Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I own the Linksys EA6500 and it has WPS with the WPS button. I have disabled WPS (enabled by default) because I remember reading about brute force attacks against WPS routers which have them enabled and this eventually gives the hacker full access to the router if it has default username/passwords (I don't). Is that something I should be worried about on my new router, since I believe I read it around 2-3 years ago?

enter image description here

share|improve this question

1 Answer 1

up vote 0 down vote accepted

The WPS attack I know was based on the PIN method, and that on some routers one couldn't disable it and the router didn't limit the attempts and through a technique one would only need about 10'000 attempts.

Since the push-button method of WPS is not per se unsafe (only if an attacker happens to try to connect after you've pushed the button and before you do), there's nothing to worry about even when it's left enabled (i.e. WPS is enabled but not in effect until you push the button).

share|improve this answer
    
I do have the PIN. Is the risk still there, if I have a pin? Added picture for clarification. –  sabrefresco Jan 29 '13 at 16:01
    
Yes, if your router offers a PIN, it could be vulnerable. It depends on whether or not Cisco has implemented security measures against this attack. So it's safer to leave this off. To be really sure, try to pair a device with the router PIN after you've disabled WPS. If it works, then you have a problem. The push button method may still work even with WPS disabled, but that's not a problem (that is, if you have a physical button on the router to press). –  Stefan Seidel Jan 30 '13 at 5:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.