On January 1st we posted a little bit of information regarding the Wi-Fi Protected Setup (WPS) brute force vulnerability. As a follow-up, I have performed a bit more research and analysis on the vulnerability and the attack tools. Here is a list of resources you might want to check out for more information:
No Strings Attached Podcast
I was privileged enough to participate in the @NSAShow’s episode 2 podcast: Wi-Fi Protected Setup, Battered or Broken? I highly recommend giving the podcast a listen as it contains a lot of good information. I’d also like to thank the host @revolutionwifi and the other guest @matthewsgast for a fun and insightful 45 minutes.
We’ve already shared my video demonstration of how a WPS brute force attack works. Since then, I’ve created another video, seen below, demonstrating the use of a tool that identifies vulnerable wireless routers. I’ve also taken some frame captures of an attack and provided an explanation of the frames at different stages of the attack. Sample frames have also been made available for anyone who wants to take a closer look in Wireshark.
United States Computer Response Team (US-Cert)
Here is the original vulnerability note created on December 27, 2011. It details the basic purpose of WPS and describes the vulnerability.
If you are aware of any additional resources, please share them in the comments section below.