Hackers poised to land at wireless AirPort

The group, which includes a computer-science professor at the University of California at Berkeley, a recent graduate and a current computer-science student, discovered the weaknesses in the so-called Wired Equivalent Privacy algorithm, or WEP. The security measure is employed in the wildly popular 802.11b wireless networking technologies that allow people to connect to networks using simple radio antennas in their laptop or desktop PCs.

The technology, also called Wi-Fi, is sold by many vendors but was popularized by Apple Computer (aapl) under the name AirPort and is quickly being deployed in networks at a growing number of businesses, college campuses, hotels and airports. By the end of 2001, an estimated 10 million Wi-Fi radios will be deployed, according to research firm Cahners In-Stat. Starbucks, for instance, plans to use the technology to allow latte quaffers to noodle around the Internet.

"We found a number of ways to intercept transmissions and discover what the contents are," says Nikita Borisov, a 23-year-old graduate student at Berkeley. "We found ways to modify transmissions as they're sent. And we found ways to access the network even if it's restricted." Borisov, along with professor David Wagner and recent graduate Ian Goldberg, Friday published their findings on the Internet.

The weakness is yet another reminder of the intractable difficulties in implementing effective network security. For years researchers have discovered frailties in hardware and software manufactured by some of the world's most revered and valuable companies. In recent years, companies such as Microsoft (msft) and Netscape Communications have had to address browser vulnerabilities, for example, brought to light by network-security specialists around the globe. Goldberg himself found a significant flaw in the Netscape browser in 1995. Most recently, he and others discovered a vulnerability that would allow a hacker to eavesdrop on conversations held on GSM phones, a cellphone technology used in Europe. Cryptographers decry the fact that the underlying security mechanisms aren't submitted to the security community at large to test them until after products have been shipped to market.

The group behind the latest discovery is no different. "During the design process, the crypto community wasn't invited to participate," says Goldberg, now chief scientist at Zero Knowledge Systems Inc., a privacy-software firm in Montreal.

Earlier versions of Wi-Fi were devised in 1997 by a group of volunteer technologists at the Institute of Electrical and Electronics Engineers, or IEEE. Wi-Fi proponents dispute that technical specifications were anything but open to peer review. The charges of secrecy are "absolutely not true," says Greg Ennis, technical director of the Wireless Ethernet Compatibility Alliance and a former member of the IEEE. "It is open to anybody," he said.

Ennis agrees that the newest vulnerabilities are an issue of concern. The Wired Equivalent Privacy system, he says, "has been known from the outset not to be an end-all-be-all security system." Like others, he advocates the use of additional security measures that would prevent unlawful breaches of privacy, such as virtual private-network technology that transmits data through an encrypted "tunnel." He adds that the IEEE is working on future versions that won't be vulnerable.

But Ennis says this type of attack "requires a significant mounted effort" to accomplish.

Beware of script kiddies
The researchers counter, however, that once someone writes a piece of software, known as a "script," to exploit the weakness, it can be distributed to "script kiddies" who don't need expertise to mount the attack. Such tools "will probably be written, after which a high degree of investment will no longer be needed," says Harvie Branscomb, who built one of the first public-access wireless networks.

Traditionally, human error has compounded network-security issues and wireless networks are no exception. Many businesses deploy wireless networks, connected to their internal conventional networks, without activating security measures such as WEP. One computer-security consultant in New York, who asked not to be identified, said he was able to access the computer network of his client, a major financial-services firm on Wall Street, while sitting on a bench across the street. Though he didn't have free range of the network, it was as if he walked through the building lobby, past a receptionist and sat down at one of the firm's computers.

"From a taxi driving by you could gain access to their network," he said. That is the unique challenge of wireless networks: Radio transmitters beam out data beyond the walls of buildings.

The latest vulnerabilities also point to human error in the design. "Some of the mistakes they made are howlers," said Steven Bellovin, a security researcher at AT&T.

One weakness resides in the system that scrutinizes data packets when they are received at a destination. The system, called a "checksum," applies a mathematical formula to the contents of the packet of data and generates a number. When the packet of data is received, its checksum is recalculated to ensure that the packet hasn't been corrupted or modified. The Berkeley researchers found, however, that the packets and their checksum could be modified without detection.