Verizon MiFi Owned By Simple Attack 86
Trailrunner7 writes "Security researcher Joshua Wright has developed a simple attack that allows him to recover the passwords for any Verizon MiFi device. The MiFi is essentially a tiny, portable wireless AP, and Wright's attack uses a simple and effective technique to get default passwords by using the device's SSID and some existing password attacks on the encryption protocols the MiFi employs. Result: complete 0wnage of any MiFi."
Important Question (Score:5, Insightful)
Is the choice of a predictable default password and a vulnerable encryption protocol specific to Verizon's branded version of this device or does it also affect the identical Sprint version and/or any GSM variants that may exist? As much as I dislike Verizon, I don't want to see the wrong name stuck on this if the problem is Novatel's, not Verizon's.
Re:Important Question (Score:4, Informative)
Dupe? (Score:3, Informative)
http://mobile.slashdot.org/article.pl?sid=10/02/02/1632203 [slashdot.org]
Re:Dupe? (Score:5, Informative)
Re: (Score:2, Interesting)
No doubt that when the femtocell article was posted, someone was like "Hey, i can do that on a Verizon MiFI because it not only does it use the same technology, but allows me to get far more useful data than anyone would be doing over a phone"
Does this mean that Verizon should stop promoting the MiFi as a small business tool? Aren't small businesses without a clue the only ones purchasing the MiFi anyway? No clue = not security conscious
Re: (Score:2)
Not necessarily. I've considered it for long trips to/from my daughter's university. My netbook doesn't have a wireless modem, but it does have WiFi. Ditto for my daughter's fullsize laptop.
I'm sure that there are other people (not businesses) who are buying or considering a MyFi sort of thing.
Slightly misleading title (Score:5, Informative)
Re:Slightly misleading title (Score:5, Funny)
To clarify, this exploit is only for the configuration as shipped from the factory. Just like most consumer routers, you can reconfigure the SSID and WPA-PSK values via a web interface, but almost nobody does.
Fixed that for you. Yes, yes, people are getting better with their home routers. For most people, if you mention SSID and WPA-PSK, it will probably be countered with a WTF?
Re:Slightly misleading title (Score:5, Insightful)
They wont know what it's called but they have a good chance of knowing that they need to "give their wireless a name and password". I can see anywhere from 5 to 8 wireless networks from my home on any given day. All have non default ssids and passwords. I doubt they were all set up by IT professionals. My guess is a lot of 'regular' folks have clued in.
Re: (Score:2)
Just realize that your dad will loose this file AND t
Re: (Score:2)
Just realize that your dad will loose this file AND the password - requiring a cross country flight to visit.
Or at least instruction on how to press-and-hold the reset button on the back of the router for 30 seconds. On nearly every router I've heard of, that forces a factory reset, then you have them go through the setup process again.
Of course, if your dad is ponying up for a cross-country flight to come visit, I'd be the last one to interfere with good family relationships... :)
Re: (Score:1, Insightful)
It helps to also write the SSID and Password down on a piece of paper and tape it to the router. Writing down passwords is generally bad practice, but in this situation if the person is already inside your house with physical access to your equipment then they could also just plug in an Ethernet cable for access.
Re:Slightly misleading title (Score:4, Insightful)
New routers come with software that change the SSID and sets up encryption. Also, people are used to stealing wifi from others, when they get their own wifi, know to encrypt it.
Re:Slightly misleading title (Score:4, Funny)
All have non default ssids and passwords.
Yes, for example in my neighborhood there is a "dontstealmyinternet," which doesn't require a password, and a "freewifi" which does. I find that odd.
Re: (Score:2)
Yeah - I think ssids are pretty interesting. Someone should collect good ones. If I've thought of it now, there's probably a site that's been doing just that for a while.
Re:Slightly misleading title (Score:4, Interesting)
My wifis show up as "GetCurtainsISeeYou" and "ImDatingYourDaughter" Figured I would screw with the neighbors.
Re: (Score:2)
Re: (Score:2)
I thought, "Well, I'm not going to be piggybacking on THAT".
Re:Slightly misleading title (Score:4, Interesting)
Re: (Score:2)
I see it all the time and it looks like some sketchy malicious AP (you know...email your secret business documents through my free airport wifi please) but I figure that it can't be since it does not actually work. If you are going to sniff peoples data and do a MITM...you need to actually provide something on the other end.
Re: (Score:2)
Easy enough to do. I could shove a WRT54GL board into something, and it can provide an access point while at the same time connecting to another. It's not gonna happen with stock firmware, but hell... if you're after this, that's not gonna bother you.
Or, you could even just throw two in and bridge them. One serves, one connects.
