Researchers Say Wi-Fi Virus Outbreak Possible

alphadogg writes with a link to a NetworkWorld article about a troubling security scenario. Indiana University IT researchers are now saying that a WiFi attack intended to piggyback across unsecured access points could do serious damage in a city like Chicago or New York. By essentially brute-forcing the passwords on insecure routers, a worm-like firmware agent could be introduced to an estimated 20,000 networks in New York City alone. "Although the researchers did not develop any attack code that would be used to carry out this infection, they believe it would be possible to write code that guessed default passwords by first entering the default administrative passwords that shipped with the router, and then by trying a list of one million commonly used passwords, one after the other. They believe that 36% of passwords can be guessed using this technique."

Comments

troubling security scenario?

[Facetious]

Holy crap! Maybe we should deal with existing security problems before we start with the imaginary ones.

Varying router models and revisions

[Dan East]

How many router models and hardware revisions would the worm need to support to make this effective? It would take a great deal of resources to produce custom firmware for that many devices and hardware revisions, especially considering that people have been trying to produce custom firmware for specific devices for a long time without any success at all.

On another note, configuring the router for administrative access only via ethernet would completely stop the problem.

Dan East

Re:Varying router models and revisions

[David_W]

Would covering the router ports with a note that indicates a required login to set it up be out of the question here?

They are getting there. A Linksys I recently picked up had a label over the ports reminding you to RUN CD FIRST. I'm assuming their CD will do things like change passwords and turn on encryption (wouldn't know since I prefer to do that manually).

Re:1 million passwords?

[crow]

They don't need to hold the dictionary. Anything that doesn't fit can be downloaded on demand. Most access points have access to the Internet, and residential access points are almost always outside of any firewall (they're usually the firewall themselves).

Re:Question...

[nevurthls]

I'm not sure if your post is serious as these questions have been answered many times in slashdot. Hiding your ESSID, not using DHCP and using MAC address filtering are insufficient in adding security as they are all part of any exchange between the router and wireless connections. The MAC address of existing machines can be found and copied in seconds. The ESSID and IP address can be found very easily as well. Hacking WEP encryption is also trivial. As a security measure, all these are completely pointless, and do not add anything in terms of security. Hiding your ESSID does decrease your wireless performance. The only security measure that has any real effect in protecting your wireless network from people who really want to get in is using secure encryption. (WPA, etc.)