Wi-Fi Protected Setup

From Wikipedia, the free encyclopedia - View original article

Jump to: navigation, search
For other uses, see Wi-Fi positioning system and WPS.
The WPS push button (center, blue) on a wireless router showing the symbol defined by the Wi-Fi Alliance for this function.

Wi-Fi Protected Setup (WPS; originally Wi-Fi Simple Config) is a network security standard that attempts to allow users to easily secure a wireless home network but could fall to brute-force attacks if one or more of the network's access points do not guard against the attack.[1][2]

Created by the Wi-Fi Alliance and introduced in 2006, the goal of the protocol is to allow home users who know little of wireless security and may be intimidated by the available security options to set up Wi-Fi Protected Access, as well as making it easy to add new devices to an existing network without entering long passphrases. Prior to the standard, several competing solutions were developed by different vendors to address the same need.[3]

A major security flaw was revealed in December 2011 that affects wireless routers with the WPS PIN feature, which most recent models have enabled by default. The flaw allows a remote attacker to recover the WPS PIN in a few hours with a brute-force attack and, with the WPS PIN, the network's WPA/WPA2 pre-shared key.[4] Users have been urged to turn off the WPS PIN feature,[5] although this may not be possible on some router models.[6]


The standard emphasizes usability and security, and allows up to four usage modes aimed at a home network user adding a new device to the network:

The last two modes are usually referred as out-of-band methods as there is a transfer of information by a channel other than the Wi-Fi channel itself. Only the first two modes are currently covered by the Wi-Fi Protected Setup certification. The USB method has been deprecated and is not part of the Alliance's certification testing.

A few wireless access points have a dual-function Wi-Fi Protected Setup button (which can also perform a factory reset); pressing this button for too long can initiate a factory reset of the wireless access point.

Technical architecture[edit]

The WPS protocol defines three types of devices in a network:

The WPS standard defines three basic scenarios that involve these components:


The WPS protocol consists as a series of EAP message exchanges that are triggered by a user action and relies on an exchange of descriptive information that should precede that user's action.

The descriptive information is transferred through a new Information Element (IE) that is added to the beacon, probe response and optionally to the probe request and association request/response messages. Other than purely informative type-length-values, those IEs will also hold the possible, and the currently deployed, configuration methods of the device.

After the identification of the device's capabilities on both ends, user is used to initiate the actual session of the protocol. The session consists of 8 messages that are followed, in the case of a successful session, by a message to indicate the protocol is done. The exact stream of messages may change when configuring different kinds of devices (AP or STA) or using different physical media (wired or wireless).

Inflexibility with respect to band or radio selection[edit]

When the pushbutton method is supported by the wireless access point SSID and the wireless client (and its drivers) when selected under Windows Vista onwards, a prompt appears to press the Wi-Fi Protected Setup button which has its standardized symbol, of which allows flexibility and ease of connection with respect to band or radio selection, since a number of dual-band wireless routers only have video optimization options for the 5 GHz band. A number of non-PC devices with dual band wireless network connectivity do not allow the user to select the 2.4 GHz or 5 GHz band (or even a particular radio or SSID) when using Wi-Fi Protected Setup unless the wireless access point has separate Wi-Fi Protected Setup buttons for each band or radio.

Non-standard symbols and names[edit]

Some manufacturers of wireless access points which support Wi-Fi Protected Setup use a symbol and/or other than the symbol standardized by the Wi-Fi Alliance. Notable examples are Push ‘N’ Connect from Netgear and QSS (Quick Secure Setup) from TP-Link.

Brute-force attack[edit]

In December 2011, researcher Stefan Viehböck reported a design and implementation flaw that makes brute-force attacks against PIN-based WPS feasible to perform on WPS-enabled Wi-Fi networks. A successful attack on WPS allows unauthorized parties to gain access to the network. The only effective workaround is to disable WPS.[5]

The vulnerability centers around the acknowledgement messages sent between the registrar and enrollee when attempting to validate a PIN. The PIN is an eight-digit number used to add new WPA enrollees to the network. Since the last digit is a checksum of the previous digits,[7] there are seven unknown digits in each PIN, yielding 107 = 10,000,000 possible combinations.

