Cracking WEP the FBI way

WEP also known as Wired Equivalent Privacy was intended to provide comparable confidentiality to a traditional wired network. Several security weaknesses have been identified. Despite the weaknesses, WEP provides a level of security that can deter casual snooping.

The FBI method relies on the following tools: Kismet and Aircrack. Both can be found on Linux live cds such as knoppix.

Do the following if you have the tools available:

1. Run Kismet to find your target network. Get the SSID and the channel.
2. Run Airodump and start capturing data.
3. With Aireplay, start replaying a packet on the target network. (You can find a ‘good packet’ by looking at the BSSID MAC on Kismet and comparing it to the captured packet’s BSSID MAC)
4. Watch as Airodump goes crazy with new IVs. Thanks to Aireplay.
5. Stop Airodump when you have about 1,000 IVs.
6. Run Aircrack on the captured file.
7. You should see the WEP key infront of you now.

Update: WEP and WPA are no longer considered secure standards for wireless data transactions. It is highly recommended to enable WPA2-PSK in the wireless router if available. While it is also possible to attack WPA2-PSK wireless connections, success is not likely.

Please consult the manual of your router to find out how to change or modify the encryption method used by your wireless router. While we are at it, it is recommended to change the default admin password and username to improve router security significantly. Additional security measures, like disabling SSID broadcasting, filtering MAC addresses or changing the default SSID of the router have been proven to be ineffective to protect the wireless router from attacks.

The wireless research paper is still available. It details 802.11 security vulnerabilities. The latest vulnerability listed dates back to February 2002 though, it is therefor recommended to check other sources for more recent discoveries.

Related Articles:

Author: Martin Brinkmann, Sunday July 2, 2006 -
Tags:wep, wpa, wpa2

Responses so far:

1. pad says:

   July 3, 2006 at 2:28 pm

   but u need a minimum of 100.000 IVs. sometimes it works with 80.000 IVS. but 1.000 THATS NOT CORRECT !

   Reply
2. Matt says:

   January 10, 2010 at 11:21 pm

   That’s nothing Special I hack wep on my iPhone in under 5 min now that’s cool and nobody can say it’s not :)

   Reply
3. esa says:

   May 12, 2011 at 5:12 pm

   T I hack wep with my pee-pee in under 5 min now that’s cool and nobody can say it’s not

   Reply