Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was reading about Reaver and wi-fi protected setups (WPS). In my Netgear router I have the option to disable the WPS pin code, but still have the WPS push button enabled. Am I secured with such configuration?

Or does Reaver also attack WPS without the pin?

share|improve this question
    
If you are worried about Reaver it means you should verify you are using the most current firmware offered by Netgear for your router. Once you do that just disable ALL WPS, WPS at the very core is not secure, and there is only one implementation that is secure and its not used by Netgear. –  Ramhound Aug 27 '12 at 15:46

1 Answer 1

up vote 3 down vote accepted

If Netgear has implemented it properly, WPS Push-button-connect should be secure. However, I have no idea whether Netgear has implemented it properly, and if they haven't, you might be insecure.

The known attack on WPS is described in this paper:

For another great explanation, see also:

The attack described there breaks the PIN-based forms of WPS. It is not effective against a properly implemented version of WPS Push-button-connect (PBC), because a remote attacker cannot physically push the button your router, and WPS PBC requires someone to press the button before it can proceed.

Therefore, if Netgear has implemented WPS PBC correctly, and has properly disabled all the other forms of WPS, you should hopefully be safe (fingers crossed).

(Do make sure you are running the latest version of the Netgear firmware. The WPS attacks were only discovered less than a year ago, so versions of the firmware written before the attack was discovered are very likely to be vulnerable.)

That said, router vendors have screwed this stuff up before. The bad track record, and the fact that it is not easy for an average user to tell whether they've finally gotten it right this time, does give some room for concern. I think it would be understandable if this makes some security folks throw up their arms in disgust and say "oh, to heck with it, just turn off WPS, I don't trust the router vendors to get this right".

So, how much do you trust Netgear to not screw this up?

share|improve this answer
    
To be fair, Netgear were the least hopeless. The PDF you linked to says their mitigation would increase the time-to-crack to about a day. That was before the vulnerability was released. I think they scored well in having options. And the –  sourcejedi Aug 27 '12 at 17:07
    
@D.W. - I actually think you are mistaken about the WPS Push-button-connect version of WPS being secure. If I am not mistaken depending on how the WPS Push-button-connect is actually implemented there are insecure ways of doing it. The "proper" way is the code is generated by software, the only implementation done that way, is used by Apple. It was already discovered there is no way to "fix" WPS so the feature itself is 100% flawed and is likely...hopefully dropped entirely. Everything else you say is 100% correct. The Security Now eps on this issue might be a good resource for the author –  Ramhound Aug 28 '12 at 13:22
2  
@Ramhound, Interesting. Do you have a reference to the vulnerabilities in WPS Push-button-connect? My understanding is that WPS Push-button-connect does not have any PIN, so the PIN-guessing attack found by Viehböck does not apply. Have I misunderstood? Or is there a different attack that I'm unaware of? (I'm not sure what you meant by "the code"; as far as I know, WPS PBC does not use a PIN. Have I misunderstood?) –  D.W. Aug 28 '12 at 18:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.