Verizon MiFi Owned By Simple Attack

Trailrunner7 writes "Security researcher Joshua Wright has developed a simple attack that allows him to recover the passwords for any Verizon MiFi device. The MiFi is essentially a tiny, portable wireless AP, and Wright's attack uses a simple and effective technique to get default passwords by using the device's SSID and some existing password attacks on the encryption protocols the MiFi employs. Result: complete 0wnage of any MiFi."

Comments

Important Question

[wolrahnaes]

Is the choice of a predictable default password and a vulnerable encryption protocol specific to Verizon's branded version of this device or does it also affect the identical Sprint version and/or any GSM variants that may exist? As much as I dislike Verizon, I don't want to see the wrong name stuck on this if the problem is Novatel's, not Verizon's.

Slightly misleading title

[Scorpion_1169]

To clarify, this exploit is only for the configuration as shipped from the factory. Just like most consumer routers, you can reconfigure the SSID and WPA-PSK values via a web interface.

Re:Slightly misleading title

[Overzeetop]

To clarify, this exploit is only for the configuration as shipped from the factory. Just like most consumer routers, you can reconfigure the SSID and WPA-PSK values via a web interface, but almost nobody does.

Fixed that for you. Yes, yes, people are getting better with their home routers. For most people, if you mention SSID and WPA-PSK, it will probably be countered with a WTF?

Re:Slightly misleading title

[stoolpigeon]

They wont know what it's called but they have a good chance of knowing that they need to "give their wireless a name and password". I can see anywhere from 5 to 8 wireless networks from my home on any given day. All have non default ssids and passwords. I doubt they were all set up by IT professionals. My guess is a lot of 'regular' folks have clued in.

Default settings

[Nickodeemus]

This article is pointless - it points out how to overcome the encryption on a MIFI that has the default settings in place.

If you deploy any networking device with default settings in place, you deserve to be compromised.

Take 30 minutes to reconfigure the device using default settings and this is a non-issue.

Re:Default settings

[querist]

This article is NOT pointless, especially when you consider that the password is the ESN. That greatly narrows down the possible values because the first part of the ESN is assigned by manufacturer. Also, it is NOT pointless because the average person will look at that long string of seemingly random numbers, and the strings are different for each unit because the string is the ESN of the chip, and will think that it is a secure, randomly generated number. The length of the password itself is good. It is the fact that several of the digits are predictable, thus significantly reducing the number of values you need to try, that makes this significant. The average person will not know this and will THINK that it is secure. My own testing: average time to break (on units that I had legal permission to scan, of course) was just over four minutes after forcing a reset. This article is a wake-up call to companies that are issuing these things that they need to fix those passwords.

Re:Dupe?

[rhsanborn]

Not a dupe, just double embarrassment for Verizon. Femtocells are devices used to extend cellular coverage, usually in your home or office, generally via your own internet connection with a box you generally have to pay extra for. The MiFi device is a mini wireless access point that has a built in cellular access. It allows you to share your Verizon cellular internet service with friends or coworkers.

"Owned"

[N0Man74]

Really? Headlines with "owned" and summaries with "ownage"?

Did we go from "News for Nerds" to "News for Teenage Online Gamers" recently, or would that require taking it one step further and using the "Pwn" form of the word. Maybe we should sprinkle in a "MiFi Fail!" in there somewhere too.

Re:Gotta love the article

[Anonymous Coward]

Nothing like watching script kiddies THINK they know what the router is, and bashing their heads trying to figure out why they can't get into what MUST be an unconfigured network.

Even better - get a plain linksys router, set it to factory default settings, but don't connect it to internet.

Script kiddies keep trying to figure out why they can't connect to the internet...

Re:Submitter is clueless on what 0wnage is

[natehoy]

The funny part of this story is that Verizon routers take so much effort to hack based on their default configuration. I read it as a good move on Verizon's part.

It's just hard enough that someone thinks that "hacking" it is some form of accomplishment. That's pretty impressive given that this is a default configuration, which by definition has to use some form of predictable algorithm for their password. At least they are shipping them with OK encryption enabled by default and a password that takes 4 minutes to crack.

Now, if someone managed to hack into one of these gizmos and get free Internet after a user changed the password to a properly secure one, that would be news.

I was at my father's house once, setting up a new wireless router. This was a few years ago. The directions said to plug it into the Internet, power it up, connect to it, and set up wireless security (optional). The problem is, the wireless side comes on at first power-up, and it's an open access point. So I connected all the cables, plugged it in, went to go get a cup of coffee, and by the time I returned 15 minutes later the wireless light was blinking solid and someone had already changed the configuration password. I had to do a factory reset and beat the guy to the configuration screen when it powered up again. There was no way to tell the router to power up without wireless enabled, and the antenna was not removable. I was seriously considering wrapping the !@#$ thing in tin foil to give me enough time to get the admin password changed, but on the third try I beat the little bastard to it or he gave up.

I can imagine that 90% of Internet users at the time would simply have powered up their router, seen the access point name, connected to it, and gone on blissfully unaware that a script kiddie next door had set up port forwarding and was running a Torrent client or webserver off their connection.

I think the fact that it takes 4 minutes to hack into a default-configured router is a pretty good indication of how far we've come. Maybe not far enough, but still pretty far.