WiFi Protected Setup WPS- Security Alert

[AliceKlaar]

There is a security weakness with WiFi Protected Setup (WPS) that allows the 8 digit PIN (effectively 7 digits plus checksum) to be brute forced in two parts due to protocol handling errors similar to the old 2*7 !=14 Lanman password implementation.
Basically after the first 4 digits have been sent the access point reports an incorrect PIN with EAP-NACK This allows a 0000-9999 atack followed by a similar 000-999 (+ checksum ). This reduces the keyspace from 99.999.999 to only 11,000.

Stefan Viehböck discovered this fault and has released POC code, whitepaper and a video demonstration,on his site ( http://sviehb.wordpress.com/2011/12/...vulnerability/ ). Craig Heffner of Tactical Network Solutions has independently discovered the vulnerability and has also released a bruteforce tool.

There is a US-CERT http://www.kb.cert.org/vuls/id/723755 that cites disabling WPS as a workaround

This info released to public domain 2011-12-27

[phaZed]

Yay! I hate WPS anyway! Now I can truthfully tell people it sucks.

[4ycr]

It's something I have never used. I have always done it manually