Instructor: The first encryption
that we'll learn how to break is called WEP,
or Wired Equivalent Privacy.
This is an old encryption, that can be easily broken.
The reason why I'm still covering it in this course,
is first of all, because like I said, it's very simple,
so it's a good starting point.
Also, it's still used sometimes in some networks.
Therefore, you can't really call yourself a hacker,
and then if you see a network that uses WEP,
you'll get stuck,
and you won't even be able to break into it.
So in this lecture, I'm gonna explain how WEP works,
and what's the weakness that we can use to break it.
And in the next lecture,
you'll see how we can use this weakness
in order to break WEP and get the key
for any network that uses WEP.
So basically, WEP uses an algorithm called RC4
to encrypt its the data.
So the way this works is basically,
if a client wants to send something to the router,
and let's say it wants to send this text,
data to send to the router,
it will first encrypt this using a key.
Therefore this normal text will be converted into gibberish
as you can see here.
This encrypted packet will be sent into the air,
so if a hacker captures this packet as we seen before,
if we open this packet,
we'll see that it's full of gibberish.
Even though it actually contains useful information,
we won't be able to read it because it's encrypted.
The access point will receive this encrypted packet,
and it will be able to transform it
back to its original form because it has the key.
Therefore, it'll actually be able to read the contents
which is, data to send to the router.
The same happens if the router
wants to send something back to the client,
it will first encrypt it using a key,
send it to the client,
the client will be able to decrypt it
because it has the key.
So the concept is always the same,
the transmitter encrypts the data using a key,
sends it to the receiver,
the receiver is able to decrypt it,
because it also has the key, therefore,
anybody who captures the packet in the middle,
they will get the packet,
but they won't be able to see the contents
because they do not have the key.
So the algorithm and the way RC4 works is actually fine,
the problem is with the way
that WEP implement this algorithm.
And to understand it,
let's zoom in a little bit more on each step.
So going back to the first step,
we have the client trying to send data to the router,
and the data that wants to send is,
data to send to the router.
So in order to encrypt this,
WEP tries to generate a unique key for each packet.
So literally each packet that's sent into the air,
it tries to create a new unique key for it, to do that,
it generates a random 24 bit initialization vector.
The initialization vector is then added to the password
of the network to the actual key
that people use to connect to the network.
This generates a key stream,
and then this key stream is used to encrypt this packet
and transform it into gibberish.
So basically, we have the key stream
plus the data that we need to encrypt,
gives us the gibberish,
and then the gibberish is sent into the air.
But before sending this into the air,
WEP will also append the initialization vector.
This is the 24 bit random number that I said it creates
in order to make sure that each packet has a unique key.
The reason why it adds the initialization vector
to the packet is because
once the router receives this packet,
it needs to be able to decrypt it,
and to decrypt it, it needs the key and the IV.
But the router already has the key,
so there is no need to send that.
Therefore we just need to send it the IV.
So when the router receives the packet, it has the IV,
it has the password or the key,
so it can generate a key stream
and then use that key stream to transform this gibberish
into its original form and read the packet.
So if you think about what I said,
you can probably guess what the weakness is.
Basically, the IV is sent in plain text,
so if you look at this,
you can see the packet content is encrypted,
so if someone captures this packet,
they won't be able to read this,
but they will be able to read the IV in plain text.
Also, the size of the IV is only 24 bits.
Now considering the huge amount of traffic
that can be generated on a Wi-Fi network,
this number is not big enough,
and the IVs will start getting repeated in a busy network.
This makes WEP vulnerable to statistical attacks,
so we can use a tool called Aircrack-ng
to determine the key stream,
once we have enough repeated IVs.
And from that it will also be able to crack WEP,
and give us the key to the network.