US-CERT warns about security flaw affecting millions of wireless routers
The US Department of Homeland Security has issued a warning about a vulnerability that exposes millions of wireless routers to brute force attacks.
A design flaw in the WiFi protected setup (WPS) specification for the PIN authentication used by many wireless routers “significantly” reduces the time required to launch a brute force attack against the PIN because the flaw allows an attacker to know when the first half of the eight digit PIN is correct, warned the US Computer Emergency Readiness Team (US-CERT) in a vulnerability note.The lack of a proper lock out policy after a certain number of failed attempts to guess the PIN on wireless routers makes this brute force attack that much more feasible.
“An attacker within range of the wireless access point may be able to brute force the WPS PIN and retrieve the password for the wireless network, change the configuration of the access point, or cause a denial of service”, US-CERT said.
WPS is a standard developed by the WiFi Alliance to ease the set up of a wireless home network. WPS contains an authentication method called “external registrar” that only requires the router’s PIN, US-CERT said. More
