Timeline for Has the WPS brute-force cracking issue been fixed?
Current License: CC BY-SA 3.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 8, 2016 at 23:41 | comment | added | Smit Johnth | And I tell you this happens for me rather seldom. And FYI mac spoofing doesn't work. | |
| Dec 6, 2016 at 3:04 | comment | added | dr jimbob | @SmitJohnth - The question "Has the WPS brute force cracking issue been fixed" is NO. Attackers that know what they are doing can crack modern routers with WPS enabled. It may not be as easy as it originally was via better adoption of timeouts, but with patience (and MAC spoofing) you can break the protocol. WPS is still a broken protocol. | |
| Dec 4, 2016 at 4:47 | comment | added | Smit Johnth | This question is not about "should I use WPS" but about why can't people crack almost no router with WPS. | |
| Dec 3, 2016 at 7:11 | comment | added | dr jimbob | Practical attacks exist on WPS. There is no new WPS protocol. DO NOT USE WPS. Since this post more WPS attacks have been discovered that vastly speed up the time to break many popular WPS implementations of routers from 2014 and earlier (see WPS pixie dust attack). My guess is some routers may be better at detecting at stopping obvious brute force attempts (e.g., ban a MAC address after 100 bad guesses, but say spoofing your MAC can get around this). Don't trust un-sourced rumors to avoid active security advisories. | |
| Dec 2, 2016 at 19:12 | comment | added | Smit Johnth | That's still not an answer to a question whether practical attacks on WPS are working today. | |
| Mar 27, 2013 at 21:04 | comment | added | dr jimbob | @SmitJohnth - Never claimed you didn't understand it, but this is a forum for people who may not be familiar with WPS (Wifi Protected Setup) so some context is helpful. The reason some tool (e.g., reaver) isn't working on newer routers is likely not a new protocol that brute-forcing the entire 10^7/10^8 (e.g., CERT isn't aware of it; wifi alliance hasn't announced new WPS protocol), but instead exponential/permanent timeouts after too many bad attempts preventing WPS brute-forcing. | |
| Mar 27, 2013 at 19:37 | comment | added | Smit Johnth | Thank for describing of WPS vulnerability.. oh wait, I already knew it! For some reasons, WPS bruteforce with reaver doesn't work for that people. Wonder why. | |
| Mar 27, 2013 at 16:24 | history | edited | dr jimbob | CC BY-SA 3.0 |
wrong link.
|
| Mar 27, 2013 at 16:14 | history | answered | dr jimbob | CC BY-SA 3.0 |