Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

US-CERT recently released Vulnerability Note VU#723755.

http://www.kb.cert.org/vuls/id/723755

In short, this describes how modern wireless routers can have their PSKs discovered within just a matter of hours - even if they're using WPA2 with a strong PSK.

The exploit is done by abusing a design flaw in the Wi-Fi Protected Setup (WPS) feature that is common to most routers. The WPS PIN can be (relatively) easily brute-forced, and this can lead to revelation of the WPA2 PSK. This remains effective even if the victim changes their PSK. The only known work-around is to disable the WPS feature.

I personally don't use the WPS feature at all. I use randomly-generated 63-character PSKs which I either manually enter or cut-and-paste to client devices. The fact that there is a side-channel attack which can easily circumvent this protection bothers me a bit. So, I'd like to disable the WPS feature as suggested.

However, on my Linksys routers (WRT400N and E3000), I can't see a way to do that.

When I go to the Wireless section of my routers' configuration sites, (both appear the same, in regards to this post) I see this:

enter image description here

Below that is my basic wireless radio configuration options (Network Mode, Network Name (SSID), Channel Width, Wide Channel, Standard Channel, SSID Broadcast) for each of the 2.4 and 5 GHz bands. Nothing here, aside from the Wi-Fi Protected Setup radio button, addresses anything related to security.

If I go to the Wireless Security section, I only see the options for configuring my passphrase on each band. No mention of Wi-Fi Protected Setup in there.

However, if I select the Wi-Fi Protected Setup radio button under Basic Wireless Settings, I see this:

enter image description here

Obviously, I've obscured the PIN here. Also, below this section are configuration details of the WPA2 PSKs for each radio band. The key element I'm concerned with though, is where it says "Wi-Fi Protected Setup Status: Configured". Does this mean that my router still has the WPS service active, despite the fact that I'm not using it? If so, how can I disable it on this router? Is there an option I'm missing?

NOTE: I've checked and found a firmware update for the WRT400N, but the E3000 is already running the most current version. Also, I don't see anything in the Release Notes for the WRT400N's update which seems to be addressing my issue.

share|improve this question
2  
With it set to Manual the rest doesn't mean anything. They hold the previous values so you can turn it on/off without re-configuring it every time. –  Brian Jan 4 '12 at 18:49
    
@Brian According to Amoork - and I tend to agree - the Manual/WPS radio has no effect on whether the feature is enabled or not. It's simply the mechanism within the GUI that allows you to access the WPS configuration. –  Iszi Jan 9 '12 at 15:08

4 Answers 4

up vote 2 down vote accepted

While not an ideal solution, installing the DD-WRT or Tomato custom firmwares will resolve this, as they do not implement WPS

share|improve this answer
    
I think there's an entire sub-culture that would disagree that this is "not an ideal solution". I'm not one of them though. Still, thanks for putting it out there. –  Iszi Jan 9 '12 at 16:13
    
Oh definitely, I'm part of the sub-culture that would entirely recommend going the custom firmware route, it's not everyone's cup of tea though :) –  benwh Jan 9 '12 at 16:16
    
Giving up on waiting for firmware updates, I think I'm going to go with this route. Thanks for the suggestion. –  Iszi Feb 3 '12 at 19:47

I have the E3000 router and have also been looking for a way to disable it, and as far as my research goes, it is currently not possible (with FW 1.0.04).

That "Manual" switch only affects the GUI, if you look at the beacon (with some WiFi Analyzer) you will notice that WPS is still enabled.

UPDATE: Take a look at here. The guy there basically states (about E3000) that "Vulnerable: YES - however, the WDS falls over quickly so it is not very practical to attack a router.", so thanks to it's vulnerability to denial of service, it withstands the WPS attack...

Information about other routers is also listed in his public google spreadsheet.

share|improve this answer
    
This is what I suspected. One of these days, I'm going to get a Wi-Fi NIC capable of packet injection so I can test these things for real. –  Iszi Jan 6 '12 at 14:08

Cisco announced dates for firmware releases which allow Disabling WPS. Both E3000 and WRT400N remain To Be Determined, but some models list "early March".

http://www6.nohold.net/Cisco2/ukp.aspx?vw=1&articleid=25154#

They suggest disabling all wifi in the meantime. Thanks, Cisco!

share|improve this answer

As of 1/9/2012, there is no way to fully disable WPS on Linksys products.

See: http://www.smallnetbuilder.com/wireless/wireless-features/31664-waiting-for-the-wps-fix

and

http://arstechnica.com/business/news/2012/01/hands-on-hacking-wifi-protected-setup-with-reaver.ars

MAC address filtering offers some protection, but can easily be bypassed.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.