3 ms·
Aren't WPS Pins completely flawed in their design anyway? I seem to remember being able to use an exploit to break into my own router that had WPS enabled abou
by jgrowl 12y ago
Aren't WPS Pins completely flawed in their design anyway?
I seem to remember being able to use an exploit to break into my own router that had WPS enabled about a year ago using a program called reaver.
The exploit had something to do with routers telling the attacker whether or not they guessed the first 4 digits correctly and then it narrowed it down enough to where bruteforcing was easy.
- amckenna 12y agoYup! Basically the problem boils down to: "An attacker can derive information about the correctness of parts the PIN from the AP´s responses. > If the attacker receives an EAP-NACK message after sending M4, he knows that the 1st half of the PIN was incorrect. > If the attacker receives an EAP-NACK message after sending M6, he knows that the 2nd half of the PIN was incorrect. This form of authentication dramatically decreases the maximum possible authentication attempts needed from 108 (=100.000.000) to 104 + 104 (=20.000). As the 8th digit of the PIN is always a checksum of digit one to digit seven, there are at most 104 + 103 (=11.000) attempts needed to find the correct PIN." Reference - http://sviehb.files.wordpress.com/2011/12/viehboeck_wps.pdf http://sviehb.files.wordpress.com/2011/12/viehboeck_wps.pdf