Re: (Score:2)
The only issue is that I have never ever connected to one of these "Free Airport Wifi" and had it give me a real connection so the GP's explanation makes a lot of sense.
Re:Slightly misleading title (Score:4, Interesting)
Actually, it's more of a Windows side effect.
User connects their laptop to "Free Wireless Internet" AP (a real, live accesspoint). User then leaves, and parks butt in another location. Windows again looks for a network with SSID "Free Wireless Internet" as well as doing scans for other networks (ad-hoc or otherwise). Inadvertently, it also broadcasts this as an ad-hoc SSID, so a second user doing a scan sees it and tries to connect. They fail (obviously), but now their laptop will look for an ad-hoc network called "Free Wireless Internet", to which others will try to connect, fail, and broadcast anew ad-hoc network.
It's spread to the point where you can see that SSID everywhere. A viral SSID, effectively.
http://www.wlanbook.com/free-public-wifi-ssid/ [wlanbook.com]
http://blogs.chron.com/techblog/archives/2006/09/free_public_wif.html [chron.com]
A bit more Googling will reveal a ton more of same. Of course, it's trivially simple for someone to really do set up a real MITM using tihs viral SSID, so beware.
Re: (Score:2)
User connects their laptop to "Free Wireless Internet" AP (a real, live accesspoint). User then leaves, and parks butt in another location. Windows again looks for a network with SSID "Free Wireless Internet" as well as doing scans for other networks (ad-hoc or otherwise). Inadvertently, it also broadcasts this as an ad-hoc SSID, so a second user doing a scan sees it and tries to connect. They fail (obviously), but now their laptop will look for an ad-hoc network called "Free Wireless Internet", to which others will try to connect, fail, and broadcast anew ad-hoc network. It's spread to the point where you can see that SSID everywhere. A viral SSID, effectively.
This sounds like a great basis for an "around the world in 80 days" style bet: "I bet I can start a 'Free Porno Libre' SSID in Alaska and you'll see it spread to Morocco, Japan, Paris, and Beijing in less than five days". It might even kill "Free Wireless Internet" as the default viral SSID.
Re: (Score:2)
If you've ever hung around airports looking for a wireless signal, there is always somebody broadcasting "Free Wireless Internet" or similar SSIDs in ad-hoc mode.
While this can be (and usually is) a side effect of how windows does network sharing automatically, one should be at least aware of the fact this is also used as a well known attack vector.
EvilDude sits at airport, pays $40 or whatever for a days worth of paid wifi, then his laptop (in his backpack out of sight) uses one card to jump on the paid wifi for internet uplink, and broadcasts an ad-hoc network under a name using 'free' in the SSID.
The logic is, anyone that jumps on his wifi to avoid paying, will t
Re: (Score:2)
Even better, EvilDude can actually know what he's doing and broadcast in 'master' mode. No ad-hoc nonsense required.
Re: (Score:2)
I think a good ssid name would be "honeypot".
Re: (Score:2)
There is another one in the area called "virusporno" which I can only assume is a lot of shared porn in which the actors and actresses have horrible sexually transmitted infections.
Re: (Score:2)
Re: (Score:2)
It's actually pretty rare to encounter an unencrypted wifi access point these days. And the few that are unencrypted tend to have some sort of security at another layer (browser-based authentication, for example). This would suggest that most people actually do know how to enable security on their routers.
Re: (Score:2)
To clarify, this exploit is only for the configuration as shipped from the factory.
In other words, this is not news. Everyone know that you change the default factory pass and ID...
Re: (Score:2)
Then why is there over 20 AP's on my block that are broadcasting "Linksys" on channel 6 with no key or even passwords for accessing the config.
It seems like NOBODY knows this.
Re: (Score:1)
Anecdotal evidence sucks.
Actually I find quite the opposite...
Re: (Score:2)
Owning a Mi-Fi myself (although Sprint, not Verizon), this article was worrying me a bit. But it looks like you can only get bit by it if you're a moron. Reconfiguring the SSID and encryption keys is of course the very first thing I do with any Wi-Fi access point. No worries.
Re: (Score:2)
If it were just like consumer routers, you wouldn't need a hack. Just download the manual from the web and look up the default admin password.
"Hah! I've tunneled under your foundation, broken through your basement floor, picked the lock on your basement door, and finally let myself in to join you for some refreshments and perhaps a movie."
"The front door was unlocked."
Default settings (Score:4, Insightful)
If you deploy any networking device with default settings in place, you deserve to be compromised.
Take 30 minutes to reconfigure the device using default settings and this is a non-issue.
Re:Default settings (Score:5, Insightful)
Re: (Score:2)
Nickodeemus is kind of right though, the moral of this story, as is the moral of all stories of this type; CHANGE THOSE DEFAULT SETTINGS.
