Wi-Fi Protected Setup design flaw leaves routers open to attack

Design flaws in the Wi-Fi Protected Setup (WPS) standard used by most modern routers could make it easier to retrieve a wireless network's password through brute force and leave it open to attack. The issue was first brought to light by security researcher Stefan Viehböck and has since prompted a vulnerability notice from the U.S. Computer Emergency Readiness Team (CERT).
The WPS standard was created in 2007 by the Wi-Fi Alliance in order to provide non-technical users with simpler methods of setting up secure wireless networks. One of these methods uses a predefined eight-digit PIN number printed on a sticker by the router manufacturer. The problem, according to Viehböck, is that entering the wrong PIN returns information that could be useful to a hacker.
Ideally an eight-digit PIN code would produce 100,000,000 possible combinations, enough to keep an attacker busy for a few years if attempting a brute force break-in. But the protocol used by Wi-Fi Protected Setup responds to failed authentication attempts by indicating if the first or second halves of the PIN number are correct, significantly reducing the possible combinations. Plus, the last digit is actually the checksum of the other seven. That means an attacker only has to try 11,000 different combinations to find the right PIN.
In his tests, Viehböck found that an authentication attempt takes between 0.5 and 3 seconds and the majority of routers don't implement lock-down periods after several consecutive failed WPS authentication attempts. Only one router from Netgear slowed its responses to failed authentication attempts in order to mitigate against the attack, but that only extended the attack time to a day or so -- otherwise it can take 2-4 hours.
Devices from Buffalo, D-Link, Linksys, Netgear and others are affected. Presummably, the flaw can be addressed with a simple software fix, but until then the US-Cert is recommending users switch off WPS.
Related Posts : security,wi-fi,Wireless,wpsPosted byManabharanaat7:03 AMEmail ThisBlogThis!Share to TwitterShare to FacebookLabels:security,wi-fi,Wireless,wps0comments: Post a Comment

Newer PostOlder PostHomeSubscribe to:Post Comments (Atom)Total PageviewsFriendsGamers ZoneTricks For WindowsTV Show InfoFollowersBlog Archive ►  2012(14) ►  January(14) ►  Jan 10(14)Cooler Master unveils astronomically-sized Cosmos ...The beauty of high-speed camerasLG set to show Intel smartphone at CES 2012Pantech's Element is a waterproof 8-inch Android t...BitTorrent launches free personal file-swapping se...Windows 8 adds RAID-like storage pooling and fault...Chrome 17 beta brings speed and security improveme...Facebook giving away 200,000 sets of Timeline busi...Apple to release iPad 3 in March, iPad 4 following...WD intros 4-6TB My Book Live Duo with RAID, remote...Crucial announces 'Adrenaline' hybrid storage kit ...Asus full lowdown, claims 70% market share on X79 ...Israel likens hacker to terrorist for exposing 400...Acer unveils Iconia Tab A200 and quad-core A700 ta...