April 14, 2008, 11:49 AM — A security researcher claims to have found a significant weakness in the wireless
encryption of a DSL home gateway made by Thomson and distributed to broadband
subscribers in the U.K. by network operator BT.
Exploiting the weakness could enable someone to connect to a victim's Wi-Fi
router for malicious purposes such as snooping on their Internet traffic or
hacking other machines using the same network, according to GNUCitizen, a group
of blogging security researchers.
BT's Home Hub ships with default encryption keys to encrypt wireless network
traffic using either WEP (Wired Equivalent Privacy) or WPA (Wi-Fi Protected
Access).
Router manufacturers use an algorithm to generate those WEP and WPA default
keys, wrote Adrian Pastor, one of the GNUCitizen's researchers, on
their blog. But the algorithm is predictable and only creates a limited
number of easily-guessed keys, Pastor wrote.
"Chances are that if you own a wireless router which uses a default WEP
or WPA key, such keys can be predicted based on publicly-available information
such as the router's MAC [Media Access Control] address or SSID [Service Set
Identifier]," Pastor wrote.
"In other words: it's quite likely that the bad guys can break into your
network if you're using the default encryption key," he wrote.
Pastor wrote that the information was passed to GNUCitizen by Kevin Devine,
who has previously done research into wireless security. Using a software tool
built by Devine in addition to information already known about the router, it's
possible to come up with 80 possible default encryption keys for WEP, Pastor
wrote. Devine created another software tool to try each of those keys on the
router until the valid one is found.
The attack worked on three different BT Home Hubs, Pastor wrote. The researchers,
however, are not publishing the software tools used in the attack.
But BT Home Hub users can take two steps to avoid this kind of attack: Change
the default encryption key, and also opt to use the WPA standard, which is considered
stronger encryption than WEP.
A BT spokesman said in an e-mail that the company is aware of the problem,
but that no customers had reported they had been affected.
"It's important to realise that although it has been possible to demonstrate
a scenario where the hub may be vulnerable, we don't believe it is something
that should affect the majority of BT customers in real life," the spokesman
said.
BT has published a
set of security guidelines for BT Home Hub users. Like GNUCitizen, BT recommends
changing the default encryption key as well as using WPA encryption rather than
WEP.
