WiFi Protected Setup Design Flaw Allows for PINs to Be Easily Guessed

At the end of 2011, security researcher Stefan Viehbock informed the United States Computer Emergency Readiness Team (US-CERT) of a major design flaw that existed in the latest wireless routers that incorporate the WiFi Protected Setup (WPS).

Now, Neowin provides a detailed explanation that shows how an 8-digit PIN can be guessed in less than a day.

WPS can be found in most commercial routers sold over the past few years, which means that a large number of individuals may be affected by the vulnerability present in the system that was designed to secure users in the first place.

Whenever someone tries to connect to a router that supports WPS, they are requested to provide an 8-digit PIN found on the back of the device.

While normally it would take someone more than 60 years to guess the PIN, especially since most routers go into a lock-down state for one minute if three wrong codes are entered, the recently discovered flaw allows for someone to guess it in around a day.

This is possible because the system is designed to split the 8 digits into 2 sets of 4, and if the first set is entered correctly, the router indicates this, giving the potential crook more chances of uncovering the password.

However, there are some ways in which users can protect themselves. The easiest way to secure a device is by updating its firmware to the latest variant offered by the vendor or by using a third party firmware such as Tomato or DD-WRT.

Another way to secure a router is by disabling WPS using the web interface. In order to test if the WPS is actually disabled, users can use another computer to connect to the network and if they’re prompted for the WPA key, they’re safe.