Wifi router vulnerability

CommDriver · Jan 15, 2012

On December 27, the Department of Homeland Security's Computer Emergency Readiness Team issued a warning about a vulnerability in wireless routers that use WiFi Protected Setup (WPS) to allow new devices to be connected to them. Within a day of the discovery, researchers at a Maryland-based computer security firm developed a tool that exploits that vulnerability, and has made a version available as open source.

WiFi Protected Setup, a standard created by the WiFi Alliance, is designed specifically for home and small business users of wireless networking to easily configure devices without having to enter a long password. Offered as an optional feature on WiFi routers from a number of manufacturers, it automates the setup of the WiFi Protected Access 2 (WPA2) authentication between the router and a wireless device. One of the standard's methods of establishing connection that is supported by all WPS-capable routers is the use of a personal identification number, usually printed on the wireless router itself, to authenticate the device.

But as security researcher Stefan Veihbock found and reported to US-CERT, the PIN implementation is susceptible to "brute-force" attacks because of the way routers respond to bad requests, and the nature of the PIN itself. When a PIN request fails, the message sent back to the wireless device attempting to connect contains information that can help an attacker by revealing whether the first half of the PIN is correct or not'reducing the number of guesses that an attacking system would have to make. Additionally, the last number of the PIN is a checksum for the the rest of the PIN. As a result, an attacker could get the PIN within 11,000 guesses. Veihbock demonstrated the vulnerability with a proof-of-concept tool he wrote in Python, available for download from his site.

That wouldn't be as much of a problem for security if wireless access points locked out devices after repeated bad PIN entries. But on many WPS wireless routers, there is no lockout feature. That means attackers can continue to attempt to connect at their leisure.

And unlike passwords, the PIN is something that can't usually be changed by the router's owner. That presents a huge security loophole for attackers'once they've gained the PIN, they can reconnect at will to the network, even if the administrator has changed the password or service set identifier (SSID) for the network. And on access devices that have multiple radios in them providing network connectivity for different SSIDs with different passwords, the PIN can provide access to all of the wireless networks on the router.
Click to expand...

http://arstechnica.com/business/new...rce-tool-for-hacking-wifi-protected-setup.ars

the attack
[ame]http://www.youtube.com/watch?v=qQf7TvHx-NE&feature=related[/ame]

the fix/unless you have linksys
[ame]http://www.youtube.com/watch?v=DhWS_qveIss&feature=related[/ame]
[ame="http://www.youtube.com/watch?v=qQf7TvHx-NE&feature=related"][/ame]

Log in or Sign up

Forums

Find Trucking Jobs

Wifi router vulnerability

CommDriver Road Train Member

Trucking Jobs in 30 seconds

Wait, employers can't reach you!

Log in or Sign up

Useful Searches

Find Trucking Jobs

Wifi router vulnerability

CommDriver Road Train Member

Wait, employers can't reach you!