1

I recently purchased a wifi extender and I now have to set it up.

There are three options for how to set it up:

  1. Through the app
  2. By pressing the WPS button on the router and then pressing the WPS button on the extender
  3. By connecting to the wifi network of the extender (which does not have a password) and then navigating to a webpage that doesn't have HTTPS and enter the password for the extender.

The fact that there is no preset password is worrying. Considering that 3 is even possible I worry about what security compromises they made in implementing 1.

Is 2. the best bet here? WPS seems to have some vulnerabilities though after googling.

1
  • 1
    There is no generic Wifi Extender and there is no generic app to configure a Wifi Extender. There is also no generic firmware. As for option 3 - it is usually ok for a short time to have no password and a publicly trusted certificate could not be provided for HTTPS anyway. Thus nothing can be said about the actual security of the options 1 and 3. There is also nothing known about the actual implementation of 2 in your environment (repeater and router). In summary: not enough information to answer your question. – Steffen Ullrich Dec 30 '20 at 7:16
1

Using the WPS (Wi-Fi Protected Setup) button is generally considered a secure method. For two minutes after that, your access point will accept new devices onto the network, but not after, which means that the scope for attack is limited. If you are concerned, most access points allow you to find the connected devices to your network, and you can verify that before and after only one new device has connected.

The WPS PIN method is known to be vulnerable to brute force and should generally be disabled on all access points. However, you're clearly not using that technique here.

If you're using the Wi-Fi network of the extender, that is also probably okay, provided you promptly secure it with a strong password you don't use elsewhere. The use of HTTPS is generally not possible on this kind of device because (a) certificates are time-limited, so they could expire before your device got installed, and (b) usually there isn't a secure way to ship the private key required for TLS, so the certificate would end up revoked due to potential misuse.

I generally recommend against using custom apps for setting up embedded devices because typically the security in such scenarios is pretty abysmal and using the app may result in that functionality being enabled on a more permanent basis.

The major threat you need to consider in scenarios 2 and 3 is whether the attacker is present in the small window of time during your power-on and setup. If so, all of these options are insecure, and you should return the device and purchase one that does not power on any radios until set up over an Ethernet connection so that you can secure it adequately at first from a trusted network. You will also of course want to be sure that your network is secured with a passphrase providing at least 128 bits of entropy and that all of your extenders and access points are up to date with security patches.

If, on the other hand, you believe that your major source of attacks is going to be nosy neighbors and not a dedicated, ever-vigilant party, then option 2 is probably secure and also quite easy, and it's a fine choice.

2
  • Ah thanks I now see why doing TLS here is impossible because of the certificate, I hadn't thought about that. But can you explain the private key issue some more? Can they not just encode the private key for the device into the hardware? Clearly it's useless without a valid certificate but why is this a separate issue? I'm not quite understanding. – Lubed Up Slug Jan 1 at 19:56
  • If you hard-code a private key into the device and someone can dump the flash (which they can, with physical access), then the private key is revealed to a third party. If I then sell it to you, I can MITM you and read all your data. You'd need to use a secure element that's tamper-resistant to secure a private key (or a seed). There are some theoretical ways you could get a valid cert if the device had a secure element and a fixed domain name, and you had the vendor cooperate in issuing the cert on the device's behalf, but that's pretty complex and has privacy implications. – bk2204 Jan 1 at 20:18
-1

WPS can be easily hacked. So, make sure you disable WPS in settings.

First and foremost, update the firmware on the device, if possible. A firmware update can sometimes patch security vulnerabilities discovered by the manufacturer or 3rd parties after it left the factory.

Login to settings via the device's default IP address. Enable WPA2 encryption and use a robust password.

Finally, change the default username and password. For example, this might be "admin" and "admin". You need to change these to something else.

1
  • 2
    "WPS can be easily hacked." - my guess is that you refer to WPS PIN method. But this method is not used here. Instead the push button method is used which is not affected by the same problem as the PIN method. If you think otherwise please add the appropriate references to your claim. – Steffen Ullrich Dec 30 '20 at 7:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.