Vulnerability allows brute force hacking of wireless routers

By

WPS found to be vulnerable.

A computing standard than enables users to easily stand up an encrypted wireless network suffers from a design weakness that could enable attackers to gain router access, according to US-CERT.

Vulnerability allows brute force hacking of wireless routers

The vulnerability exists in the WiFi Protected Setup (WPS) and could allow an adversary to brute force the standard's authentication method, drastically reducing the number of attempts necessary to retrieve the router's PIN password. With this in hand, the adversary can change the access point's configuration and launch a denial-of-service attack.

"When the PIN authentication fails, the access point will send [a message] back to the client," according to a US-CERT advisory.  "The...messages are sent in a way that an attacker is able to determine if the first half of the PIN is correct. Also, the last digit of the PIN is known because it is a checksum for the PIN."

The attack is aided if wireless routers lack any lock-out capabilities when PINs are repeatedly attempted.

As users await updated firmware, disabling WPS is the only known fix for the vulnerability, which was discovered by researcher Stefan Viehbock. In a research note, he recommended vendors "introduce sufficiently long lock-down periods in order to make an attack impractical."

This article originally appeared at scmagazineus.com

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

First npm worm "Shai-Hulud" released in supply chain attack

First npm worm "Shai-Hulud" released in supply chain attack

"VoidProxy" PhishKit targets Google and Microsoft users

"VoidProxy" PhishKit targets Google and Microsoft users

Apple adds "mercenary spyware" protection to new A19 chip

Apple adds "mercenary spyware" protection to new A19 chip

Phishing attack nets enormous npm supply chain compromise

Phishing attack nets enormous npm supply chain compromise

Log In

  |  Forgot your password?