Reinforce your router against the WPA encryption hack

If you thought WPA Wi-Fi encryption was the bullet-proof alternative to the wide-open WEP, think again. A German graduate student Erik Tews claims to have discovered a security exploit in WPA encryption and plans to present a paper on his findings at the PacSec conference in Tokyo this week.

It’s far from a gaping security hole – the exploit takes up to 15 minutes to effect and does not allow the WPA encryption keys to be discovered. In fact Tews states that so far, it simply allows correctly-encrypted information to be injected into the network so that they appear to be sent from the router. In other words, it cannot be used to break into a wireless network, nor decipher all of its data – yet.

However, the exploit only applies to networks that use WPA encryption with the TKIP protocol. If that applies to your network, then there is a simple solution to lock it down again – simply switch to the AES protocol (using TKIP/AES is not sufficient). Tews also recommends using a Wi-Fi encryption key of 20 more or less random characters to defeat any brute-force cracking attempts (something that his exploit doesn’t use, incidentally).

[ ITworld]