Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am testing a router for vulnerability, and I've noticed an interesting anomaly. It isn't the first time I noticed it, either. When entering the right PIN, Reaver will return with a different PSK and SSID each time. However, none will ever work. Here's an example of output:

~$ reaver ...
[+] Waiting for beacon from xx:xx:xx:xx:40:19
[+] Associated with xx:xx:xx:xx:40:19 (ESSID: xxxxxx7Y)
[+] Trying pin xxxxxx33
[+] WPS PIN: 'xxxxxx33'
[+] WPA PSK: 'bE8vLF121WVW8YJhiJSHU5VdYItwo5Y8Cv8KpWV9'
[+] AP SSID: 'NTGR_kRq'

~$ reaver ...
Reaver v1.4 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner <cheffner@tacnetsol.com>

[+] Waiting for beacon from xx:xx:xx:xx:40:19
[+] Associated with xx:xx:xx:xx:40:19 (ESSID: xxxxxx7Y)
[+] Trying pin xxxxxx33
[+] Trying pin xxxxxx33
[+] WPS PIN: 'xxxxxx33'
[+] WPA PSK: 'd45zG5uYHwsdu14ZEsioF9IWWzRrJPL2eWBrGYAkRikYThaC4'
[+] AP SSID: 'NTGR_A5VzduBlQv'
macai@macai:~$

These two attempts were made less than a minute within each other. The BSSID, PIN, and real ESSID have been blanked out. The generated PSKs and generated SSIDs, however, are both real.

So, the question raised is threefold:

  1. Is this behavior a glitch, or is it deliberate technology?

  2. Does this behavior have a name, and if so, what is it?

  3. Are there any known vulnerabilities of this behavior?

share|improve this question
    
That's interesting. I'm writing a blog about WiFi security and cracking WPS. I've completed the attack against 4 access points and not seen this behavior. –  Scott Helme Sep 20 '13 at 14:07
add comment

3 Answers

This behavior is very similar to WIPSs (Wireless intrusion prevention system).

A wireless intrusion prevention system (WIPS) is a network device that monitors the radio spectrum for the presence of unauthorized access points (intrusion detection), and can automatically take countermeasures (intrusion prevention).

share|improve this answer
    
I'm convinced that it's a WIPS of some sort, I was just being conservative and open-minded enough to consider the possibility that it's a glitch. Also, I want to know if this particular approach has a name and if it's vulnerable in some way. Would you know about any of that? –  Luke Laupheimer Sep 21 '13 at 2:54
add comment

Yes it is still vulnerable. Instead of using reaver you can make your own little script to brute force wps pin. Using a command 'wps_reg'. However if the router has wireless intrusion prevention system the wps feature will probably go to the (WPS)locked state after a couple attempts.

share|improve this answer
add comment

The same access point can broadcast several SSIDs, so it looks like the one you're attacking is broadcasting two; and that reaver only shows (or gets from the AP!) a SSID at a time.

I would try with a different WPS cracking tool as well to check if you get similar results. You could try with bully or (more obsolete) wpscrack. Bully bundled with Kali Linux.

Please let us know, it is going to be interesting. :)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.