WPA Wifi Security: The Reaver Threat

The Vulnerability of WPS and Network Security

Most internet users are now familiar with the security risks associated with using WEP for network protection, as demonstrated by its susceptibility to relatively quick hacking – often achievable within just five minutes.

For some time, the recommended practice has been to implement WPA or WPA2 security protocols, coupled with a robust, lengthy password designed to resist brute-force attacks.

The WPS Backdoor

However, a considerable security flaw exists within many routers, presenting a potential point of exploitation. This vulnerability centers around a technology known as WPS (Wi-Fi Protected Setup).

This technology, while intended to simplify network setup, introduces a significant backdoor that can compromise network security.

How the WPS Hack Works

The WPS hack leverages a weakness in how the protocol handles PIN verification. It doesn't require cracking the password itself, but rather exploiting the PIN system.

Attackers can attempt to brute-force the 8-digit WPS PIN, and because of the protocol's design, it only requires a limited number of attempts before revealing the network password.

Testing Your Network's Security

It is crucial to determine if your network is vulnerable to this WPS exploit. Several tools are available online that can assess your router's susceptibility.

These tools typically attempt to brute-force the WPS PIN and will indicate whether your network is protected or at risk.

Preventing WPS Exploitation

Fortunately, there are several steps you can take to mitigate the risk of a WPS attack:

• Disable WPS: The most effective solution is to disable WPS functionality entirely within your router's settings.
• Use a Strong Password: Ensure your WPA2 password is complex and lengthy, making it difficult to crack through traditional methods.
• Keep Router Firmware Updated: Regularly update your router's firmware to benefit from the latest security patches.

By taking these precautions, you can significantly enhance the security of your wireless network and protect it from potential exploitation through the WPS vulnerability.

Understanding Wi-Fi Security: WPA and WPS

WPA, the Wi-Fi Protected Access protocol, is inherently a robust security measure. Its passphrase is resistant to cracking unless a simple, easily guessed passphrase is used, making brute-force attacks impractical in most scenarios.

However, WPS (Wi-Fi Protected Setup) presents a different situation. This feature, commonly found on wireless routers, was designed to simplify network connection, but introduces a significant security vulnerability.

The WPS Weakness

WPS allows users to connect devices without entering the full WPA passphrase. This is achieved through a physical PIN located on the router, or by pressing a button on both the router and the connecting device to establish a pairing.

The core issue lies in the WPS PIN itself – an 8-digit numeric code. This PIN is susceptible to brute-force attacks, particularly when a vulnerable router and a strong wireless signal are present.

Successful exploitation of the WPS PIN grants access to the WPA passphrase, effectively compromising the entire network.

Tools for Exploiting WPS

Reaver, developed by Craig Heffner and available on Google Code, is a tool specifically designed to target WPS vulnerabilities. It automates the brute-force process against susceptible networks.

Here's a demonstration of Reaver in operation, showcasing the revelation of the WPA passphrase:

Independently, Stefan Viehböck identified the same vulnerability and created a comparable tool. A video illustrating his application's functionality is provided below:

Addressing the Security Vulnerability

Several approaches can be taken to lessen the impact of this attack. Initially, completely deactivating the WPS function on your router presents a solution. However, this isn't universally achievable, as WPS is frequently enabled by default.

Furthermore, my investigation revealed a concerning detail: on my particular router, disabling the WPS PIN option didn't actually eliminate the factory-printed PIN. It only prevented the setting of a custom PIN.

Even when disabled, users retain the ability to connect a wireless client via WPS, utilizing either the Push Button or PIN Number method.

Consequently, in certain instances, this appears to be a persistent vulnerability that cannot be resolved solely through user configuration.

An alternative strategy involves disabling the wireless network on vulnerable devices. However, this is impractical for most users who rely on Wi-Fi for their laptops and mobile devices.

More technically proficient users might consider implementing MAC address filtering, creating a whitelist of permitted devices. However, this security measure can be easily bypassed through MAC address spoofing.

A final defense involves devices initiating a lockout after multiple unsuccessful connection attempts. While this doesn't entirely prevent an attack, it substantially increases the time required for its completion. For example, Netgear routers incorporate an automatic five-minute blocking period.

My testing showed this only extended the attack duration to approximately one day. A firmware update that extends the lockout duration could significantly increase the overall time needed for a successful attack. This update would require either user intervention or automatic execution during router restarts, a common practice with cable internet services.

Experimentation and Vulnerability Testing

Individuals interested in evaluating the security of their own wireless networks can acquire the most recent version of the Reaver code from the project's repository on Google Code. Testing necessitates a Linux distribution – Backtrack is a recommended option – alongside a wireless network adapter capable of promiscuous monitoring and the corresponding drivers and aircrack-ng software package.

Prior experience with WEP cracking, as detailed in a previous guide, will prove beneficial in utilizing this tool.

Following the download, access the extracted directory and execute the following commands, substituting 'XXXXX' with the current version number. The console's auto-completion feature (activated by pressing TAB) can assist with filename input:

tar -xvf reaver-XXXXX.tar.gz

cd reaver-XXXX/src

./configure

make

make install

airmon-ng start wlan0

Confirmation of a new 'mon0' interface creation should be displayed. Network scanning for potential targets can then be initiated using:

walsh -i mon0