Slashdot Mirror
Verizon MiFi Owned By Simple Attack
Trailrunner7 writes "Security researcher Joshua Wright has developed a simple attack that allows him to recover the passwords for any Verizon MiFi device. The MiFi is essentially a tiny, portable wireless AP, and Wright's attack uses a simple and effective technique to get default passwords by using the device's SSID and some existing password attacks on the encryption protocols the MiFi employs. Result: complete 0wnage of any MiFi."
Is the choice of a predictable default password and a vulnerable encryption protocol specific to Verizon's branded version of this device or does it also affect the identical Sprint version and/or any GSM variants that may exist? As much as I dislike Verizon, I don't want to see the wrong name stuck on this if the problem is Novatel's, not Verizon's.
I used to get high on life, but I developed a tolerance. Now I need something stronger.
http://mobile.slashdot.org/article.pl?sid=10/02/02/1632203
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
To clarify, this exploit is only for the configuration as shipped from the factory. Just like most consumer routers, you can reconfigure the SSID and WPA-PSK values via a web interface.
This article is pointless - it points out how to overcome the encryption on a MIFI that has the default settings in place.
If you deploy any networking device with default settings in place, you deserve to be compromised.
Take 30 minutes to reconfigure the device using default settings and this is a non-issue.
From The Fine Article:
I suggest using linksys or netgear. :D
Nothing like watching script kiddies THINK they know what the router is, and bashing their heads trying to figure out why they can't get into what MUST be an unconfigured network.
Only catch is if you're in an environment with lots of them pre-configured in which case 'FreeWiFi' is also good (with a nice strong random password of course :P ).
This space for rent. All reasonable inquiries will be entertained at proprietors discretion.
using the words "own" and "pwn."
The Password is the ESN of the CDMA chip.
* Manufacture Year: "09" represents the 2-character year of manufacture. * Manufacture Month: "11" represents the 2-character month code. * Manufacture Day?: "19" represents the 2-character day code (NB: This could be wrong, one sample had a value of "34" here, need more data). * Sequential Identifier: "00891" represents the 5-character sequential identifier code. Based on this assessment, we can determine that the password selection for the MiFi default is weak. Instead of 11 numeric values with an effective entropy of approximately 36 bits, the MiFi password only has an effective entropy of less than 17 bits for a given 6-byte prefix. If the concept of a manufacture date-stamp is true for the 6-byte prefix, then we have a relatively small search space to find the default MiFi PSK.
Weak? maybe....but as far as DEFAULT passwords go that seems above average to me! You mean it's not EXACTLY THE SAME on every device manufactured? That's a good thing! In many cases I'd think that's a better password choice than many users would choose for themselves.
I got a verizon FiOS service. The router they gave me runs a web server and throws a username/password dialog to the WAN side. That part can not be disabled by the user. They claim it is used to push firmware upgrades and other service settings changes. But instead of making the device make outbound calls to specific servers, they are relying on a simple username/password dialog. Hope they are using some randomly generated password stored in tables in a secure location. Thus even if a password is compromised, the damage is limited to that router. If it is a formula based password generator, there is potential for widespread pwning of verizon routers.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Really? Headlines with "owned" and summaries with "ownage"?
Did we go from "News for Nerds" to "News for Teenage Online Gamers" recently, or would that require taking it one step further and using the "Pwn" form of the word. Maybe we should sprinkle in a "MiFi Fail!" in there somewhere too.
The submitter of this article is apparently clueless as to what "0wnage" is ... the router is not owned. You've hacked a password to allow you to use the router. To own the router, you would need root access. You don't have that with this attack... you have a simple WPA-PSK password. Big deal... anyone can do that with a bit of time on their hands and a Backtrack 4 CD on laptop. Wheeee... you are a l33t scr1pt k1ddie now!
It's an interesting article from the standpoint of how an unconfigured router is insecure (that is to say, it's the article isn't really that interesting since everyone should know by now that an unconfigured router is insecure) - but it's not news and it's not really useful. It's DEFINITELY not ownage in any way, shape or form.
a simple attack that allows him to recover the passwords for any Verizon MiFi device.
The attack is based on searching through a limited set of default passwords.
Changing the password to something other than the default prevents this attack. I don't have a Verizon MiFi device, but I have one from Sprint. By default, it was an open access point. I quickly changed it to something else before I left the store, and changed it again later at a distant location over the (somewhat) secure connection.
It was literally the first one sold from the store where I bought it. Sprint may have since changed to something like Verizon has done, with a (non-) random password. But, I would have changed it anyway.
My Verizon router (for FIOS) had a similar setup, although I don't think it's a predictable SSID and password. However, it was WEP-64. Needless to say, it was the first thing I changed.
An aside: I made the initial connection and changed the password in the Sprint store with my iPhone. The staff was really amused by that, and asked how fast the connection was. I used the iPhone speedtest to tell them -- about the same as the PCMCIA Sprint AirCard I had before this.
When I read that summary, the first thing I thought was that it was ANY MiFi router, default or not. The poster needs to mention default passwords. The problem is, we can talk about default passwords being weak all we want, but it HAS to be possible to communicate it to the person who configures it.
Once they get to using truly random methods to generate totally random keys, we'll be raking them over the coals for daring to print it in the owner's manual where someone could find it and hack into your wireless network.
The fact is, no matter how secure a device is, a determined idiot will make it insecure. We need to devote time to making users pay attention to security. The problem is that they don't WANT to pay attention to security (until they get hacked).
Isn't the whole point of the MiFi to provide internet access? So, what have you gained? And it's meant to be moved around a lot -- once you hack it, it'll be out of range soon anyway.
Coder's Stone: The programming language quick ref for iPad
From TFA:
I've seen more enticing offers in my Spam box...
How many people are really going to take him up on this offer, exactly? If you understand the topic, you know you'll be making it much easier for people to break-in to the service your paying for, and at worse, perhaps making your own device stick out like a sore thumb as it becomes one of very few submitted... But even if you're completely ignorant of what's going on here, the phrasing is plenty menacing anyhow...
"Gee. He wants me to e-mail him my secret ID# so he can add my device to the attack set? Sure! Why not?"
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant