Secure Wi-Fi? Not so Much -- Gaping Hole Found in WPS Pin System
December 29, 2011 12:42 PM
comment(s) - last by
The Department of Homeland Security suggests the only solution is to disable WPS
NETGEAR, Inc. (
), Cisco System, Inc.'s (
) Linksys, D-Link Corp (
), and Belkin, Inc. are some of the biggest makers of routers. If you own a router, there's a good chance you own a router from one of these manufacturers. And if you own a router from them, there's a good chance you used Wi-Fi Protected Setup (WPS) -- a PIN protected method -- to easily set up your home network. And that means that there's a good chance your security is now at serious risk.
WPS was dreamed up by
the Wi-Fi Alliance
as a means of easing the pain of home networking. But by including a flag in the EAP-NACK message, the standard unwittingly left a gaping hole that can be exploited by hackers to subvert your router.
The message tells the user if the first half of the pin they typed was right. Thus it drastically reduces the time needed to crack the PIN using a brute force attack. Add in that the last bit of the PIN is always its checksum, you have a recipe for a security disaster.
[Image Source: Best Wireless Internet Routers Blog]
The flaw reduces the time it takes to crack your average PIN from 10
attempts to 10
attempts (11,000 attempts total). Assuming you can fire off ten requests or more a second, you should be able to crack routers in minutes.
U.S. Department of Homeland Security
issued a warning
to the public
about the flaw. It
disabling WPS. This may be a painful option for less savvy operators, though, as setting up a network with more sophisticated protections can require a bit of learning.
the vulnerability and reported it to the DHS. He claims that none of the major manufacturers stepped up to the plate with a patch. He is going to release a C-coded exploitation tool shortly -- perhaps that will help prompt the business into action.
.BrainDump (Stefan Viehbock)
Department of Homeland Security
This article is over a month old, voting and posting comments is disabled
RE: Valid assumption?
12/29/2011 1:34:37 PM
A modern GPU can do 60k+ passwords per second. So it's a very valid assumption that your system could do 10. If anything it's rather low.
RE: Valid assumption?
12/29/2011 1:48:52 PM
The limiting factor is how many requests the router can answer not your pc
RE: Valid assumption?
12/29/2011 4:49:08 PM
Have you ever logged into a router before? You are not going to be able to do that 60,000 times a second. Those kind of speeds are generally only possible if you've got the entire password database stored locally on the machine doing the cracking - not applicable in this situation.
"If you look at the last five years, if you look at what major innovations have occurred in computing technology, every single one of them came from AMD. Not a single innovation came from Intel." -- AMD CEO Hector Ruiz in 2007
Homeland Security Warns About Latest Dangerous Apple Browser Bug
May 10, 2010, 5:20 PM
WiGig Specifications Completed
December 10, 2009, 11:16 AM
Dutch Gov. to Google: Don't Spy on Us
December 2, 2013, 1:21 PM
Quick Note: Amazon to Use Unmanned Drones for 30 Minute Package Deliveries
December 2, 2013, 11:51 AM
Quick Note: Wi-Fi Hack Prompts European Parliament to Eliminate Access
November 29, 2013, 11:05 AM
NYT: NSA May Have Spied on Google, Yahoo Data Centers Via Fiber-Optic Cables
November 26, 2013, 3:35 PM
Quick Note: Intel Wants to Sell OnCue Internet TV Service for $500M
November 26, 2013, 12:40 PM
Facebook CEO Says Government "Blew It" with NSA Spying
November 25, 2013, 11:23 AM
Most Popular Articles
NSA Snares Americans' Porn Viewing Histories in Effort to Target Muslims
December 1, 2013, 9:00 PM
Coalition of 20+ Tech Firms Backs MRAM as Potential DRAM, NAND Replacement
November 29, 2013, 11:59 PM
Fed Up With Cheating OEMs, Microsoft Trolls Chromebooks in New Ad
November 27, 2013, 4:09 PM
Xbox? PCs? Mobile? Microsoft Wants One Windows to Rule Them All
November 25, 2013, 8:21 PM
Seattle Restaurant Bans Google Glass, Tells Wearers to "Just shut up and get out"
November 27, 2013, 10:27 AM
Latest Blog Posts
Global Cyber Espionage Concerns Reveal Growing Cyber Armies
Nov 29, 2013, 11:04 AM
Is The Period Becoming an Expression of Anger?
Nov 26, 2013, 2:02 PM
NSA and Congress -- You Will Never Kill the Constitution, It's an Idea
Nov 10, 2013, 2:00 PM
AT&T Explores $100B+ USD Deal to Acquire Vodafone's European Operations
Nov 4, 2013, 7:34 AM
U.S. Army Developing Cyber, Electronic War Arsenal
Oct 31, 2013, 4:49 PM
More Blog Posts
Copyright 2013 DailyTech LLC. -
Terms, Conditions & Privacy Information