BT Home Hub Wi-Fi Security Easy to Crack

April 14, 2008 – 9:53 AM

A security researcher claims to have found a significant weakness in the wireless encryption of a DSL home gateway made by Thomson and distributed to broadband subscribers in the U.K. by network operator BT.

Exploiting the weakness could enable someone to connect to a victim’s Wi-Fi router for malicious purposes such as snooping on their Internet traffic or hacking other machines using the same network, according to GNUCitizen, a group of blogging security researchers.

BT’s Home Hub ships with default encryption keys to encrypt wireless network traffic using either WEP (Wired Equivalent Privacy) or WPA (Wi-Fi Protected Access).

Router manufacturers use an algorithm to generate those WEP and WPA default keys, wrote Adrian Pastor, one of the GNUCitizen’s researchers, on their blog. But the algorithm is predictable and only creates a limited number of easily-guessed keys, Pastor wrote.

“Chances are that if you own a wireless router which uses a default WEP or WPA key, such keys can be predicted based on publicly-available information such as the router’s MAC [Media Access Control] address or SSID [Service Set Identifier],” Pastor wrote.

“In other words: it’s quite likely that the bad guys can break into your network if you’re using the default encryption key,” he wrote.

Pastor wrote that the information was passed to GNUCitizen by Kevin Devine, who has previously done research into wireless security. Using a software tool built by Devine in addition to information already known about the router, it’s possible to come up with 80 possible default encryption keys for WEP, Pastor wrote. Devine created another software tool to try each of those keys on the router until the valid one is found.

The attack worked on three different BT Home Hubs, Pastor wrote. The researchers, however, are not publishing the software tools used in the attack.

But BT Home Hub users can take two steps to avoid this kind of attack: Change the default encryption key, and also opt to use the WPA standard, which is considered stronger encryption than WEP.

A BT spokesman said in an e-mail that the company is aware of the problem, but that no customers had reported they had been affected.

“It’s important to realise that although it has been possible to demonstrate a scenario where the hub may be vulnerable, we don’t believe it is something that should affect the majority of BT customers in real life,” the spokesman said.

BT has published a set of security guidelines for BT Home Hub users. Like GNUCitizen, BT recommends changing the default encryption key as well as using WPA encryption rather than WEP.

Source: PC World