WEP uses a 64 or 128 bit key to encrypt every packet with RC4.
This key is constructed from the contactination of an 24 bit IV
(initialization vector) and a 40 or 104 bit WEP key. The IV is sent in the
clear with the packet. The ICV (Integrity Check Value) is a 4-byte checksum
computed with the CRC-32 algorithm appended to the end of every packet. It is
also encrypted.
Relatively weak encryption, WEP suffers from several problems in design and implementation that makes it vulnerable to security breaches.
First, WEP has key problems. There is no key management incorporated in WEP, so keys are over-used and ill-constructed. Each piece of equipment in a WLAN must be re-keyed individually, making a key's lifetime enormous. Also, a 40 bit key can be brute forced in about a week, making it much too short.
Second, the IV is extremely small. With only 2^24 values (16,777,216), IV reuse becomes an issue. An attacker with an IV can use it to forge packets or decrypt subsequent transfers. WEP does not specify how the IV is chosen, so IVs are reused regularly. With two packets, the cipher stream can be discerned. With a regular return packet, an attacker can also decode the cipher stream.
Third, CRC-32 is a poor choice for an encrypted checksum. It utilizes a
linear progression, which makes it very easy to spoof, and therefore, makes it
easy to spoof regular packets. Furthermore, this checksum is computed on
the plain text data. This makes it easy to
mount dictionary attacks against the WEP key by attempting to decrypt packets
with a guessed key and then checking to see if the checksum is valid.
Fourth, weak keys in RC4 are apparent via the IV values. 9000 of the 16
million IV values are tags for weak keys. By gathering weak keyed IV packets, an attacker only has to gather data for a short
time and try a few keys to gain access to the network. In fact, the proportion of
weak IVs rises with the size of the key, so larger key lengths are even
easier to break.
Fifth, authentication messages are easily forgeable. By monitoring a challenge-response to the WLAN, an attacker can discern the cipher stream and adapt to any further challenges to his access.
Without knowing or attempting to determine the WEP key of a network, an attacker can do many other malicious things to other users traffic.
Packet Injecting - If an attacker were to determine the plain text of a single packet the attacker could then use the RC4 cipher against itself to create new packets, and have them be accepted by the network. To validate packets the access point decrypts and checks the CRC. The CRC tells the AP if the packet payload has been modified in transit. Since the attacker can encrypt his own packet (by xoring the plain text that he knows with the cipher text, and then again with the plain text he wants to encrypt) the attacker can also generate the CRC. Thus the attacker can have any packets he wants enter the network and be accepted by the AP without knowing the WEP secret key.
Decrypting without a key - Another attack that involves not knowing an entire packets plain text, is done through guessing headers, and other select parts of information. With this attack, the attacker adjusts the packet destinations without decrypting the packet to reroute to a different destination that he controls (A different type of man-in-the-middle attack). The packets arrive un-WEP'ed and readable by the attacker. This is mainly useful for clear text transmissions, such as telnet, and HTTP traffic. If a user were to have a vpn client or use ipsec for secure communications, then the effectiveness of this attack would be severely decreased.
Other attacks include the attacker posing as a AP, and performing a type of man in the middle monitoring of all network traffic.
As you can see, WEP has quite a few security holes that makes it a poor choice for hardened WLAN security.
