WPA2 wireless security cracked

I'm sure we'll see an analysis written up by Securosis or someone along those lines soon. I'm tempted to buy it myself, but given the synopsis, I'm a little skeptical.

"The researchers have now shown that a brute force attack on the WPA2 password is possible and that it can be exploited, although the time taken to break into a system rises with longer and longer passwords."

A brute force attack is possible on any symmetric encryption system. Difficulty is increased with the size of the keyspace. These are truisms. No offence to the authors, but this isn't really a discovery, unless they've discovered a way to reduce the key space.

"As part of their purported security protocols routers using WPA2 must reconnect and re-authenticate devices periodically and share a new key each time. The team points out that the de-authentication step essentially leaves a backdoor unlocked albeit temporarily. "

This isn't really a backdoor. If there was an actual fault that would allow you to authenticate without passing a key, that would be one thing. But you still have to pass a key by the way they describe it. To perform a brute force attack on the authentication step, you need to capture the handshake. You can wait for that to happen, or try and force one yourself. Here's an aircrack tutorial on how to do this:

http://www.aircrack-ng.org/doku.php?id=cracking_wpa&DokuWiki...

Note though, that while this gets you the packets needed to perform your attack on (as opposed to waiting for the Client/AP to periodically reauthenticate), and potentially saved you a couple of hours, you still have to break the key.

And that's what it all comes down to. Breaking a weak password is easy. Breaking a lengthy key is hard. The only vulnerability that exists as described so far is insufficiently long keys. That's a key management/user problem, not so much a technological one.

What bothers me most however is what the authors seem to recommend as additional security measures (per http://www.securityweek.com/researchers-outline-how-crack-wp...): MAC ACLs and Hidden SSIDs. I don't think I need to point out here how ridiculous these 'security' measures are, especially in light of the nature of the alleged weakness and how one would need to exploit it.

That doesn't really lend a lot of credibility to the paper's / this link's title.

Also, it looks like that without rainbow tables, the PSK cannot be cracked in a meaningful timespan? They compared the 'captured' hash (?) against a dictionary to determine their success, but again, I might be extrapolating too much from too little information.