Vulnerability allows brute force hacking of wireless routers

By

WPS found to be vulnerable.

A computing standard than enables users to easily stand up an encrypted wireless network suffers from a design weakness that could enable attackers to gain router access, according to US-CERT.

Vulnerability allows brute force hacking of wireless routers

The vulnerability exists in the WiFi Protected Setup (WPS) and could allow an adversary to brute force the standard's authentication method, drastically reducing the number of attempts necessary to retrieve the router's PIN password. With this in hand, the adversary can change the access point's configuration and launch a denial-of-service attack.

"When the PIN authentication fails, the access point will send [a message] back to the client," according to a US-CERT advisory.  "The...messages are sent in a way that an attacker is able to determine if the first half of the PIN is correct. Also, the last digit of the PIN is known because it is a checksum for the PIN."

The attack is aided if wireless routers lack any lock-out capabilities when PINs are repeatedly attempted.

As users await updated firmware, disabling WPS is the only known fix for the vulnerability, which was discovered by researcher Stefan Viehbock. In a research note, he recommended vendors "introduce sufficiently long lock-down periods in order to make an attack impractical."

This article originally appeared at scmagazineus.com

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

CBA using facial recognition logins to verify disputed payments

CBA using facial recognition logins to verify disputed payments

Top US diplomat impersonated with AI by unknown actor

Top US diplomat impersonated with AI by unknown actor

UK police arrest four over cyberattacks on M&S, Co-op and Harrods

UK police arrest four over cyberattacks on M&S, Co-op and Harrods

Google Gemini for Workspace vulnerable to prompt injection attacks

Google Gemini for Workspace vulnerable to prompt injection attacks

Log In

  |  Forgot your password?