If you’re still using WEP (Wireless Encryption Protocol) to secure your wireless networks, you’re basically wasting your time. Thiis is especially true now that WPA has been hacked (using a practical attack against a known vulnerability) in less than a minute. That’s incredibly bad news, especially since so many sites use this level of encryption to “protect” data.

The situation is clear. “Unfortunately, many companies in the payment card industry are still using WEP, and many more have upgraded to WPA only to find that neither technology is now secure.” The WPA attack has been known for some time, but only recently has been demonstrated in a real situation. Theoretical attacks are one thing…but they’re irrelevant unless someone shows they can be put to practical use by hackers and others with limited resources.

So the best bet is to move to WPA2, since it is (at least for now) secure and unbroken. This said, the hack to WPA doesn’t mean you need to move your home network to WPA2…unless you regularly gain access to restricted data or confidential information, and there’s a reasonable chance someone is listening in. I live in a fairly remote area, and there are no nearby WiFi networks. The likelihood that someone will be listening in on my transmissions is next to zero.

The people who really need to worry are those in financial services, health care, and other businesses whose daily activities involved sensitive data. In these situations, someone could easily drop an unauthorized device in the right location and potentially listen in on WPA-encrypted business traffic. For these businesses, probably the only option is to upgrade to WPA2 as soon as practically possible. This version of WPA adds NAC to help automate key management as well as RADIUS based authentications. It hopefully it provides proactive security that will make it more secure over a longer term.

Nothing is guaranteed…an announcement of a WPA2 crack could occur at any time. Until that happens, it’s the best wireless encryption you can get from a practical sense.

This entry was posted on Wednesday, September 2nd, 2009 at 5:53 am and is filed under Encryption, Privacy. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.