Hackers, commonly, require multiple guess attempts at codes and passwords when they try to break Wi-Fi router security. However, research by the Swiss security firm 0xcite has detailed a flaw in some Wi-Fi router chipsets that enable hackers to bypass the push-button security of WPS (Wi-Fi Protected Setup) instantly.
While a common attack takes up to 11,000 guesses, and about four hours to discover the correct PIN to access the WPS functionality of the router, this new technique only requires one guess and offline calculations, according to reverse engineer and founder of 0xcite, Dominique Bongard.
“It takes one second,” Bongard said. “It’s nothing. Bang. Done.”
The vulnerability is not there in every router, says 0xcite but is there in relatively common chipsets from Broadcom and another unnamed company that is trying hard to integrate a fix.
Speaking to Ars Technica, The Wi-Fi Alliance says that the flaw stems from how firms implement wireless networking, rather than anything inherent to the functioning of the technology. Whatever the root cause, the best way to protect against the exploit is to switch off WPS, which is possible through the router setup page. They however, didn’t confirm whether the products affected by the attack were certified.
“A vendor implementation that improperly generates random numbers is more susceptible to attack, and it appears as though this is the case with at least two devices,” said Kevin Robinson of The Wi-Fi Alliance. “It is likely that the issue lies in the specific vendor implementations rather than the technology itself. As the published research does not identify specific products, we do not know whether any Wi-Fi certified devices are affected, and we are unable to confirm the findings.”
This isn’t the first time security vulnerabilities have been reported in Wi-Fi Protected Setup and the PIN required to complete the setup of a wireless router. Davey Winder wrote about the lax in security of the PIN version of the WPS protocol back in 2012. He stated that in order to crack the WPS encryption through a brute-force attack, hackers didn’t need to know all eight digits, which would require a great deal of computing power and time. Instead, they only have to find out the first four digits of the PIN.
A tool called Reaver was also released by security researchers to exploit the flaw, and it enabled anyone to crack the simple WPS PIN and get access to the cleartext version of the router’s WPA2 PSK (pre-shared key) which is revealed. The full PIN has about 10 million combinations, but the reduced digit PIN has only 11,000.
According to Winder, the following are a countermeasure:
It isn’t all bad news: you can simply disable the WPS feature on your router to remove the PIN that the likes of Reaver will be looking for. I believe, but at the time of writing have no details to back up this belief, that a number of router manufacturers have either released or are working on firmware updates to close the vulnerability, one assumes by turning off the PIN (which not all routers have a user configuration option for.
Winder is not the only researcher to notice flaw in the protocol. Independently, Stefan Viehböck’s work, published in late 2011, revealed a number of design flaws in WPS and, most significantly, he found the PIN required to complete the setup of a wireless router could be divided into smaller parts and each of these parts could be attacked separately. By breaking down the key into smaller parts, a hacker would bring down the number of attempts from millions to 11,000.
Most hacking tutorials demonstrate that even without the vulnerability of WPS PIN, it is possible to find a WPA2-PSK using brute force, but it takes longer and a hacker needs a very solid reason to invest so much time and resources into devising such an attack. New research and flaws are reducing that time and suddenly making Wi-Fi routers more attractive targets for casual hackers.
The new attack used by Dominique Bongard exploits the lack of randomization, or weak randomization, in a key that is responsible for authenticating hardware PINs on some implementations of WPS, allowing an adversary to quickly gather enough information to guess the PIN with offline calculations.
So by calculating the correct PIN off the web, rather than attempting brute-force attacks to guess numerical passwords (which could be detected in advanced security implementations), the new attack does a great job at circumventing defenses deployed by companies.