2
2
As you may know, WiFi Protected Setup (WPS) has recently been broken.
I downloaded and tested Reaver-WPS, the tool that implements the WPS attack. The tool's README file states:
Reaver performs a brute force attack against an access point's WiFi Protected
Setup pin number.
Once the WPS pin is found, the WPA PSK can be recovered and alternately the
AP's wireless settings can be reconfigured.
While Reaver does not support reconfiguring the AP, this can be accomplished
with wpa_supplicant once the WPS pin is known.
I managed to find the AP's WPS pin without any problem (it took about 4 hours).
I would now like to try to reconfigure the AP's wireless settings using wpa_supplicant. I tried to find how to do this in wpa_supplicant's man page, but there's no mention of WPS. I tried to Google this, but I could not find anything.
Does anyone know how to reconfigure an AP's wireless settings with wpa_supplicant (or any other tool) knowing the AP's WPS pin?
BTW, what does the WPS protocol itself allow you to reconfigure? Just the WPA passphrase? Or even the SSID or other parameters?
Please don't think that I'm trying to hack my neighbour's network. This is purely a professional research (measuring the risk for my company and our customers).
Thank you very much.
Ever since WPS came out i disabled it because it was obvios to this brute force problem, and its not used in public places any way because its crap. Just use a WPA2 password.. or if you dont trust that use MAC filtering – Piotr Kula – 2012-01-09T12:29:31.140
Yes, I agree, I have already sent out this warning to all our customers, but I wanted to get a better understanding of what's possible. – MiniQuark – 2012-01-10T10:18:38.823
for your answer, once you are secured in the network you can access the router. So its good practice to put a strong password on the router admin login! allot of routers are just "enter" and your in.. then there is nothing stopping you from reeking havock. But if you cannot loginto the router, then you will need to hack it..and that means you will need to find out the make,model of it..not that simple unless you have years or experience. But once in the network, damage can be done to unprotected computers, using aggressive ip/port scanners and netbios hacks and other nasty things. – Piotr Kula – 2012-01-10T21:33:54.670