IMPLEMENTS A 64-BIT MESSAGE INTEGRITY
CHECK NAMED MICHAEL
 PROVIDES A REKEYING MECHANISM
 ENSURES THAT EVERY DATA PACKET IS SENT WITH
A UNIQUE ENCRYPTION KEY.
TKIP EXPLOIT
TKIP DATA FRAME

PLAIN ENCRYPTED

MAC
IV/ TSC DATA MIC ICV
HEADER
 TKIP ENCRYPTION/ DECRYPTION
E PLAINTEXT TSC+ D
PACKET(P) ENCRYPTED
N E
CALCULATE P+MIC+ICV
C MIC C
R R
P + MIC CHECK DROP
Y TSC
Y
CALCULATE
P ICV ENCRYPTION P
VALID KEY
T P + MIC CALCULATION T
I +ICV I
GET NEXT
O TSC DECRYPT O
DATA
N N
ENCRYPTION CHECK
KEY ICV DROP
P CALCULATION P
R VALID R
O ENCRYPT TSC+ CHECK TRANSMIT O
ENCRYPTED MIC ERROR
C P+MIC +ICV C
P+MIC+ICV VALID
E E
S PROCESS DROP S
S PACKET S
THEORY BEHIND EXPLOIT
 ICV FAILURE GENERATES NO NETWORK
ACTIVITY
 MIC FAILURE CAUSES THE CLIENT TO GENERATE
A NOTICE THE ATTACKER CAN OBSERVE
 IF MIC FAILURE OBSERVED, ICV PASSED!
 TAKE A PACKET, CHOP LAST BYTE, GUESS FIX
AND TX UNTIL MIC FAILURE OBSERVED
 WAIT 60 SECONDS TO NOT TRIGGER
COUNTERMEASURES
 REPEAT FOR NEXT-TO-LAST BYTE
 TKIP ICV ATTACK

Attacker waits
3. Client 4. A MIC failure 60 seconds to
2. Attacker message is sent to avoid MIC
1. Attacker receives
removes last AP to coordinate countermeasu
captures frame, most
payload byte, Michael res, then
TKIP have ICV
invalidating Countermeasures. repeats
encrypted failures and
ICV and MIC. Though encrypted, process with
packet are attacker can 66 byte
Attempts to fix
that dropped. observe this frame Packet.
ICV with guess0
looks like One passes to identify valid Continues
and sends to
ARP ICV, but ICV, revealing one until all packet
station.
fails MIC. byte of plaintext. plaintext is
known.
IMPACT OF TKIP EXPLOIT
 FIRST AND FOREMOST, IT IS NOT A KEY
RECOVERY EXPLOIT.
 IT ONLY WORKS IF CLIENT USES QoS FEATURE
OF 802.11e/WMM.
 IT IS SLOW. THERE HAS TO BE LEAD TIME OF
ABOUT 12 MINUTES BEFORE ANY PACKET III.
INJECTION CAN BE DONE. THEREAFTER, 7-15
PACKETS CAN BE INJECTED EVERY 4 MINUTES
 THE INJECTED PACKETS HAVE TO BE VERY
SMALL, SAY, LESS THAN 100 BYTES.
 PACKET INJECTION IN AP IS NOT POSSIBLE.
MICHAEL WEAKNESS
 MICHAEL IS INVERTIBLE; YOU CAN DETERMINE
THE KEY FROM PLAINTEXT + MIC
 ATTACKER DECRYPTS ARP, KNOWS MICHAEL
KEY AND CAN CRAFT ANY PACKET UP TO 68
BYTES
 ATTACKER CAN USE OTHER QOS QUEUES
WHERE ATTACKED
 TSC IS LOWER TO INJECT ARBITRARY PACKETS
INTO NETWORK (CAN TARGET ANY
DESTINATION OR PROTOCOL)
ATTACK TOOL
 tkiptun-ng
 ATTACK TOOL IN Aircrack-ng SOURCE
REPOSITORY
 INCOMPLETE, DOESN’T WORK IN CURRENT
FORM
 LIKELY TO IMPLEMENT ATTACK DESCRIBED,
EXTRACTING PLAINTEXT, INJECTING NEW
PACKETS
PROPOSED COUNTERMEASURES
 USE OF AES – CCMP ENCRYPTION
 TKIP KEY ROTATION.
 BROADCAST KEYS CAN ALSO BE
PERIODICALLY ROTATED.
 FREQUENT KEY ROTATION
 DISABLE QoS IF NOT REQUIRED
PROPOSED FINAL SOLUTION
TO DEVELOP A PATCH WHICH CAN BE USED
TO AUTOMATICALLY DETECT AND PREVENT
TKIP ICV ATTACK AND THEREBY NULLIFYING
THE EFFECT OF THE VULNERABILITY IN TKIP IN
ITS PRESENT FORM AND REDUCE FURTHER
EXPLOITATION OF THE VULNERABILITY FOR
FORMING ATTACKS.