Re: (Score:2)
Also, it is NOT pointless because the average person will look at that long string of seemingly random numbers, and the strings are different for each unit because the string is the ESN of the chip, and will think that it is a secure, randomly generated number.
You raise a good point. Any time you ship with a dummy/example/default value that should be changed, you need to make it blindingly obvious to the user--or better yet, require it be changed on first use. Being excessively tolerant to bogus data often just hides or delays problems until a later time.
Re: (Score:2)
Re: (Score:2)
For about 10 seconds, then I finish changing it. Why would I trust their unknown password generation process when I can use apg, which I *know* generates random passwords?
Re: (Score:2)
Re: (Score:2)
I'm sick and tired of this attitude that makes victims responsible for the crimes against them. Like well its her fault for dressing up so attractivily, she deserved what she got. Or doesn't he know not to walk in that neighborhood, he deserved what he got. Or didn't he do exhaustive checking with all sorts of agencies before investing with Maddoff, oh wait, he did and they all said things were good, well he deserved to get cheated.
That puts blame where it does not belong. It is the argument used by those
Re: (Score:2)
Obviously the person breaking into your house is committing a crime, but if you don't even bother to lock it, you're at least partly to blame, right?
Re: (Score:2)
No, there is no excuse for a crime. None. You can not be blamed for leaving your car unlocked. You should not have to lock your car. Out in the rural area's people don't lock their cars or their houses. That is the way it should be. There the same rule holds.
It would be like you were saying, you did not buy automobile insurance so you deserve to get in an accident.
Gotta love the article (Score:4, Funny)
From The Fine Article:
I suggest using linksys or netgear. :D
Nothing like watching script kiddies THINK they know what the router is, and bashing their heads trying to figure out why they can't get into what MUST be an unconfigured network.
Only catch is if you're in an environment with lots of them pre-configured in which case 'FreeWiFi' is also good (with a nice strong random password of course :P ).
Re:Gotta love the article (Score:4, Funny)
Nothing like watching script kiddies THINK they know what the router is, and bashing their heads trying to figure out why they can't get into what MUST be an unconfigured network.
Even better - get a plain linksys router, set it to factory default settings, but don't connect it to internet.
Script kiddies keep trying to figure out why they can't connect to the internet...
Re: (Score:1, Informative)
Here i was thinking i was the only one to do this for fun.
Even funnier if you connect a tiny computer to it (or custom firmware) to dump anything they are doing to a memory stick or something, just so you can laugh at their attempts.
I say tiny computer because then you can setup some Linux OS, make it look like Windows XP (requires a liiiitle bit of effort), set up VNC and watch the idiots try to hack Linux with Windows viruses.
"What the fuck, my EXEs aren't running"
Shame i'm no longer in a place with a lot
Re: (Score:2)
I say tiny computer because then you can setup some Linux OS, make it look like Windows XP (requires a liiiitle bit of effort), set up VNC and watch the idiots try to hack Linux with Windows viruses.
That sounds like an awful lot of time that could be better spent looking at po... erm, poetry and stuff.
Re: (Score:2)
Yeah, but just think, if we create a small distro for this. :)
Re: (Score:2)
Must have been annoying! '
Re: (Score:2)
That is so cruel. I love it!!!!
Re: (Score:2)
You are my hero for today sir, best thing I've read all day.
Re: (Score:2)
So HE'S the one that tried to hack my WiFi!! ;)
The "Password" is the ESN (Score:4, Informative)
Re: (Score:3, Informative)
Worse yet, it appears that 14 of the 32 bits of the ESN are fixed for a given product (emphasis mine):
The Electronic Serial Number (ESN) is a 32-bit number assigned by the mobile station manufacturer which uniquely identifies the mobile station equipment. The rules to be followed by manufacturers for assigning the ESN are given in the IS-95 standard. Binary digits are allocated for a manufacturer's identity code (8 bits), the equipment serial number (18 bits), and 6 bits are reserved. ESN, and MIN1, along with other digital input, are used during the authentication process.
Source [cdmaonline.com]
that's not a bad default choice... (Score:1)
* Manufacture Year: "09" represents the 2-character year of manufacture. * Manufacture Month: "11" represents the 2-character month code. * Manufacture Day?: "19" represents the 2-character day code (NB: This could be wrong, one sample had a value of "34" here, need more data). * Sequential Identifier: "00891" represents the 5-character sequential identifier code. Based on this assessment, we can determine that the password selection for the MiFi default is weak. Instead of 11 numeric values with an effective entropy of approximately 36 bits, the MiFi password only has an effective entropy of less than 17 bits for a given 6-byte prefix. If the concept of a manufacture date-stamp is true for the 6-byte prefix, then we have a relatively small search space to find the default MiFi PSK.
