Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have heard a rumor that the WPS brute force attack doesn't work on newer devices, and that you now have to try all 10^7 PINs to find the correct one. Is that true?

share|improve this question
The Wikipedia article on WPS doesn't mention this. Can you link to a reliable source making this claim? – Brendan Long Mar 27 '13 at 15:42
What the heck? Who downwotes and why? No, I doesn't have a source, but people who hack WPS tell that newer devices are unhackable, that's why I ask. – Smit Johnth Mar 27 '13 at 16:00
My guess is the downvotes are because there does not seem to be any support that such a rumor exists, however the question is still valid and the answer appears to be "no, there is nothing making it so that it is no longer broken." It's still a perfectly valid question though. I gave it a +1. – AJ Henderson Mar 27 '13 at 17:57

The three major problems with WPS are: (1) it requires only an 8 digit pin (10^8 is a small keyspace), (2) one digit of that pin is a checksum (hence 7 independent digits and 10^7 pins to check), and (3) the first group of four digits is checked independently - that is you need to only check at most 10^4 ~ 10000 pins to break the first group of four digits; and then 1000 to check the second group (since you know one digit due to the checksum). And really the expected number of attempts is half that; so on average only ~5500 attempts are needed.

WPS slightly mitigates this by mandating that you are locked out for 60 seconds after three consecutive bad attempts. Originally, not all WPS routers enforced this timeout (very bad even without vulnerabilities 2 and 3; checking at a rate of 10 per second; means you can break your neighbor's router in a few months). Some manufacturers will increase this timeout on subsequent failures, which is good. Note the three attempts = 60s timeout is not a panacea; e.g., will take 3.82 days on average (and at most 7.64 days) to crack into your neighbors WPS enabled router. Granted exponential timeouts could mitigate brute forcing; however how these timeouts are implemented is important. (E.g., if the attacker changes their wifi mac address on each attempt will they continue to be blocked out? Otherwise can you use this to DoS WPS connections?).

Now to answer your question: CERT (last updated May 2012) is "currently unaware of a practical solution to this problem" and recommends disabling WPS.

Also while there are rumors of a new WPS 2.0 standard eventually coming out, especially in the responses to this vulnerability. Hopefully, this fix would not let an attacker know if they've found a portion of the key and hopefully would require all digits to be independent instead of having a worthless checksum. However, the wifi alliance page on WPS doesn't mention this at all (e.g., the last press-release on WPS is from Feb 2008) unless its in one of the standards that cost $100-$200 to purchase. Standards tend to change slowly as it requires both the software and hardware end of the client and router to be fully compatible (and backward-compatible).

Granted, I'd expect nowadays more WPS enabled routers to implement the 60s + exponential timeout, but still would never recommend for anyone to use WPS.

share|improve this answer
Thank for describing of WPS vulnerability.. oh wait, I already knew it! For some reasons, WPS bruteforce with reaver doesn't work for that people. Wonder why. – Smit Johnth Mar 27 '13 at 19:37
@SmitJohnth - Never claimed you didn't understand it, but this is a forum for people who may not be familiar with WPS (Wifi Protected Setup) so some context is helpful. The reason some tool (e.g., reaver) isn't working on newer routers is likely not a new protocol that brute-forcing the entire 10^7/10^8 (e.g., CERT isn't aware of it; wifi alliance hasn't announced new WPS protocol), but instead exponential/permanent timeouts after too many bad attempts preventing WPS brute-forcing. – dr jimbob Mar 27 '13 at 21:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.