1

Recently I read about the pixie dust attack in which a WPS PIN is decoded with time stamp and other resources within a fraction of a second. The only drawback is that it only works on WPS-enabled routers.

What is the success rate of this attack? Is it better than a bully brute force attack?

Improve this question

1 Answer 1

Reset to default
0

These days, most wifi routers incorporate various forms of protections against attacks like pixie dust, e.g., not allowing multiple tries for the PIN in quick succession. Some even require a human admin reset after, say, 3 wrong PINs.

Furthermore, the weaknesses of WPS are well known, so more people are disabling it if they can.

Thus, the success rates are not high these days.

Improve this answer
3
  • 2
    I doubt that a lot of people really bother with AP configuration. Sure, you and me, we disabled WPS, but you think average Joe will visit 192.168.0.1 and bother checking what all of these things mean? He'll assume it'll be fine the way it is.
    – user163495
    Commented Apr 12, 2020 at 17:33
  • Sure, average Joes would not bother, but anecdotal evidence suggests that at least among more tech savvy people, WPS doesn't have a reputation as being very secure and should be disabled. Nevertheless, I'm thinking the main reason why the success rate is not so high these days is that most wifi routers implement the sorts of protections mentioned above.
    – auspicious99
    Commented Apr 12, 2020 at 17:39
  • 1
    Most wireless access points I have seen recently have WPS disabled, strictly rate limited, or require a physical button press to temporarily enable WPS.
    – multithr3at3d
    Commented Apr 12, 2020 at 18:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .