WPS stands for WI-FI Protected Setup<\/strong> and it is a networking standard that tries to make connections between a router and wireless devices easier and faster. Instead of entering the WP2-PSK key for each device you can use WPS to connect your devices to the network.<\/p>\n There are several ways to connect to a wireless network that uses WPS:<\/p>\n <\/p>\n The first two points seems to be more or less secure, because you\u2019ve to press the WPS button on the router that make it difficult for a remote attacker if he has no physical access. But what\u2019s about the third method with the 8 digit pin?<\/p>\n Bruteforece a 8 digit pin = 10^8 = 100\u2019000\u2019000 possibilities!<\/strong> Sounds secure, but\u2026<\/p>\n Back in 2011, a security researcher discoverd that you don\u2019t need to try all 100\u2019000\u2019000 pin combinations. The last digit is just a check digit that is calculated from the previous seven. That means that WPS pins are effectively only seven digits long.<\/p>\n But not enough, the 8-step protocol doesn\u2019t validate the pin in form of a seven digit number. It checks the first four digits and only if those are right it does check the last three digits.<\/p>\n 10^4 = 10\u2019000 + 10^3 = 1\u2019000<\/strong>. Instead of 10\u2019000\u2019000 combinations you only have to try 11\u2019000 combinations to get the WP2-PSK key<\/strong>.<\/p>\n The problem is known since 2011, but most of the vendors who implement WPS functionality in their devices didn\u2019t react. Such an attack can still be lucrative for an attacker, because WPS is activated by default in most devices and it won\u2019t by hard to find WPS routers in your environment if you do a scan. Another fact is that not many routers have implemented security meassures against a WPS bruteforece attack, forexample that your MAC Address will be locked out after few false tries\u2026<\/p>\n Let’s move over to part 2 where I’ll show you step by step how you can do such a attack \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"\n
![\"\"](\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_pin_on_router.jpg\")
![\"\"](\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_pin.png\")
<\/p>\n![\"\"](\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2018\/03\/wps_combination.png\")
<\/p>\n