Weak? maybe....but as far as DEFAULT passwords go that seems above average to me! You mean it's not EXACTLY THE SAME on every device manufactured? That's a good thing! In many cases I'd think that's a better password choice than many users would choose for themselves.
Verizon FiOS routers allow login from WAN (Score:4, Interesting)
Re: (Score:3, Interesting)
"Owned" (Score:5, Insightful)
Really? Headlines with "owned" and summaries with "ownage"?
Did we go from "News for Nerds" to "News for Teenage Online Gamers" recently, or would that require taking it one step further and using the "Pwn" form of the word. Maybe we should sprinkle in a "MiFi Fail!" in there somewhere too.
Re: (Score:2)
MiFi Fail: Pwn!
I see the pass of a Verizon!
Re: (Score:1, Funny)
It's pwned and pwnage. "Pwn" does not exist.
Submitter is clueless on what 0wnage is (Score:2)
The submitter of this article is apparently clueless as to what "0wnage" is ... the router is not owned. You've hacked a password to allow you to use the router. To own the router, you would need root access. You don't have that with this attack... you have a simple WPA-PSK password. Big deal... anyone can do that with a bit of time on their hands and a Backtrack 4 CD on laptop. Wheeee... you are a l33t scr1pt k1ddie now!
It's an interesting article from the standpoint of how an unconfigured router is
Re:Submitter is clueless on what 0wnage is (Score:5, Interesting)
The funny part of this story is that Verizon routers take so much effort to hack based on their default configuration. I read it as a good move on Verizon's part.
It's just hard enough that someone thinks that "hacking" it is some form of accomplishment. That's pretty impressive given that this is a default configuration, which by definition has to use some form of predictable algorithm for their password. At least they are shipping them with OK encryption enabled by default and a password that takes 4 minutes to crack.
Now, if someone managed to hack into one of these gizmos and get free Internet after a user changed the password to a properly secure one, that would be news.
I was at my father's house once, setting up a new wireless router. This was a few years ago. The directions said to plug it into the Internet, power it up, connect to it, and set up wireless security (optional). The problem is, the wireless side comes on at first power-up, and it's an open access point. So I connected all the cables, plugged it in, went to go get a cup of coffee, and by the time I returned 15 minutes later the wireless light was blinking solid and someone had already changed the configuration password. I had to do a factory reset and beat the guy to the configuration screen when it powered up again. There was no way to tell the router to power up without wireless enabled, and the antenna was not removable. I was seriously considering wrapping the !@#$ thing in tin foil to give me enough time to get the admin password changed, but on the third try I beat the little bastard to it or he gave up.
I can imagine that 90% of Internet users at the time would simply have powered up their router, seen the access point name, connected to it, and gone on blissfully unaware that a script kiddie next door had set up port forwarding and was running a Torrent client or webserver off their connection.
I think the fact that it takes 4 minutes to hack into a default-configured router is a pretty good indication of how far we've come. Maybe not far enough, but still pretty far.
Re: (Score:2)
someone had already changed the configuration password. I had to do a factory reset and beat the guy to the configuration screen when it powered up again.
Next time, use a wireless sniffer and find his MAC. Then find that MAC's physical location based on signal strength (he has to be close). Then beat the hell out of him and tell him that's what happens to punks who screw with your dad's IT.
Article summary is wrong. (Score:4, Informative)
a simple attack that allows him to recover the passwords for any Verizon MiFi device.
The attack is based on searching through a limited set of default passwords.
Changing the password to something other than the default prevents this attack. I don't have a Verizon MiFi device, but I have one from Sprint. By default, it was an open access point. I quickly changed it to something else before I left the store, and changed it again later at a distant location over the (somewhat) secure connection.
It was literally the first one sold from the store where I bought it. Sprint may have since changed to something like Verizon has done, with a (non-) random password. But, I would have changed it anyway.
My Verizon router (for FIOS) had a similar setup, although I don't think it's a predictable SSID and password. However, it was WEP-64. Needless to say, it was the first thing I changed.
An aside: I made the initial connection and changed the password in the Sprint store with my iPhone. The staff was really amused by that, and asked how fast the connection was. I used the iPhone speedtest to tell them -- about the same as the PCMCIA Sprint AirCard I had before this.
What have you gained (Score:2)
Isn't the whole point of the MiFi to provide internet access? So, what have you gained? And it's meant to be moved around a lot -- once you hack it, it'll be out of range soon anyway.
Nice try! (Score:2)
From TFA:
I've seen more enticing offers in my Spam box...
How many people are really going to take him up on this offer, exactly? If you understand the topic, you know you'll be making it much easier for people to break-in to the service your paying for, and at wo