ID

VAR-201211-0048

CVE

CVE-2012-4366

TITLE

plural Belkin Wireless Router Network access vulnerabilities in products

DESCRIPTION

Belkin wireless routers Surf N150 Model F7D1301v1, N900 Model F9K1104v1, N450 Model F9K1105V2, and N300 Model F7D2301v1 generate a predictable default WPA2-PSK passphrase based on eight digits of the WAN MAC address, which allows remote attackers to access the network by sniffing the beacon frames. Belkin offers a variety of wireless router devices. The Belkin wireless routing device prints the network name (ESSID) and the seemingly random password on the bottom of the device. Although the manufacturer's default WPA2-PSK password is more secure than the user setting, the Belkin default password is calculated only for the device. Multiple Belkin Wireless Routers are prone to a security vulnerability that may allow attackers to generate a default WPA2 password. Successfully exploiting this issue may allow attackers to generate the default WPA2 passwords. This may lead to other attacks. The following products are affected: Belkin Surf N150 F7D1301v1 Belkin N900 F9K1104v1 Belkin N450 F9K1105V2. Background Belkin ships many wireless routers with an encrypted wireless network configured by default. II. Description of vulnerability Having a preconfigured randomly generated WPA2-PSK passphrase for wireless routers is basically a good idea since a vendor-generated passphrase can be much more secure than most user-generated passwords. Each of the eight characters of the default passphrase are created by substituting a corresponding hex-digit of the wan mac address using a static substitution table. Moreover, the default WPA2-PSK passphrase solely consists of 8 hexadecimal digits, which means that the entropy is limited to only 32 bits (or 33 bits since some models use uppercase hex digits). After sniffing one successful association of a client to the wireless network, an attacker can carry out an offline brute-force attack to crack the password. The program oclhashcat-plus can try 131,000 passwords per second on one high end GPU (AMD Radeon hd7970) [1]. Doing a full search of the 32-bit key space takes about 9 hours at this rate. III. Impact An attacker can exploit this vulnerability to calculate the WPA2-PSK passphrase of a wireless network. This allows sniffing and decrypting all wireless traffic in a purely passive attack given that the attacker has also sniffed the association. The attacker may also connect to the wireless network, which may allow further exploitation of unprotected systems in the local network. An attacker may furthermore use the wireless network to access the internet from the owner's network. The network owner may then be held responsible for any illegal activities perpetrated by the unauthorized users. IV. Affected devices Belkin Surf N150 Model F7D1301v1 The official Belkin support page [2] contains pictures of the label of several other WiFi devices, which show that the following devices are vulnerable as well: Belkin N900 Model F9K1104v1 Belkin N450 Model F9K1105V2 The following device uses a variation of the algorithm and the password consists of uppercase hex digits. When using our algorithm with the wlan mac of the device, the first 5 digits of the password are calculated correctly. It is likely that the algorithm differs only in the tables used. Belkin N300 Model F7D2301v1 It is likely that other Belkin devices are affected as well. Unfortunately, Belkin has not yet cooperated with us to fix the vulnerability and/or confirm a list of other affected devices. V. Solution Users of potentially affected wireless routers should change the wireless passphrase to something more secure. VI. Timeline 6.1.2012: Vendor contacted 27.1.2012: Escalated 29.10.2012: Another contact attempt, still no response 19.11.2012: Public disclosure VII. Credits Jakob Lell J\xf6rg Schneider VIII. References Advisory location: http://www.jakoblell.com/blog/?p=15 CVE-2012-4366: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4366 [1] http://hashcat.net/oclhashcat-plus/ [2] http://en-us-support.belkin.com/app/answers/detail/a_id/6989

IOT TAXONOMY

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

specific network environment

TYPE

encryption problem

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Jakob Lell and Jörg Schneider

SOURCES

LAST UPDATE DATE

2024-08-14T15:40:10.970000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE