Hands-on: hacking WiFi Protected Setup with Reaver
j at w1.fi
Sat Jan 7 12:56:22 EST 2012
On Fri, Jan 06, 2012 at 01:21:15AM +0100, Cristian Ionescu-Idbohrn wrote:
> Would be really interesting to read some qualified comments to this
Any particular detail you would be interested in? The possibility of
brute force attack against a static AP PIN was already described in the
WPS 1.0h specification with a mechanism for mitigating the attack.
Unfortunately, some WPS implementations do not follow that guidance.
As far as hostapd is concerned, commit
3b2cf800afaaf4eec53a237541ec08bebc4c1a0c from early 2009 added lock-down
mechanism to limit brute force attacks on AP PIN. To avoid the issue
completely, static AP PIN should not be enabled by default as described
# Static access point PIN for initial configuration and adding Registrars
# If not set, hostapd will not allow external WPS Registrars to control the
# access point. The AP PIN can also be set at runtime with hostapd_cli
# wps_ap_pin command. Use of temporary (enabled by user action) and random
# AP PIN is much more secure than configuring a static AP PIN here. As such,
# use of the ap_pin parameter is not recommended if the AP device has means for
# displaying a random PIN.
README-WPS has more details on how to use the wps_ap_pin command.
Jouni Malinen PGP id EFC895FA
More information about the HostAP