Verizon MiFi Owned By Simple Attack 86
Trailrunner7 writes "Security researcher Joshua Wright has developed a simple attack that allows him to recover the passwords for any Verizon MiFi device. The MiFi is essentially a tiny, portable wireless AP, and Wright's attack uses a simple and effective technique to get default passwords by using the device's SSID and some existing password attacks on the encryption protocols the MiFi employs. Result: complete 0wnage of any MiFi."
Important Question (Score:5, Insightful)
Is the choice of a predictable default password and a vulnerable encryption protocol specific to Verizon's branded version of this device or does it also affect the identical Sprint version and/or any GSM variants that may exist? As much as I dislike Verizon, I don't want to see the wrong name stuck on this if the problem is Novatel's, not Verizon's.
Default settings (Score:4, Insightful)
If you deploy any networking device with default settings in place, you deserve to be compromised.
Take 30 minutes to reconfigure the device using default settings and this is a non-issue.
Re:Slightly misleading title (Score:5, Insightful)
They wont know what it's called but they have a good chance of knowing that they need to "give their wireless a name and password". I can see anywhere from 5 to 8 wireless networks from my home on any given day. All have non default ssids and passwords. I doubt they were all set up by IT professionals. My guess is a lot of 'regular' folks have clued in.
Re:Default settings (Score:5, Insightful)
"Owned" (Score:5, Insightful)
Really? Headlines with "owned" and summaries with "ownage"?
Did we go from "News for Nerds" to "News for Teenage Online Gamers" recently, or would that require taking it one step further and using the "Pwn" form of the word. Maybe we should sprinkle in a "MiFi Fail!" in there somewhere too.
Re:Slightly misleading title (Score:4, Insightful)
New routers come with software that change the SSID and sets up encryption. Also, people are used to stealing wifi from others, when they get their own wifi, know to encrypt it.
Re:Slightly misleading title (Score:1, Insightful)
It helps to also write the SSID and Password down on a piece of paper and tape it to the router. Writing down passwords is generally bad practice, but in this situation if the person is already inside your house with physical access to your equipment then they could also just plug in an Ethernet cable for access.