▼ 2011(912)▼ December(147)▼ Dec 30(15)Microsoft closes 2011 with an emergency Windows Up...Gearbox shares more info about Borderlands 2's 'Gu...Google earns top spot in Nielsen's Tops of 2011Wi-Fi Protected Setup design flaw leaves routers o...Neowin's top tech news stories of 2011Verizon to charge $2 fee for paying your bill onli...Some facts about BitTorrentGoDaddy accused of interfering with domain transfe...GSM security vulnerability affects 80 percent of m...Legal Siri port for iOS 5 devices released, proxy ...Microsoft is in better shape than most people thin...Gigabyte issues BIOS update for fire-prone motherb...Intel's 32nm Medfield handset chip benchmarked ear...Asus is not giving up on netbooks yet, readies Eee...Intel to launch 22nm Ivy Bridge processors on Apri... ►  Dec 29(7)Intel ships 'Cedar Trail' Atom processors for netb...60beat introduces GamePad accessory for iOS gaming...Apple to announce two new iPad models in JanuaryIntel's Thunderbolt to see wider adoption starting...Microsoft job listing reveals automatic backups co...HP Envy 14 ReviewAmazon sued for bullying Kindle accessory maker M-... ►  Dec 27(27)Dexter and Game of Thrones most pirated TV shows o...BitTorrent downloads linked to RIAA and DHSTwo Firefox add-ons already bypass SOPA's domain c...Liquid metal beads can automagically repair electr...Seagate and Western Digital announce reduced warra...Firefox 9 released, touts 20-30% more JavaScript p...Intel 'Ivy Bridge' desktop chip prices leakStar Wars: The Old Republic launches today in the ...Intel's Thunderbolt to see wider adoption starting...Mozilla renews Google agreement for default search...Skype offers free Wi-Fi in airports, but not for A...Australia bans Syndicate reboot, EA calls it 'arca...Online holiday retail spending breaks multiple sal...Seagate completes acquisition of Samsung's hard dr... ►  Dec 21(1) ►  Dec 19(9) ►  Dec 16(13) ►  Dec 14(12) ►  Dec 12(12) ►  Dec 11(23) ►  Dec 05(4) ►  Dec 03(24) ►  November(153) ►  Nov 29(16) ►  Nov 25(8) ►  Nov 24(14) ►  Nov 21(12) ►  Nov 18(11) ►  Nov 17(13) ►  Nov 15(1) ►  Nov 14(9) ►  Nov 13(18) ►  Nov 10(6) ►  Nov 09(10) ►  Nov 08(7) ►  Nov 07(9) ►  Nov 05(1) ►  Nov 03(18) ►  October(51) ►  Oct 29(9) ►  Oct 21(14) ►  Oct 19(1) ►  Oct 11(5) ►  Oct 10(7) ►  Oct 04(1) ►  Oct 03(14) ►  September(61) ►  Sep 29(4) ►  Sep 26(3) ►  Sep 24(16) ►  Sep 22(2) ►  Sep 21(11) ►  Sep 20(9) ►  Sep 19(1) ►  Sep 18(10) ►  Sep 15(4) ►  Sep 01(1) ►  August(43) ►  Aug 31(6) ►  Aug 29(3) ►  Aug 23(1) ►  Aug 03(6) ►  Aug 02(11) ►  Aug 01(16) ►  July(24) ►  Jul 31(10) ►  Jul 29(8) ►  Jul 26(2) ►  Jul 21(1) ►  Jul 20(3) ►  June(6) ►  Jun 29(5) ►  Jun 04(1) ►  May(64) ►  May 28(1) ►  May 18(3) ►  May 17(25) ►  May 16(15) ►  May 15(12) ►  May 06(2) ►  May 05(2) ►  May 02(4) ►  April(232) ►  Apr 28(1) ►  Apr 27(10) ►  Apr 26(27) ►  Apr 24(22) ►  Apr 23(1) ►  Apr 22(1) ►  Apr 21(9) ►  Apr 20(8) ►  Apr 19(9) ►  Apr 18(7) ►  Apr 17(5) ►  Apr 14(4) ►  Apr 13(28) ►  Apr 12(9) ►  Apr 11(14) ►  Apr 10(4) ►  Apr 09(25) ►  Apr 08(1) ►  Apr 07(3) ►  Apr 06(5) ►  Apr 05(11) ►  Apr 04(1) ►  Apr 03(12) ►  Apr 02(4) ►  Apr 01(11) ►  March(73) ►  Mar 31(14) ►  Mar 30(3) ►  Mar 27(5) ►  Mar 26(9) ►  Mar 25(6) ►  Mar 24(1) ►  Mar 21(2) ►  Mar 19(9) ►  Mar 17(10) ►  Mar 16(3) ►  Mar 13(1) ►  Mar 10(7) ►  Mar 07(3) ►  February(34) ►  Feb 24(9) ►  Feb 23(2) ►  Feb 20(5) ►  Feb 17(10) ►  Feb 12(8) ►  January(24) ►  Jan 21(1) ►  Jan 18(2) ►  Jan 16(1) ►  Jan 15(2) ►  Jan 14(2) ►  Jan 13(1) ►  Jan 11(2) ►  Jan 10(2) ►  Jan 09(2) ►  Jan 06(1) ►  Jan 05(1) ►  Jan 04(2) ►  Jan 03(3) ►  Jan 02(2) ►  2010(3) ►  December(3) ►  Dec 29(1) ►  Dec 28(2)Copyright ©2010 Tech Info Zone. Powered by Blogger.