Feeds

UK's most popular Wi-Fi router defaults to insecurity

Come and get it

  • alert
  • submit to reddit

The Power of One eBook: Top reasons to choose HP BladeSystem

From the folks at security think tank GNUCitizen comes yet another demonstration of the insecurity that's present by default in the UK's most popular home broadband router.

By default, the BT Home Hub, which is manufactured by Thomson/Alcatel, uses a weak algorithm to generate keys used for locking down a Wi-Fi network. So weak, in fact, that Wired Equivalent Privacy (WEP) keys can be predicted in just 80 guesses on average. GNUCitizen has written a program to automate the guessing game, but has decided not to release it for the time being.

It's been known for some time that WEP is not a reliable way to secure a Wi-Fi network. But the GNUCitizen's research, which is based on work by ethical hacker Kevin Devine, takes this understanding a step further. It allows the router to be cracked without the use of special hardware or software that's a hassle to configure and use.

The research also affects those using the much more robust Wi-Fi Protected Access (WPA) to secure their BT Home Hub. Because the algorithm uses a predictable means to determine the WPA, an attacker can easily determine the pass phrase (should the default encryption key value be used).

GNUCitizen has exposed other weaknesses in the router, including a VoIP hijacking vulnerability and the ability for attackers to bypass password protections. BT fixed both those issues shortly after they were brought to light.

BT spokesman Adam Liversage said the company is aware of the weakness and encourages people to change the default settings of WEP with a pre-set wireless key to WPA with a random key. Liversage said BT didn't believe any customers have been affected by the default settings, although he didn't explain how the company could even know.

The company has published instructions here that walks customers through the process of securing the device. If you fail to heed them, don't say we didn't warn you. ®

Designing a Defense for Mobile Applications

More from The Register

next story
DARPA-derived secure microkernel goes open source tomorrow
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.