bk99.de entertain the web since 1997

bk99.de
hß · SecurityCurated

Insecure factory settings in Wi-Fi routers from T-Online and Vodafone

Summary

In 2011 many routers from Telekom and Vodafone came with a preconfigured WPA key that was in some cases derived from the MAC address of the Wi-Fi interface. Attackers could capture the MAC address and use it to guess the key. Looking at almost 14,000 access points, the students Stefan Viehböck and Manuel Müller found that 17 to 25 percent still used a default Speedport or EasyBox SSID, presumably mostly with the default key.

Ideas

  • A key calculated from publicly visible data is not a secret.
  • The MAC address of an access point can be captured over the air.
  • An unchanged default SSID suggests an unchanged default configuration.
  • Strong encryption is useless if the key is predictable.

Insights

  • Manufacturer defaults determine the security of millions of connections.
  • Apparent security through enabled encryption tempts users not to change anything.

Facts

  • Access points in Stuttgart, Munich, Coburg and Berlin were examined.
  • Telekom’s Speedport models and Vodafone’s EasyBox models were affected.

References

Critique

  • The share of vulnerable routers is only inferred from the default SSIDs, not measured.

Recommendations

  • Replace preset Wi-Fi keys with your own randomly generated key.
  • Also change the default SSID so that model and configuration cannot be recognised.

Read the original article

Search the Web Archive

hß · 2026

The security coprocessor in many CPUs is insecure

In August 2026 two holes became known in the Trusted Computing Group’s reference code for firmware TPMs (fTPM 2.0), which AMD and Intel adopt in their BIOS versions. CVE-2026-6727 is a timing side channel in RSA-OAEP; CVE-2026-6726 allows discarded keys to be replaced by false ones. They can only be exploited with local, privileged access and are mainly relevant for company devices.

hß · 2022

TP-Link: smuggling malicious code through a security hole in routers

In 2022 researchers from the Vietnamese telecommunications group Viettel found a buffer overflow in the web-based ping tool of the low-cost TP-Link TL-WR841N Wi-Fi router (CVE-2022-30024). Logged-in attackers could execute their own code via an overlong host address and, for example, install a backdoor. TP-Link delivered updates for revisions V10 to V12 and declared older devices end-of-life.

hß · 2022

Takeover possible: DrayTek routers with critical security hole

In 2022 Trellix found a critical hole (CVE-2022-32548, CVSS 10.0) in numerous DrayTek routers through which unauthenticated attackers could take over the devices. A logic error in the length check on the login page /cgi-bin/wlogin.cgi led to a buffer overflow, exploitable from the LAN or via the internet if management was reachable there. The researchers found more than 200,000 vulnerable devices on the net.