Cafe Latte attack steals credentials from Wi-Fi clients

Would you like a corporate login with that espresso?


Hackers have refined a new technique for breaking into Wi-Fi networks protected by the aging Wired Equivalent Privacy (WEP).

The so-called 'Cafe Latte' attack aims to retrieve the WEP keys from the PCs of road warriors. The approach concentrates its attack on wireless clients, as opposed to earlier attacks that cracked the key on wireless networks after sniffing a sufficient amount of traffic on a network.

"At its core, the attack uses various behavioral characteristics of the Windows wireless stack along with already known flaws in WEP," explains Vivek Ramachandran, a security researcher at AirTight Networks, who will demonstrate the approach at the Toorcon hacking conference in San Diego this weekend (19-21 October). "Depending upon the network configuration of the authorised network we will show that it is possible to recover the WEP key from an isolated Client within a time slot ranging between just a few minutes to a couple of hours."

The attack relies on a laptop's attempt to connect to a WEP-protected network as a means to trick it into sending thousands of WEP-encrypted ARP (Address Resolution Protocol) requests.

ARP is a network protocol that maps between a network layer address and a data link layer hardware address. ARP, for example, is used to resolve IP addresses to their corresponding Ethernet address. This is necessary because a host in an Ethernet network can only communicate with another host if it knows the MAC address.

Manipulating this process can generate a bundle of WEP-encrypted ARP traffic. This data is then analysed to extract a WEP key.

An attacker can then present his machine as a bridge to the internet towards prospective victims, inspecting their traffic and potentially installing files on compromised PCs.

The shortcomings in WEP have been known for years. In April other researchers revealed a technique that might be used to break the protocol in under two minutes, far less than needed for the Cafe Latte attack.

Despite this, WEP remains widely used in consumer, small business and retail environments. WPA (Wi-Fi Protected Access) system replaced WEP years ago but an estimated 41 per cent of businesses continue to use WEP, Infoworld reports.

Early Wi-Fi technology fitted in retail point-of-sale terminals, and warehouses reportedly support only WEP. Hackers who obtained millions of credit card records from TJX, the giant US retailer, are thought to have used these shortcomings to break into its systems.

The Cafe Latte attack also has implications for the development of more sophisticated honeypots, according to Ramachandran and Md Sohail Ahmad, a colleague at AirTight who helped develop the approach.

"This presentation debunking the age-old myth that to crack WEP, the attacker needs to be in the RF (radio) vicinity of the authorised network," Ramachandran and Ahmad explain. ®


Other stories you might like

  • Robotics and 5G to spur growth of SoC industry – report
    Big OEMs hogging production and COVID causing supply issues

    The system-on-chip (SoC) side of the semiconductor industry is poised for growth between now and 2026, when it's predicted to be worth $6.85 billion, according to an analyst's report. 

    Chances are good that there's an SoC-powered device within arm's reach of you: the tiny integrated circuits contain everything needed for a basic computer, leading to their proliferation in mobile, IoT and smart devices. 

    The report predicting the growth comes from advisory biz Technavio, which looked at a long list of companies in the SoC market. Vendors it analyzed include Apple, Broadcom, Intel, Nvidia, TSMC, Toshiba, and more. The company predicts that much of the growth between now and 2026 will stem primarily from robotics and 5G. 

    Continue reading
  • Deepfake attacks can easily trick live facial recognition systems online
    Plus: Next PyTorch release will support Apple GPUs so devs can train neural networks on their own laptops

    In brief Miscreants can easily steal someone else's identity by tricking live facial recognition software using deepfakes, according to a new report.

    Sensity AI, a startup focused on tackling identity fraud, carried out a series of pretend attacks. Engineers scanned the image of someone from an ID card, and mapped their likeness onto another person's face. Sensity then tested whether they could breach live facial recognition systems by tricking them into believing the pretend attacker is a real user.

    So-called "liveness tests" try to authenticate identities in real-time, relying on images or video streams from cameras like face recognition used to unlock mobile phones, for example. Nine out of ten vendors failed Sensity's live deepfake attacks.

    Continue reading
  • Lonestar plans to put datacenters in the Moon's lava tubes
    How? Founder tells The Register 'Robots… lots of robots'

    Imagine a future where racks of computer servers hum quietly in darkness below the surface of the Moon.

    Here is where some of the most important data is stored, to be left untouched for as long as can be. The idea sounds like something from science-fiction, but one startup that recently emerged from stealth is trying to turn it into a reality. Lonestar Data Holdings has a unique mission unlike any other cloud provider: to build datacenters on the Moon backing up the world's data.

    "It's inconceivable to me that we are keeping our most precious assets, our knowledge and our data, on Earth, where we're setting off bombs and burning things," Christopher Stott, founder and CEO of Lonestar, told The Register. "We need to put our assets in place off our planet, where we can keep it safe."

    Continue reading

Biting the hand that feeds IT © 1998–2022