Slashdot Mirror
Wi-Fi Router Attack Only Requires a Single PIN Guess
An anonymous reader writes: New research shows that wireless routers are still quite vulnerable to attack if they don't use a good implementation of Wi-Fi Protected Setup. Bad implementations do a poor job of randomizing the key used to authenticate hardware PINs. Because of this, the new attack only requires a single guess at the hardware PIN to collect data necessary to break it. After a few hours to process the data, an attacker can access the router's WPS functionality. Two major router manufacturers are affected: Broadcom, and a manufacturer to be named once they get around to fixing it. "Because many router manufacturers use the reference software implementation as the basis for their customized router software, the problems affected the final products, Bongard said. Broadcom's reference implementation had poor randomization, while the second vendor used a special seed, or nonce, of zero, essentially eliminating any randomness."
WiFi Protected Setup shouldn't be used anyways for security, especially since its problems have already been mentioned many times already in quite a few articles.
Is it just me that hates shit on my router?
- WPS (a.k.a. turn your massive password into a four-digit number): turned off on every router I've ever used, since day one of installation.
- UPnP (a.k.a. let anything open any port to anywhere without authentication): turned off on every router I've ever used, since day one of installation.
- WPA/WEP (a.k.a. half-arsed encryption that we never really thought through): turned off on every router I've ever used, since day one of installation.
- Guest networks (a.k.a. let random strangers use your Internet connection without you knowing): turned off on every router I've ever used, since day one of installation.
- Remote administration (a.k.a. let random strangers on the Internet sit and brute-force your passwords with no way to tell it's happening): turned off on every router I've ever used, since day one of installation.
And, in fact, on anything BUT my actual wireless router of choice (e.g. any Internet router supplied by my ISP):
- wireless (a.k.a. give people another way into my network and hinder all my other - wanted - wifi connections by flooding the airwaves): turned off on every router I've ever used, since day one of installation.
Seriously, people, just turn this shit off. And layer VPN over the top of it, if you can. Seriously. There's zero impact on always VPN'ing over your wireless connection to a machine that has a fixed line to your actual Internet connection. Then even if WPA2 is broken, you're still secure. And yes, you can game. I've done it with OpenVPN over my wireless for years - for EVERY packet - that goes over the wireless.
Wireless is the leaky, draughty hole of your network. Seal that fucker up and treat it like an Internet connection, even to your local network.
rubbish. ..like printers. if we can talk to them via tcp/ip or even wifi this is agood thing(tm). ...
we want cheap devices
in my case the printer was tcp/ip AND wifi but no display/menu to speak of.
the one with a display would have printed the same quality but would have cost more.
so how the swiss cheese was i to setup the printer via wifi if i could not access it to setup the passphrase and ip address etc.etc?
wifi protected setup to the rescue.
once it was paired to the router automagically i could access the printer via its built-in website to set all the details and then DISABLE the protected wifi again
I still marvel that Broadcom designs everything about the router, and could, with a little bit extra work, have Foxconn manufacture millions of working routers.
I guess that knowing which features consumers will pay for, the cosmetic design of the router, the web UI, and customer warranties is a very big deal. I still marvel that it is more difficult to do that, than design the actual product.
In cryptography, it means a number that is only used once -- n-once. However, it is actually the wrong word to use here, as a cryptographic seed's most important attribute is unpredictability.
John
Reaver has been around for a long time. It makes exploiting this trivial.
well, you can always use Huawei routers, they are too cheap to follow standards (a.k.a. be vulnerable to wps)
What is the big deal, if I lose anything on my computer all I need to do is contact the NSA for a copy of my hard drive.
...a manufacturer to be named once they get around to fixing it...
Someone got paid off not to name the manufacture. Doing a great injustice to their customers by not letting them know their routers can easily be compromised.
Sure, maybe not letting the criminals know which manufacture might seem like a smart idea, but in the same process, they don't need to know, they can just start checking them all. Your customers aren't safe that way. At least if you tell them there is a problem, they can use secondary measures, like turning off their router when they aren't using it. Maybe change their password every hour or so, or maybe pay attention to anything connecting to it. At least that way you can do something about it.
Going to boycott which ever manufacture that is because they don't have my security in mind when they do stuff like this.
Be seeing you...
keep it as your get you jail free card as when you get sued for download and or barking the law just say my router got hacked and I did not do that.
I know for example that Apple uses broadcom chipsets and supports WPS (through Airport Utility) - are they vulnerable?
A known list of vulnerable routers would be very interesting.
Make sure everyone's vote counts: Verified Voting
Develop a router that can be hacked easily, present public with an encryption protocol for plausible deniability. This way no one can get sued by the RIAA if someone uses P2P and downloads music.
You are trusting your ISP to deliver you a router that has all these things properly configurable and not leave back doors for their own remote admin and whatnot still open. ISPs don't do that, they always leave themselves a backdoor and often are lax in upgrading firmware. If at all possible, let your ISPs router do only the minimal required to let your network connect to the internet and do the rest (firewalling, NAT, WiFi) on your own trusted devices.
I was promised a flying car. Where is my flying car?
Yeah, the resulting articles are always pretty far away from what you told the reporters. Better look at the slides.
you can afford netflix and you're using my connection across the street? wtf?
Being able to afford Netflix ($120 per year) doesn't always imply being able to afford the inflated prices that cable providers charge for high-speed Internet access without a subscription to multichannel pay TV at the same address (often $700 or more per year).
UPnP - I am not going to manually configure every internet facing service every time I want to use a piece of software.
In the era of IPv4 address exhaustion and IPv6 foot-dragging, more and more users end up behind carrier-grade NAT. To serve these users, more and more applications are being written to bounce traffic off a server so that the client can get away with making only outbound connections.
WPA/WEP (a.k.a. half-arsed encryption that we never really thought through): turned off on every router I've ever used, since day one of installation.
Was this true even during the days of Nintendo Wi-Fi Connection, when the Nintendo DS couldn't use anything but WEP? Or did you just skip the DS?
Remote administration (a.k.a. let random strangers on the Internet sit and brute-force your passwords with no way to tell it's happening): turned off on every router I've ever used, since day one of installation.
So when you're setting up a home network for a relative who lives far away and is not technically inclined, and you have to troubleshoot it, do you make plans to get on an airplane whenever something goes wrong?
Seriously. There's zero impact on always VPN'ing over your wireless connection to a machine that has a fixed line to your actual Internet connection.
Except on machines that do not support OpenVPN, such as a video game console.
Doesn't somebody need to press a button on the front of the router to begin the Wi-Fi Protected setup process? So the attack cannot happen until the setup is in session? What is the issue? Or am I missing something?
Is this even possible??
Herb