Wi-Fi Protected Setup (WPS) was designed to simplify network connections using an 8-digit PIN code. However, design flaws make it vulnerable to rapid recovery.
1. The WPS PIN Vulnerability
The 8-digit PIN is verified in two separate halves:
- First 4 digits: Verified independently (10,000 combinations).
- Next 3 digits: Verified independently (1,000 combinations).
- Last digit: Serves as a checksum.
This reduces the total combinations from 100,000,000 to just 11,000 guesses, allowing a local auditor to crack the PIN in a few hours using brute-force tools.
2. Auditing with Reaver
reaver -i wlan0mon -b 00:11:22:33:44:55 -vv3. Mitigation
Enforce strict security: **Disable WPS** entirely inside your wireless router administration console.