When an enrollee attempts to gain access using a PIN, the registrar reports the validity of the first and second halves of the PIN separately. Since the first half of the pin consists of four digits (10,000 possibilities) and the second half has only three active digits (1000 possibilities), at most 11,000 guesses are needed before the PIN is recovered. This is a reduction by three orders of magnitude from the number of PINs that would have to be tested. As a result, an attack can be completed in under four hours (183 minutes to be precise). The ease or difficulty of exploiting this flaw is implementation-dependent, as Wi-Fi router manufacturers could defend against such attacks by slowing or disabling the WPS feature after several failed PIN validation attempts.[4]

A tool has been developed in order to show that the attack is practical.[8] The firm that released the tool, Tactical Network Solutions in Maryland, says that it has known about the vulnerability since early 2011 and has been using it.[9]

In some devices, disabling WPS in the user interface does not result in the feature actually being disabled. The device remains vulnerable to attack.[6] Firmware updates have been released for some of these devices so that WPS can be disabled completely.

Vendors could patch the vulnerability by adding a lock-down period if the Wi-Fi access point detects a brute-force attack in progress, which disables the PIN method for long enough to make the attack impractical.[2]

Physical security issues[edit]

All forms of Wi-Fi Protected setup are vulnerable to usage by an unauthorized user if the wireless access point is not kept in a secure area, and many wireless access points have security information (if factory secured) and the Wi-Fi Protected Setup PIN printed on them. This PIN is often found in the configuration menus of the wireless access point. If this PIN cannot be changed or disabled, the only remedy is to get a firmware update to enable the PIN to be changed or to replace the wireless access point. Intruders who physically find a wireless access point which is factory secured and/or supporting Wi-Fi Protected Setup can use such information printed on the unit to commit unauthorized and/or unlawful activities. It is possible to extract a wireless passphrase with the following methods using no special tools:[10]

It is highly recommended that wireless access points which are factory secured and/or supporting Wi-Fi Protected Setup be kept in a physically secure area, preferably under video surveillance.

See also[edit]


  1. ^ Walker-Morgan, Dj (2011-12-29). "Wi-Fi Protected Setup made easier to brute force". The H. Archived from the original on 2 May 2012. Retrieved 2011-12-31. 
  2. ^ a b Slavin, Brad (January 18, 2013). "Wi-Fi Security – The Rise and Fall of WPS". Netstumbler.com. Retrieved December 17, 2013. 
  3. ^ Tim Higgins (2008-03-13). "How is WPS supposed to work?". Pudai LLC. Retrieved 2012-01-02. 
  4. ^ a b Viehböck, Stefan (2011-12-26). "Brute forcing Wi-Fi Protected Setup" (PDF). Retrieved 2011-12-30. 
  5. ^ a b Allar, Jared (2011-12-27). "Vulnerability Note VU#723755 - WiFi Protected Setup PIN brute force vulnerability". Vulnerability Notes Database. US CERT. Retrieved 2011-12-31. 
  6. ^ a b Gallagher, Sean (2012-01-04). "Hands-on: hacking WiFi Protected Setup with Reaver". Condé Nast Digital. Retrieved 2012-01-20. 
  7. ^ "Windows Connect Now–NET (WCN-NET) Specifications". Microsoft Corporation. 2006-12-08. Retrieved 2011-12-30. 
  8. ^ "reaver-wps". Retrieved 2011-12-30. 
  9. ^ Dennis Fisher (2011-12-29). "Attack Tool Released for WPS PIN Vulnerability". Retrieved 2011-12-31. "This is a capability that we at TNS have been testing, perfecting and using for nearly a year." 
  10. ^ Cherry, Bryce. An Emphasis On Physical Security for Wireless Networks AKA The Dangers Of Wi-Fi Protected Setup http://www.youtube.com/watch?v=kRhyvRAUG6k Retrieved 2014-7-14

External links[edit]