Wi-Fi Protected Setup

The WPS push button (center, blue) on a wireless router

Wi-Fi Protected Setup (WPS; originally Wi-Fi Simple Config) is a broken network security standard that attempts to allow users to easily secure a wireless home network, but some networks using this standard could fall to brute-force attacks if one or more of the network's access points do not guard against the attack.^[1][2]

Created by the Wi-Fi Alliance and introduced in 2006, the goal of the protocol is to allow home users who know little of wireless security and may be intimidated by the available security options to set up Wi-Fi Protected Access, as well as making it easy to add new devices to an existing network without entering long passphrases. Prior to the standard, several competing solutions were developed by different vendors to address the same need.^[3]

A major security flaw was revealed in December 2011 that affects wireless routers with the WPS feature, which most recent models have enabled by default. The flaw allows a remote attacker to recover the WPS PIN in a few hours with a brute-force attack and, with the WPS PIN, the network's WPA/WPA2 pre-shared key.^[4] Users have been urged to turn off the WPS feature,^[5] although this may not be possible on some router models.^[6]

Methods

The standard emphasizes usability and security, and allows up to four usage modes aimed at a home network user adding a new device to the network:

• PIN Method, in which a personal identification number (PIN) has to be read from either a sticker or the display on the new wireless device. This PIN must then be entered at the "representant" of the network, usually the access point of the network. Alternately, a PIN on the Access Point may be entered into the new device. The PIN Method is the mandatory baseline mode; every Wi-Fi Protected Setup certified product must support it.
• Push-Button-Method, in which the user simply has to push a button, either an actual or virtual one, on both the access point and the new wireless client device. Support of this mode is mandatory for access points and optional for connecting devices.
• Near-Field-Communication Method, in which the user simply has to bring the new client close to the access point to allow a near field communication between the devices. NFC Forum compliant RFID tags can also be used. Support of this mode is optional.
• USB Method, in which the user uses a USB flash drive to transfer data between the new client device and the access point of the network. Support of this mode is optional, but deprecated.

The last two modes are usually referred as out-of-band methods as there is a transfer of information by a channel other than the Wi-Fi channel itself. Only the first two modes are currently covered by the Wi-Fi Protected Setup certification. The USB method has been deprecated and is not part of the Alliance's certification testing.

Technical architecture

The WPS protocol defines three types of devices in a network:

• Registrar: A device with the authority to issue and revoke credentials to a network. A registrar may be integrated into a wireless access point (AP), or it may be separate from the AP.
• Enrollee: A device seeking to join a wireless network.
• AP: An AP functioning as a proxy between a registrar and an enrollee.

The WPS standard defines three basic scenarios that involve these components:

• AP with internal registrar capabilities configures an Enrollee Station (STA). In this case, the session will run on the wireless medium as a series of EAP request/response messages, ending with the AP disassociating from the STA and waiting for the STA to reconnect with its new configuration (handed to it by the AP just before).
• Registrar STA configures the AP as an enrollee. This case is subdivided in two aspects: first the session could occur on both a wired or wireless medium, and second the AP could already be configured by the time the registrar found it. In the case of a wired connection between the devices, the protocol runs over Universal Plug and Play (UPnP), and both devices will have to support UPnP for that purpose. When running over UPnP, a shortened version of the protocol is run (only 2 messages) as no authentication is required other than that of the joined wired medium. In the case of a wireless medium, the session of the protocol is very similar to the internal registrar scenario, just with opposite roles. As to the configuration state of the AP, the registrar is expected to ask the user whether to reconfigure the AP or keep its current settings, and can decide to reconfigure it even if the AP describes itself as configured. Multiple registrars should have the ability to connect to the AP. UPnP is intended to apply only to a wired medium, while actually it applies to any interface to which an IP connection can be set up. Thus having manually set up a wireless connection, the UPnP can be used over it in the same manner as with the wired.
• Registrar STA configures enrollee STA. In this case the AP stands in the middle and acts as an authenticator, meaning it only proxies the relevant messages from side to side.

Protocol

The WPS protocol consists as a series of EAP message exchanges that are triggered by a user action and relies on an exchange of descriptive information that should precede that user's action.

The descriptive information is transferred through a new Information Element (IE) that is added to the beacon, probe response and optionally to the probe request and association request/response messages. Other than purely informative type-length-values, those IEs will also hold the possible, and the currently deployed, configuration methods of the device.

After the identification of the device's capabilities on both ends, user is used to initiate the actual session of the protocol. The session consists of 8 messages that are followed, in the case of a successful session, by a message to indicate the protocol is done. The exact stream of messages may change when configuring different kinds of devices (AP or STA) or using different physical media (wired or wireless).

Brute-force attack

In December 2011, researcher Stefan Viehböck reported a design and implementation flaw that makes brute-force attacks against PIN-based WPS feasible to perform on WPS-enabled Wi-Fi networks. A successful attack on WPS allows unauthorized parties to gain access to the network. The only effective workaround is to disable WPS.^[5]

The vulnerability centers around the acknowledgement messages sent between the registrar and enrollee when attempting to validate a PIN. The PIN is an eight-digit number used to add new WPA enrollees to the network. Since the last digit is a checksum of the previous digits,^[7] there are seven unknown digits in each PIN, yielding 10⁷ = 10,000,000 possible combinations.

When an enrollee attempts to gain access using a PIN, the registrar reports the validity of the first and second halves of the PIN separately. Since the first half of the pin consists of four digits (10,000 possibilities) and the second half has only three active digits (1000 possibilities), at most 11,000 guesses are needed before the PIN is recovered. This is a reduction by three orders of magnitude from the number of PINs that would have to be tested. As a result, an attack can be completed in under four hours. The ease or difficulty of exploiting this flaw is implementation-dependent, as Wi-Fi router manufacturers could defend against such attacks by slowing or disabling the WPS feature after several failed PIN validation attempts.^[4]

A tool has been developed in order to show that the attack is practical.^[8] The firm that released the tool, Tactical Network Solutions in Maryland, says that it has known about the vulnerability since early 2011 and has been using it.^[9]

In some devices, disabling WPS in the user interface does not result in the feature actually being disabled. The device remains vulnerable to attack.^[6] Firmware updates have been released for some of these devices so that WPS can be disabled completely.

Vendors could patch the vulnerability by adding a lock-down period if the Wi-Fi access point detects a brute-force attack in progress, which disables the PIN method for long enough to make the attack impractical.^[2]

References

External links

• Wi-Fi Protected Setup Knowledge Center at the Wi-Fi Alliance
• UPnP device architecture
• US-CERT VU#723755
• Waiting for WPS fix