Ease of configuration may also ease with rhyme of piracy. According to a notice published by the US-CERT, the Wi-Fi Protected Setup standard is affected by a security vulnerability for which there is currently no practical solution and exploitation can lead to the compromise of pine (8-digit code) of a wireless router.
The WPS has been implemented by the Wi - Fi Alliance to simplify the configuration of the security of wireless networks. To add a device to a secure network, it is sufficient to use a PIN (Personal Identification Number) number. A method among four possible.
According the Stefan Viehbock security researcher, a design vulnerability allows to resort to brute-force attack to access a network WPS with pine in only two hours.
When a first attack fails, the router returns a response in a way that allows the attacker to determine the first half of the pine. The last digit of the pine is also known by the sum of control (checksum for the PIN). This helps reduce the time needed to complete the sequence.
Stefan Viehbock gives more details on the WPS vulnerability in a PDF document. He has developed a tool for brute-force attack in Python but not yet published it. In his view, the US-CERT is a list of vendors affected by the vulnerability (Belkin, Buffalo, D-Link, Linksys, Netgear, Technicolor, TP-Link, ZyXEL).
The only measure of circumvention advocated is to disable WPS. US-CERT recalls the crossing best practices to follow: use WPA2 encryption with a password strong, disable the UPnP and enable MAC filtering (to only allow the connection of devices of confidence).
0 Comments:
Post a Comment