Slashdot Mirror
New WiFi Setup Flaw Allows Easy Router PIN Guessing
Trailrunner7 writes "There is a newly discovered vulnerability in the WiFi Protected Setup standard that reduces the number of attempts it would take an attacker to brute-force the PIN for a wireless router's setup process. The flaw results in too much information about the PIN being returned to an attacker and makes the PIN quite weak, affecting the security of millions of WiFi routers and access points. Security researcher Stefan Viehbock discovered the vulnerability (PDF) and reported it to US-CERT. The problem affects a number of vendors' products, including D-Link, Netgear, Linksys and Buffalo. 'I noticed a few really bad design decisions which enable an efficient brute force attack, thus effectively breaking the security of pretty much all WPS-enabled Wi-Fi routers. As all of the of the more recent router models come with WPS enabled by default, this affects millions of devices worldwide,' Viehbock said."
Don't you still have to physically push a button to (temporarily) enable WPS? If not, whose bright idea was *that*?
Who didn't see this one coming?
So I'm still safe-ish using plain old WPA2/PSK?
I've never trusted the WiFi protected setup scheme because if it seems too easy to be secure, well then it probably is. If you don't use Tomato or DD-WRT on your router you obviously don't really care about security anyway so who cares? The OOB ROMs on most consumer routers are full of more holes than a breadboard.
Since most people (home consumers) can't be bothered to change a default name/password/ssid on damn things anyway about 80% or more are unsecure as it it. If you want a secure connection, don't use the air, use a wire, and better yet, make sure you own and monitor its entire length.
Silence is a state of mime.
Same old thing, default configuration is bad.
if you don't have any laptops and just desktops then don't get a wifi router if you want a secure connection.
While the content seems sound... Arrgh! Papers made on Word with default template. Yuck.
People still run routers with the default flash?
What about using alternate router firmware such as DD-WRT?
Since my ISP uses MAC registering, I have to setup the damn router with a specific MAC address and since I'm in there doing that, I may as well configure the rest of the damn thing with it's passphrase and name. This actually saves me lots of trouble as I don't have to reconfigure the damn authorized systems again (they already have the needed connection information) so they're connected as soon as I'm done configuring the router.
Mod me up/Mod me down: I wont frown as I've no crown
Because I've replaced my router's original firmware with it, since it works a bit better with the features I need, which don't include WPS anyway.
"The flaw results in too much information about the PIN being returned to an attacker and makes the PIN quite weak"
Does anyone else visualize a router responding with: "Getting warmer!"
Most of routers implementations allow a few attempts and then black list the MAC address of the attacker for a while (according to TFA the program would have to try at most 11,000 times).
Thus the attacker program should be low-level enough to fake its own MAC address all the time.
Slashdot, fix the reply notifications... You won't get away with it...
Is this the "Secure Easy Setup" option on the "Wireless" menu, which by default is enabled, and of which there's no info on the help screen of my WRT54G?
"with their freedom lost all virtue lose" - Milton
mm lets try red red blue white this time
what kind of MasterMind(tm) came up with that?
I use OpenWRT on my private router. As can be said of ALL default installed software: SCREW the firmware that comes with the routers.
It's just like my Laptop, Servers, Workstations, and Phone: If I can't install MY OS on it, it's not worth any of my time. If I haven't installed my OS on it, I DON'T USE IT.
That "easy setup" button on my router now gives me a minimal window of time during which I can SSH in to the router itself -- I have to be connected to the router already to do so over Ethernet or WPA2 w/ AES.
If you don't know how to drive GET THE HELL OUT from behind the steering wheel! The same can be said for networks, security, computers in general. If you can't configure your network, get someone who can to do so. Otherwise, expect to lose control and have a horrible accident when you brake instead of clutch, or WPS or WEP instead of WPA PSK w/ custom firmware.
I just bought a new router. I must confess, I have no clue what it's default firmware even looks like. First thing I did was install DD-WRT on it and tweak almost everything.
I have a regular non-wifi router and then behind that a separate wifi access point (WPA2 protected)... Am I safe from this attack then?
"For every complex problem, there is a solution that is simple, neat, and wrong." -- H.L. Mencken (1880-1956) --
From the PDF, the implementation mistake is to give the attacker feedback on whether the tried key is correct after the first half of authentication (phase M4), and then after the complete authentication (phase M6). Since the PIN is only 8 digits, and the last one is a checksum, the problem is reduced to guessing 1 number in 10000, and then 1 in 1000.
The document states that there are few possible mitigations for the problem. However, it skips the obvious one: do not notify authentication success/failure until the response to the M6 message. This would restore the 1 in 10,000,000 guessing complexity of the PIN code, without changing the protocol. It should even be a new issue tested by the compliance suite the vendors need to pass to get the WPS certification.
The attack in short: WPS NACKs a partially transmitted PIN if the first part is wrong. This leaves 20k trials needed for brute-force, instead of 1M.
I have no idea how people this incompetent get to design widely used protocols.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Very interesting. But how can we test for this vulnerability in practice? I guess there isn't a readily available exploit for it. So if we don't want to check all configuration pages of all our wifi routers to see if they support WPS and whether it is enabled, what can we do? Is there an easy way to send an appropriate packet and see in the response if the router may be vulnerable or not?
Please hack my unsecured wifi network with default router login credentials. I don't live in an apartment building full of teenagers, so I can get away with it. Using passwords is really a pain for guests. Plus, my next door neighbors secretly think I'm the man for giving them free wifi. It's kind of the Google mindset applied to running my wifi network although it is just a mere byproduct of my carefree nature towards it. I think everyone should have their own broadband plus an open wifi network, that would really help out with the mesh-networks of the future.
Code for this attack has been posted: http://www.tacnetsol.com/news/2011/12/28/cracking-wifi-protected-setup-with-reaver.html
I just got a new router and the old one was as old as the hills. I had never even heard of WPS and as far as I know I don't have any devices that can use it. I have it disabled on my router thanks to this article. Since I am a home user my network is pretty static, I only occasionally change devices. I use WPA2 and mac filtering so only specific devices can connect even if the neighbor manages to crack the WPA2 pin. What he hell use is WPS if you have to enter a pin anyway, why not just use the WPA2 pin? I truly don't understand the point for a home user.
Let me carry that vehicle analogy just one step further to the infrastructure level, and then you can answer some questions: Do you know how thick the class 5 limestone needs to be to support a four lane concrete freeway when building a road on a clay-silt base? What's the weight required for the tamping machine to ensure it's adequately packed down so the roadbed doesn't crack? How much reinforcing mesh do you have to put in the concrete, and how close to the road surface can it be? What is the proper spacing for expansion joints? What joint material works best if the road is subjected to salting in the winter for traction? If you don't know how to build your own road, you certainly don't know how to drive on one, so "GET THE HELL OUT from behind the steering wheel!"
The argument may have had some merit in the past, before roads were regularly paved, and when driving through a puddle risked sinking the vehicle to the axles. But we've moved into the era where most people need to get on line just to function in society. They don't understand the infrastructure, they will never understand the infrastructure, but they still need the infrastructure, so they have to buy and install a router anyway. It's now the job of the infrastructure component providers to make the hardware and software work for these people who don't know what they're buying, or even why they have to buy one. If default router security is bad, it's now the fault of the router makers. If default switch security is bad, it's the fault of the switch makers.
Like it or not, people who don't even know how they get on line are here to stay. We either have to deal with it, or create our own little anti-social darknet and hide out there, posting a "NO NEWBS ALLOWED" sign on the door, like it's the clubhouse for some very confused techno-Luddites.
John