I was reading about Reaver and wi-fi protected setups (WPS). In my Netgear router I have the option to disable the WPS pin code, but still have the WPS push button enabled. Am I secured with such configuration?
Or does Reaver also attack WPS without the pin?
If Netgear has implemented it properly, WPS Push-button-connect should be secure. However, I have no idea whether Netgear has implemented it properly, and if they haven't, you might be insecure.
The known attack on WPS is described in this paper:
For another great explanation, see also:
The attack described there breaks the PIN-based forms of WPS. It is not effective against a properly implemented version of WPS Push-button-connect (PBC), because a remote attacker cannot physically push the button your router, and WPS PBC requires someone to press the button before it can proceed.
Therefore, if Netgear has implemented WPS PBC correctly, and has properly disabled all the other forms of WPS, you should hopefully be safe (fingers crossed).
(Do make sure you are running the latest version of the Netgear firmware. The WPS attacks were only discovered less than a year ago, so versions of the firmware written before the attack was discovered are very likely to be vulnerable.)
That said, router vendors have screwed this stuff up before. The bad track record, and the fact that it is not easy for an average user to tell whether they've finally gotten it right this time, does give some room for concern. I think it would be understandable if this makes some security folks throw up their arms in disgust and say "oh, to heck with it, just turn off WPS, I don't trust the router vendors to get this right".
So, how much do you trust Netgear to not screw this up?
You can check the list below for your router model. Most NetGear routers listed are vulnerable but WPS PIN can be turned off.
Push-button setup is safer, but there are still at least a few theoretical attack scenarios. Off the top of my head I can come up with:
A patient attacker could conceivably wait for the setup process to occur and potentially disrupt communication from the client attempting to authenticate, then initiate an authentication attempt from a malicious client before the WPS button is pressed. The user may believe the process simply failed, attempt again, and assume by their success on the second attempt, assume nothing is wrong. This is especially viable when/if the attacker observes a new device being brought into the home or office, since they can assume you will need to connect that device.
A less patient attacker could disrupt communication with an already authenticated device in the hope the end user will attempt to fix the problem by performing the setup process again, and then try to authenticate instead of the authorized device as above. This is particularly likely if the authenticated device is a printer or other similar hardware on which passphrase authentication is more difficult.
I wasn't able to easily find information on what if any mitigations are employed by vendors, but since the hardware button typically doesn't offer a sufficiently clear indication of which device was authenticated or of whether a device successfully authenticated, it's at least a plausible scenario.
These sort of attacks might be difficult/impractical, but any unnecessary attack surface is a risk, so, it's preferable to not use WPS at all.
Disable it entirely, even in the push-button form, unless you have a device where you are forced to use it by not having the ability to enter a passphrase. If you have such devices, make it a priority to replace them, and try to avoid them in the future.
If you already have devices that force the use of WPS by providing no way to enter a passphrase, such as some printers, then you will have no other choice but to keep WPS turned on. In this case, minimize your risk by disabling both the PIN and the external button if at all possible . Use the access point or router's password-protected web interface to complete the setup process and use that interface to visually confirm which device was authenticated. Be suspicious if the WPS setup process unexpectedly fails. Finally remember, as with any wireless network, regularly checking for unauthorized devices on your network is an important part of keeping it secure.
