BSI warns WPS vulnerability in routers Vodafone - Heise Newsticker

Too easy it has made with the safety of EasyBox router is Vodafone. Once a method for cracking the default WPA password was announced two years ago, have now succeeded in the attack on the wireless setup WPS mechanism. The Federal Office for Security in Information Technology classifies the vulnerability as critical.

crux of the problem: The default passwords were calculated solely from the MAC address of the device. Due to this fact already been, it was possible to calculate the default WPA passwords. However, the determined by Stefan Viehböck of SEC Consult Vulnerability goes beyond that. Even if the end user has changed the WPA password, attackers using WiFi Protected Setup (WPS) to access the router can receive.

This would actually require a code, which must be read on the router. However, this could Viehböck WPS ID calculated with a simple Python script from the BSSID identifier that identifies the router via wireless. So that everyone can get all the necessary information in range of the wireless network to log on. Once an attacker has gained access to the router, it can not only use the internet connection, but also the home network of the user to attack to listen to, for example, via man-in-the-middle attacks passwords.

Vodafone has already drawn attention to the issue in December 2012, but the gap has not been closed. The models are affected EasyBox 802 and produced before July 2011-type devices EasyBox 803 The Federal Office for Security in Information Technology advises as a workaround to change the WPS PIN to disable WPS and on top of that to change the existing password for the wireless encryption. The Federal Office does not preclude that other devices or the supplier Arcadyan Astoria Networks are affected by the vulnerability.

Update 06.08.2013 at 8:10 clock: Meanwhile, Vodafone has promised improvements. Compared to H Security, a company spokesman said: “Currently, Vodafone is working hard on the new firmware for the older boxes Easy.” After the update is accessed also not be possible if customers do not change the access in the router. (Torsten little toe ) / (cfu)