So much for security

[John Navas]

Look for "linksys" in these captures:
<http://i38.tinypic.com/3353w4g.png>
<http://i38.tinypic.com/29zpzt5.png>
--
Best regards, FAQ for Wireless Internet: <http://wireless.navas.us>
John Navas FAQ for Wi-Fi: <http://wireless.navas.us/wiki/Wi-Fi>
Wi-Fi How To: <http://wireless.navas.us/wiki/Wi-Fi_HowTo>
Fixes to Wi-Fi Problems: <http://wireless.navas.us/wiki/Wi-Fi_Fixes>

[Jeff Liebermann]

On Tue, 09 Dec 2008 23:24:18 -0800, John Navas
<spamfilter1@navasgroup.com> wrote:

>Look for "linksys" in these captures:
><http://i38.tinypic.com/3353w4g.png>
><http://i38.tinypic.com/29zpzt5.png>

Only 3 open wireless access points?
How about 11,633,000 (and climbing):
<http://www.wefi.com>
Winner of the most open access points is (insert drum roll):
San Francisco:
<http://www.wefi.com/maps/?q=san%20francisco>

It's not a security problem... it's a resource.



--
Jeff Liebermann jeffl@cruzio.com
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558

[John Navas]

On Sat, 13 Dec 2008 16:05:27 -0800, Jeff Liebermann <jeffl@cruzio.com>
wrote in <mui8k45bl0o1na6in4l4luip3lr66un9im@4ax.com>:

>On Tue, 09 Dec 2008 23:24:18 -0800, John Navas
><spamfilter1@navasgroup.com> wrote:
>
>>Look for "linksys" in these captures:
>><http://i38.tinypic.com/3353w4g.png>
>><http://i38.tinypic.com/29zpzt5.png>
>
>Only 3 open wireless access points?

Most of the rest were running WEP, which is pretty much the same thing.
;)
--
Best regards, FAQ for Wireless Internet: <http://wireless.navas.us>
John Navas FAQ for Wi-Fi: <http://wireless.navas.us/wiki/Wi-Fi>
Wi-Fi How To: <http://wireless.navas.us/wiki/Wi-Fi_HowTo>
Fixes to Wi-Fi Problems: <http://wireless.navas.us/wiki/Wi-Fi_Fixes>

[Jeff Liebermann]

On Sat, 13 Dec 2008 16:49:49 -0800, John Navas
<spamfilter1@navasgroup.com> wrote:

>On Sat, 13 Dec 2008 16:05:27 -0800, Jeff Liebermann <jeffl@cruzio.com>
>wrote in <mui8k45bl0o1na6in4l4luip3lr66un9im@4ax.com>:
>
>>On Tue, 09 Dec 2008 23:24:18 -0800, John Navas
>><spamfilter1@navasgroup.com> wrote:
>>
>>>Look for "linksys" in these captures:
>>><http://i38.tinypic.com/3353w4g.png>
>>><http://i38.tinypic.com/29zpzt5.png>
>>
>>Only 3 open wireless access points?

>Most of the rest were running WEP, which is pretty much the same thing.
>;)

Yep. I only saw one 2wire router on your list. Around here, they're
far more common. The default encryption is 64bit WEP with the Hex
encyption key printed on the serial number tag. This is despite the
fact that the Atheros chipset and firmware supports WPA/WPA2. I once
tried various WEP crackers on a 2wire router and couln't get enough
IV's to deduce the WEP key. They might be running WEP+, dynamic WEP,
or WEP2, but there's no documentation indicating such. Oh well.

--
Jeff Liebermann jeffl@cruzio.com
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558

[Char Jackson]

On Sat, 13 Dec 2008 17:30:38 -0800, Jeff Liebermann <jeffl@cruzio.com>
wrote:

>On Sat, 13 Dec 2008 16:49:49 -0800, John Navas
><spamfilter1@navasgroup.com> wrote:
>
>>On Sat, 13 Dec 2008 16:05:27 -0800, Jeff Liebermann <jeffl@cruzio.com>
>>wrote in <mui8k45bl0o1na6in4l4luip3lr66un9im@4ax.com>:
>>
>>>On Tue, 09 Dec 2008 23:24:18 -0800, John Navas
>>><spamfilter1@navasgroup.com> wrote:
>>>
>>>>Look for "linksys" in these captures:
>>>><http://i38.tinypic.com/3353w4g.png>
>>>><http://i38.tinypic.com/29zpzt5.png>
>>>
>>>Only 3 open wireless access points?
>
>>Most of the rest were running WEP, which is pretty much the same thing.
>>;)
>
>Yep. I only saw one 2wire router on your list. Around here, they're
>far more common. The default encryption is 64bit WEP with the Hex
>encyption key printed on the serial number tag. This is despite the
>fact that the Atheros chipset and firmware supports WPA/WPA2. I once
>tried various WEP crackers on a 2wire router and couln't get enough
>IV's to deduce the WEP key. They might be running WEP+, dynamic WEP,
>or WEP2, but there's no documentation indicating such. Oh well.

