search menu icon-carat-right cmu-wordmark

CERT Coordination Center


WiFi Protected Setup (WPS) PIN brute force vulnerability

Vulnerability Note VU#723755

Original Release Date: 2011-12-27 | Last Revised: 2012-05-10

Overview

The WiFi Protected Setup (WPS) PIN is susceptible to a brute force attack. A design flaw that exists in the WPS specification for the PIN authentication significantly reduces the time required to brute force the entire PIN because it allows an attacker to know when the first half of the 8 digit PIN is correct. The lack of a proper lock out policy after a certain number of failed attempts to guess the PIN on many wireless routers makes this brute force attack that much more feasible.

Description

WiFi Protected Setup (WPS) is a computing standard created by the WiFi Alliance to ease the setup and securing of a wireless home network. WPS contains an authentication method called "external registrar" that only requires the router's PIN. By design this method is susceptible to brute force attacks against the PIN.

When the PIN authentication fails the access point will send an EAP-NACK message back to the client. The EAP-NACK messages are sent in a way that an attacker is able to determine if the first half of the PIN is correct. Also, the last digit of the PIN is known because it is a checksum for the PIN. This design greatly reduces the number of attempts needed to brute force the PIN. The number of attempts goes from 10^8 to 10^4 + 10^3 which is 11,000 attempts in total.

It has been reported that many wireless routers do not implement any kind of lock out policy for brute force attempts. This greatly reduces the time required to perform a successful brute force attack. It has also been reported that some wireless routers resulted in a denial-of-service condition because of the brute force attempt and required a reboot.

Impact

An attacker within range of the wireless access point may be able to brute force the WPS PIN and retrieve the password for the wireless network, change the configuration of the access point, or cause a denial of service.

Solution

We are currently unaware of a practical solution to this problem. Please consider the following workarounds:

Disable WPS

Within the wireless router's configuration menu, disable the external registrar feature of WiFi Protected Setup (WPS). Depending on the vendor, this may be labeled as external registrar, router PIN, or WiFi Protected Setup.

Vendor Information

723755
Expand all

Belkin, Inc.

Updated:  January 06, 2012

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://en-us-support.belkin.com/app/answers/detail/a_id/75/~/disabling-wps-on-the-router

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Buffalo Inc

Updated:  December 27, 2011

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Cisco Systems, Inc.

Updated:  January 30, 2012

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

Additional information about affected devices can be found in the links below.

Vendor References

http://tools.cisco.com/security/center/content/CiscoSecurityResponse/cisco-sr-20120111-wps

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

D-Link Systems, Inc.

Notified:  December 05, 2011 Updated:  December 27, 2011

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Linksys (A division of Cisco Systems)

Notified:  December 05, 2011 Updated:  January 30, 2012

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

Additional information about affected devices can be found in the links below.

Vendor References

http://www6.nohold.net/Cisco2/ukp.aspx?vw=1&articleid=25154

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Netgear, Inc.

Notified:  December 05, 2011 Updated:  January 12, 2012

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://support.netgear.com/app/answers/detail/a_id/19824/kw/disable%20wps

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

TP-Link

Updated:  December 27, 2011

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Technicolor

Updated:  February 09, 2012

Status

  Affected

Vendor Statement

The vendor has provided the information found below.

Vendor Information

The vendor states that Technicolor products use an anti brute-force mechanism: after 5 retries, the access point is locked for 5 minutes. A penetration test performed by the vendor found that to exhaust every possible PIN would take around 189.44 hours (about 7.89 days).

Technicolor will follow the WiFi Alliance (WFA) recommendation concerning the fix for this vulnerability to keep WFA certification for their devices. Technicolor will implement the following:

Access point is locked after 10 faulty PIN code attempts. Then, the end-user resets the access point lock state via the GUI/CLI or a reboot of the access point.

Customers should contact the vendor to inquiry when firmware updates will be available that include this feature.

It is possible to disable WPS completely using the command line interface (when available) by issuing the following command:

    :wireless wps config state disabled
 

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

ZyXEL

Updated:  December 27, 2011

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C
Temporal 9.3 E:H/RL:U/RC:C
Environmental 9.3 CDP:/TD:/CR:ND/IR:ND/AR:ND

References

Credit

Thanks to Stefan Viehböck for reporting this vulnerability.

This document was written by Jared Allar.

Other Information

CVE IDs: CVE-2011-5053
Severity Metric: 17.86
Date Public: 2011-12-27
Date First Published: 2011-12-27
Date Last Updated: 2012-05-10 16:46 UTC
Document Revision: 51

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.