Apple’s Worldwide Developers Conference 2009 in San Francisco has started. There was a keynote, as usual, a few hours ago. New Products have been announced. Here’s a list of the important stuff:

• New 15″ Macbook Pro. This one has an SD-card slot, and a battery that keeps the MBP running for 7 hours when fully charged.
• The 13″ Macbook is now replaced by a 13″ Macbook Pro. This one also includes Firewire 800.
• Mac OS X 10.6 “Snow Leopard” is going to be launched in September this year.
• The iPhone OS 3.0 is going to be launched on the 17th of June. It’s a free upgrade for all iPhones, and costs $9,95 for the iPod Touch (both generations).
• A new iPhone, called the iPhone 3G S, is going to be launched in the US on the 19th of June and on the 9th of August in 80 other countries. The new version has a faster CPU, better battery, 3.0 megapixel camera with auto focus, white balance, macro and video caputure at 30 FPS.
• Safari 4. This one is now available for both Mac OS X 10.4 and Windows.

Read more: Engadget | Computer World

Read More Download Patch

The NPD also notes that the average amount of sold mobile devices is 10% less, compared to the same period last year. The average price of mobile devices has increased with 6%.

Read More

Read More: ASUS N10 Dell Mini 9

This all sounds rather alarming at face value. But how effective would their methods be in real-life application? Read on for my dissection of this development.

WPA2 Finally Cracked?

Technically, ElcomSoft isn’t claiming to have cracked WPA2 per se, but rather to have drastically accelerated the processes of cracking the password. This is done using good old brute force methodology, i.e. guessing the password very rapidly. In the press release, ElcomSoft claims to achieve up to 100x the brute force capabilities of classic CPU-based attacks by employing GPUs instead:

Moscow, Russia (PRWEB) October 9, 2008 — ElcomSoft Co. Ltd. accelerates the recovery of WPA and WPA2 encryption used in the Wi-Fi protocol by employing the new-generation NVIDIA video cards. ElcomSoft patent-pending GPU acceleration technology implemented in Elcomsoft Distributed Password Recovery allows using laptop, desktop or server computers equipped with supported NVIDIA video cards to break Wi-Fi encryption up to 100 times faster than by using CPU only.

High-end GPUs have already proven their effectiveness in mathematically complex physics simulations, so it should come as no great surprise that this technology might be leveraged in brute force password cracking operations. Still, based on the information one can glean from their somewhat vague press release, there are some serious questions the security community should be asking.

Who is the target of such an attack?

One would assume that the most desirable target of such an approach would be banks, corporations and other institutions where data security is of significance. However, the PSK security model of WPA/2 Personal is not very practical for larger or security-conscious organizations, since that means effectively handing out one password for all users. As such, I would expect WPA2 Enterprise to have a greater foothold in such circles, since authentication is centralized and handled on a per-user basis. Incidentally, WPA2 Enterprise is not vulnerable to this particular brute-force methodology at all.

What About Proximity?

How close must this GPU cluster be to the target in order to be effective? Must they be within range of the victim wireless network, or can a proxy system (e.g. a laptop) be within range, while the cluster hums in a remote data center somewhere? In the former case, an attacker must still have said laptop within range of the wireless network for at least a few weeks while the brute force works its magic. In the latter, I’m imagining a van with a noisy diesel generator, parked in the back alley behind a corporation for 2 weeks… and that probably wouldn’t be logistically feasible in most cases. Otherwise it would be down to attacking from a neighboring building, which leaves the attacker somewhat vulnerable to local law enforcement should the attack be detected.

Was The Victim Hardware Taken Into Account?

Since we’ve already established that the most likely spot to find networks using WPA/WPA2 Personal is in small or home offices and not more desirable targets, what kind of hardware are we likely to see in such a case? Consumer grade hardware which is typical of SOHO application typically has between 4-64mb of onboard memory and a 100-300MHz central processor. How many simultaneous connections would such hardware handle before becoming unreachable by the attacker? My guess would be less than 1000… probably far less on most hardware (250? 100? 50?). Still, for the sake of argument, let’s assume the prospective victim’s access point can handle 5,000 simultaneous WPA2 attempts, and is secured with a meager 8-character password that utilizes only lowercase characters and a few digits. In such a scenario, it would take approximately 19 years at a sustained rate of 5,000 attempts per second.

Summary:

This WPA2 crack doesn’t seem to be feasible in the overwhelming majority of situations. An attacker is supposed to:

• posses multi-thousand-dollar software (granted, this can potentially be pirated),
• a networked cluster with plenty of relatively high-end NVIDIA video cards,
• be able to physically position themselves in such a way as to actually perpetrate the attack.

Additionally, the victim network must:

• posses facilities which lend themselves to a rather conspicuous multi-week brute force episode
• have extremely high-end wireless hardware capable of handling much higher than average connections per second,
• forgo WPA2 Enterprise for the less scalable WPA2 Personal,
• utilize a ridiculously weak PSK with far under the 63-character max password limit,
• neglect to log failed WPA2 authentication attempts or use any wireless IDS tools of any kind,
• have something worth attacking inside the target WPA2 network (e.g. not a bare-bones DMZ that’s separated from the internal network by firewalls).

Conclusion:

While I would expect the GPU-based brute force technology may hold some merit for non-wireless password cracking, the suggested WPA2 application seems an attention grab at best and snake oil at worst. Now, I’m perfectly willing to admit that ElcomSoft might possibly have some very substantial improvements over the standard brute force methodology they’ve mentioned in their press release. If that is so, hopefully they will release a more detailed whitepaper on how their technology works; some real-world figures that are readily reproducible would be nice too. But unless this comes to pass, I think we can conclude that this press release is clearly more sales pitch than zero day.

Key Features of Armani Night Effect:

• a 2.2-inch OLED display
• HSDPA support
• 3.2-megapixel camera
• multimedia player
• FM radio tuner
• Bluetooth 2.0
• USB 2.0
• 120MB of internal memory
• a microSD expansion slot

Read More

Updates

• Decrease in call set-up failures and dropped calls
• Significantly better battery life for most users
• Dramatically reduced time to backup to iTunes
• Improved email reliability, notably fetching email from POP and Exchange accounts
• Faster installation of 3rd party applications
• Fixed bugs causing hangs and crashes for users with lots of third party applications
• Improved performance in text messaging
• Faster loading and searching of contacts
• Improved accuracy of the 3G signal strength display
• Repeat alert up to two additional times for incoming text messages
• Option to wipe data after ten failed passcode attempts
• Genius playlist creation

[ Read More ]

This service is now available for the US and the UK. Just go to google.com with a mobile device, and choose the option ‘My Location’.

[ Read More ]

Pricing or availability unknown for now!

[ Source Engadget, Slashgear and Gearlog ]

[ Read More ]