WPA2 Password Cracking in under 10 hours - WPS Side-channel attack

[#1]

I've seen a few news articles come through in the past 24 hours about a new Wi-Fi attack. It uses an attack on the implementation of WPS (ironically, WiFi Protected Setup) to crack WPA and WPA2 network passwords:
http://nakedsecurity.sophos.com/2011/12/30/most-wi-fi-routers-susceptible-to-hacking-through-securit...
http://isc.sans.edu/diary.html?storyid=12292
Here is a more technical write-up of the vulnerability:
http://sviehb.files.wordpress.com/2011/12/viehboeck_wps.pdf
I won't link to the tool, but there is already some free software around to do this.
Long passwords are no defence against this as it actually cracks an 8 character PIN. Best thing you can do is to search for the model of your router and see if you can disable WPS.
[Moderator's note by Dick (Strat) First and last URLs fixed.

[#2]

WPS appears to be off by default on my Billion 7800N.

[#3]

My Netgear doesn't support it 
http://support.netgear.com/app/answers/detail/a_id/96
http://support.netgear.com/app/answers/detail/a_id/34/session/L2F2LzEvdGltZS8xMzI1MjQ2MDcxL3NpZC9DUU...

[#4]

We ship all our technicolor routers with WPS off.

[#5]

I cannot find anywhere in the setup of my BT Voyager 2110 (supplied by Plusnet) to check this setting. Does this mean the router does not have this feature? I know its a few years old but the firmware has been updated during that time.
www.voyager.bt.com is not responding at present.

[#6]

Isn't WPS a Windows "feature"?

[#7]

The Voyager 2110 does not support WPS.
WPS is a wireless specification. Microsoft decided to adopt it within the Windows 7 core wireless functionality, through wireless cards that support it (supply the required API calls to windows).

[#8]

Buffalo WBMR-HP-GN have it enabled by default

[#9]

Thanks Phil. It pays not to be using state-of-the-art kit it seems!

[#10]

I can't see what the problem is as you need access to the router for this to work. You need to press a button on it to activate WPS. Am I missing something? 

[#11]

Taken from the first link:

Quote

It has three methods of simplifying the connection of wireless devices to WPA2 protected access points: Push Button Connect (PBC) requires the user to push a button on the router which allows it to communicate with a client needing configuration. The client attempts to connect and the router simply sends it the security configuration required to communicate. Client PIN mode is where the client device supports WPS and has a PIN assigned by the manufacturer. You then login to the router's management interface and enter the PIN to authorize that client to obtain the encryption configuration. Router PIN mode allows a client to connect by entering a secret PIN from a label on the router, or from its management interface which authorizes the client to obtain the security configuration details. The first method requires physical access, while the second requires administrative access, both of these pass muster. The third however, can be accomplished only through the use of the Wi-Fi radio.

So no you don't need to have physical access to the router.

[#12]

This doesn't surprise me.  The thinking must have been:
1)  Lets invent a secret password system to protect our wireless networks
2)  Oh dear, some people are too ignorant/stupid to cope with the secret password; lets invent a way of handing out the password even if they can't-remember/don't-know what it is.  And WPS was born.
Now it turns out that the means of handing out the secret password is open to abuse.  Well what a surprise!

[#13]

Much like all those Windows users who disable the User login password and use the machine with full administrator privileges at all times !

[#14]

I know someone with a Talk-Talk router that thoughtfully has the WPA2 passcode printed on a label on the side of the router (helpful for users who don't think to look underneath), the router is kept on the front windowsill near the master socket.....    Who needs WPS? 

[#15]

Quote from: Kelly

We ship all our technicolor routers with WPS off.

Am I right in thinking my Thomson TG585 v7 is a Technicolor router?
Cheers!