In mid February, I wrote about the huge hole in Wi-Fi security caused by the WiFi Protected Setup feature that's included in most new wireless routers.
Here is what I wrote: "It turns out that the WPS protocol breaks the 8-digit PIN into two have and tests them separately. A wrong PIN generates different errors depending on whether the first four digits failed to match or the last four were wrong. This lets an attacker test the two halves separately, a huge security gaff, cutting the maximum number of combinations to be tested from many millions to just 20,000."
Some routers let you turn WPS off, a good idea, but many popular brands do not. What's been done by the manufacturers whose routers are vulnerable and lack a way to turn off WPS? Not much. What's needed in most cases is a router firmware update.
In the hope of prodding them along, I'm proposing a very simple fix for the WPS PIN vulnerability that should be easy to implement on any router. It only requires adding six lines of source code and uses just one additional word of memory. No persistent storage or change to the user interface is required. All it does is keep a count of how many consecutive failures to enter a valid PIN are detected. If that number exceeds some maximum, say 7, no more PIN entries will be accepted. The count is reset whenever the router is turned off and then on.
Here are the needed software changes, in pseudocode:
Parameter macro declarations (this sets the maximum number of consecutive failed WPS code entries, 7 is a suggested value), add:
WPS_FAIL_LIMIT = 7
Variable declarations, add:
integer WPS_fail_count
Power up initialization code, add:
WPS_fail_count = 0
Modify the firmware's test for successful WPS PIN entry, which presumably looks like something this:
if (enteredPIN == storedPIN) then register new device
else handle bad PIN entry
to include WPS_fail_count test:
if (enteredPIN == storedPIN AND WPS_fail_count <= WPS_FAIL_LIMIT) then begin
WPS_fail_count = 0
register new device
end
else begin
If (WPS_fail_count <= WPS_FAIL_LIMIT) then WPS_fail_count = WPS_fail_count + 1
handle bad PIN entry
end
The altered code simply keeps track of how many bad PINs were added consecutively and does not allow a PIN to be registered if the found exceeds a limit. The failure limit is reset whenever power is turned off and on. Since users are familiar with cycling power as a way to clear router problems, no special user interface or documentation is required.
This is simple and, in my opinion, foolproof. I hereby release my ideas contained in this post regarding fixes to WiFi browsers to the public domain as specified by the Creative Commons CC0 1.0 Universal declaration (http://creativecommons.org/publicdomain/zero/1.0/)
No comments:
Post a Comment