Instructor: The first encryption 2 2
that we'll learn how to break is called WEP, 3 3
or Wired Equivalent Privacy. 4 4
This is an old encryption, that can be easily broken. 5 5
The reason why I'm still covering it in this course, 6 6
is first of all, because like I said, it's very simple, 7 7
so it's a good starting point. 8 8
Also, it's still used sometimes in some networks. 9 9
Therefore, you can't really call yourself a hacker, 10 10
and then if you see a network that uses WEP, 11 11
you'll get stuck, 12 12
and you won't even be able to break into it. 13 13
So in this lecture, I'm gonna explain how WEP works, 14 14
and what's the weakness that we can use to break it. 15 15
And in the next lecture, 16 16
you'll see how we can use this weakness 17 17
in order to break WEP and get the key 18 18
for any network that uses WEP. 19 19
So basically, WEP uses an algorithm called RC4 20 20
to encrypt its the data. 21 21
So the way this works is basically, 22 22
if a client wants to send something to the router, 23 23
and let's say it wants to send this text, 24 24
data to send to the router, 25 25
it will first encrypt this using a key. 26 26
Therefore this normal text will be converted into gibberish 27 27
as you can see here. 28 28
This encrypted packet will be sent into the air, 29 29
so if a hacker captures this packet as we seen before, 30 30
if we open this packet, 31 31
we'll see that it's full of gibberish. 32 32
Even though it actually contains useful information, 33 33
we won't be able to read it because it's encrypted. 34 34
The access point will receive this encrypted packet, 35 35
and it will be able to transform it 36 36
back to its original form because it has the key. 37 37
Therefore, it'll actually be able to read the contents 38 38
which is, data to send to the router. 39 39
The same happens if the router 40 40
wants to send something back to the client, 41 41
it will first encrypt it using a key, 42 42
send it to the client, 43 43
the client will be able to decrypt it 44 44
because it has the key. 45 45
So the concept is always the same, 46 46
the transmitter encrypts the data using a key, 47 47
sends it to the receiver, 48 48
the receiver is able to decrypt it, 49 49
because it also has the key, therefore, 50 50
anybody who captures the packet in the middle, 51 51
they will get the packet, 52 52
but they won't be able to see the contents 53 53
because they do not have the key. 54 54
So the algorithm and the way RC4 works is actually fine, 55 55
the problem is with the way 56 56
that WEP implement this algorithm. 57 57
And to understand it, 58 58
let's zoom in a little bit more on each step. 59 59
So going back to the first step, 60 60
we have the client trying to send data to the router, 61 61
and the data that wants to send is, 62 62
data to send to the router. 63 63
So in order to encrypt this, 64 64
WEP tries to generate a unique key for each packet. 65 65
So literally each packet that's sent into the air, 66 66
it tries to create a new unique key for it, to do that, 67 67
it generates a random 24 bit initialization vector. 68 68
The initialization vector is then added to the password 69 69
of the network to the actual key 70 70
that people use to connect to the network. 71 71
This generates a key stream, 72 72
and then this key stream is used to encrypt this packet 73 73
and transform it into gibberish. 74 74
So basically, we have the key stream 75 75
plus the data that we need to encrypt, 76 76
gives us the gibberish, 77 77
and then the gibberish is sent into the air. 78 78
But before sending this into the air, 79 79
WEP will also append the initialization vector. 80 80
This is the 24 bit random number that I said it creates 81 81
in order to make sure that each packet has a unique key. 82 82
The reason why it adds the initialization vector 83 83
to the packet is because 84 84
once the router receives this packet, 85 85
it needs to be able to decrypt it, 86 86
and to decrypt it, it needs the key and the IV. 87 87
But the router already has the key, 88 88
so there is no need to send that. 89 89
Therefore we just need to send it the IV. 90 90
So when the router receives the packet, it has the IV, 91 91
it has the password or the key, 92 92
so it can generate a key stream 93 93
and then use that key stream to transform this gibberish 94 94
into its original form and read the packet. 95 95
So if you think about what I said, 96 96
you can probably guess what the weakness is. 97 97
Basically, the IV is sent in plain text, 98 98
so if you look at this, 99 99
you can see the packet content is encrypted, 100 100
so if someone captures this packet, 101 101
they won't be able to read this, 102 102
but they will be able to read the IV in plain text. 103 103
Also, the size of the IV is only 24 bits. 104 104
Now considering the huge amount of traffic 105 105
that can be generated on a Wi-Fi network, 106 106
this number is not big enough, 107 107
and the IVs will start getting repeated in a busy network. 108 108
This makes WEP vulnerable to statistical attacks, 109 109
so we can use a tool called Aircrack-ng 110 110
to determine the key stream, 111 111
once we have enough repeated IVs. 112 112
And from that it will also be able to crack WEP, 113 113
and give us the key to the network.