Out here in the Midwest, the 2Wire networks run plain old WEP by
default. Average time to gain the key is about 3-5 minutes if packet
injection is used, much longer without. Piece of cake and really
drives home the concept that WEP is broken.

[Jeff Liebermann]

On Sat, 13 Dec 2008 20:44:44 -0600, Char Jackson <none@none.invalid>
wrote:

>On Sat, 13 Dec 2008 17:30:38 -0800, Jeff Liebermann <jeffl@cruzio.com>
>wrote:
>
>>On Sat, 13 Dec 2008 16:49:49 -0800, John Navas
>><spamfilter1@navasgroup.com> wrote:
>>
>>>On Sat, 13 Dec 2008 16:05:27 -0800, Jeff Liebermann <jeffl@cruzio.com>
>>>wrote in <mui8k45bl0o1na6in4l4luip3lr66un9im@4ax.com>:
>>>
>>>>On Tue, 09 Dec 2008 23:24:18 -0800, John Navas
>>>><spamfilter1@navasgroup.com> wrote:
>>>>
>>>>>Look for "linksys" in these captures:
>>>>><http://i38.tinypic.com/3353w4g.png>
>>>>><http://i38.tinypic.com/29zpzt5.png>
>>>>
>>>>Only 3 open wireless access points?
>>
>>>Most of the rest were running WEP, which is pretty much the same thing.
>>>;)
>>
>>Yep. I only saw one 2wire router on your list. Around here, they're
>>far more common. The default encryption is 64bit WEP with the Hex
>>encyption key printed on the serial number tag. This is despite the
>>fact that the Atheros chipset and firmware supports WPA/WPA2. I once
>>tried various WEP crackers on a 2wire router and couln't get enough
>>IV's to deduce the WEP key. They might be running WEP+, dynamic WEP,
>>or WEP2, but there's no documentation indicating such. Oh well.

>Out here in the Midwest, the 2Wire networks run plain old WEP by
>default. Average time to gain the key is about 3-5 minutes if packet
>injection is used, much longer without. Piece of cake and really
>drives home the concept that WEP is broken.

OK. That makes sense. 2wire uses Atheros wireless chips in the
current wireless routers (2700HG and 2701HG) which don't support any
of the "enhanced" WEP modes. I'm not sure what I was doing wrong, but
if you can crack it, then 2wire is not using WEPplus etc. I just
found a 2701HG router (without power supply) at the local thrift shop.
I'll give aircrack-ptw a try.

As John said "so much for security".

--
Jeff Liebermann jeffl@cruzio.com
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558

[Jeff Liebermann]

On Sat, 13 Dec 2008 16:49:49 -0800, John Navas
<spamfilter1@navasgroup.com> wrote:

>On Sat, 13 Dec 2008 16:05:27 -0800, Jeff Liebermann <jeffl@cruzio.com>
>wrote in <mui8k45bl0o1na6in4l4luip3lr66un9im@4ax.com>:
>
>>On Tue, 09 Dec 2008 23:24:18 -0800, John Navas
>><spamfilter1@navasgroup.com> wrote:
>>
>>>Look for "linksys" in these captures:
>>><http://i38.tinypic.com/3353w4g.png>
>>><http://i38.tinypic.com/29zpzt5.png>
>>
>>Only 3 open wireless access points?
>
>Most of the rest were running WEP, which is pretty much the same thing.
>;)

So, let's see how my neighborhood is doing from my laptop:
<http://802.11junk.com/jeffl/crud/2008-12-13-hop.jpg>
12 wireless systems.
4 with no encryption.
3 using WEP (All of them 2wire)
4 using WPA
1 using WPA2
3 using the default SSID
Yech.
Actually there are only 11 systems. 1540 Jackson Ave and TESTNET are
the dual SSID's of my wireless router.


--
Jeff Liebermann jeffl@cruzio.com
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558