WiFi encryption cracked in 15 minutes. What does it mean for me?
Two researchers were scheduled to reveal that the WPA WiFi encryption system could be cracked in just 15 minutes at the PacSec event taking place in Japan in mid-November.
WPA has always been held up as an extremely strong encryption system that is vastly superior for the older WEP standard, which has been 'crackable' for some time. Plans call for the research team - Erik Tews and Martin Beck - to demonstrate their findings in Tokyo in a live demonstration, which Tews plans on following up with full publication of his modus operandi in an IT research journal in the next few months.
So what does this mean for WiFi home/small office router users?
Basically it means that the older WEP and WPA encryption systems cannot be regarded as secure against hackers. Cracking the encryption system takes time - perhaps 15 minutes on the WEP system and longer on the WPA system.
The WPA-2 encryption system, seen on most routers has not, however, been compromised, so it's a good idea to move on up to that system wherever possible.
The good news is that it will take a dedicated hacker to crack your WPA-encrypted WiFi sessions so, if you're using your WiFi router for routine email and Web surfing, it's not critical to update to WPA-2 technology.
It is important to realise however, that a `Secure' Web session - where a `padlocked' green bar appears in the Web address, or a padlock appears in the browser - may not be secure against WEP and WPA hackers as, depending on the way office system is set up, anything you see on your browser screen could be readable by hackers.
This means that, unless your WiFi system is specifically protected with WPA-2 encryption, you should not be accessing online banking and other potentially hackable online systems using a wireless connection.
This also applies to using public access WiFi connections such as BT Openzone and The Cloud, as you cannot be sure of the integrity of public connections.
Curiously, however, these precautions do not apply to mobile broadband sessions via a 3G dongle, as these networks are, so far, impervious to hacker attacks.
Relevant guides:
Data Security Training
Securing Computer Data
By Steve Gold, News Editor
