I don't usually post vulnerability reports but...

[eve11]

This one might (a) not quite get to the mainstream and (b) affect a lot of you out there in cyberspace, if you have a wireless router. To quote a co-worker:

"If you have a reasonably new (last 5 years) wireless router, you probably don't really have security, even if you configured yourself for encryption. If you care about this at all (and you should), root around in the config and turn "Wi-Fi Protected Security" (WPS) off ASAP."

http://www.uscert.gov/cas/techalerts/TA12-006A.html

Comments

[stlscape.livejournal.com]

Thanks for the heads up on this.

[snonsumr.livejournal.com]

Shared in the usual places. Thanks for the heads-up.

[skurtchasor.livejournal.com]

Point of note: WPS actually stands for Wi-Fi Protected Setup (not Security). I wouldn't normally be so nitpicky, but your coworker seems to imply that there is OMG NO SECURITY AT ALL, when in actuality the other encryption and security protocols are still working just fine (as far as we know).

The ironic thing is that WPS seems to be designed for people who are effectively tech illiterate to begin with (come on, is it that hard to set up a WPA key?), so this could be a potentially huge problem.

[eve11]

Noted. It actually says the right thing on the alert. I think the point is, though, that if this is enabled, one can brute-force root your wireless router, thus stealing your WPA or WEP keys and rendering moot any other security measures you decide to put on it or have it enact.

[skurtchasor.livejournal.com]

I'm hardly an expert, but I would think that using WPS would require the router to broadcast the WPA/WEP key so that the client device could use it in the future. So instead of setting your own password/key, you rely on a pregenerated one (which is full of problems even without this current WPS fiasco).

Yet another reason why one of the first things you should do on a new router is disable wireless administration/remote management, unless you're planning to bury your router under a layer of concrete or otherwise deny yourself physical access to it.

[arthurfrdent.livejournal.com]

Tanks, I passed it along... heh, I use a hardwire still... how steam powered of me, eh? :devil: