Verizon FIOS (and DSL?) wireless access point insecure default WEP key

[Paul]

By default, the 40-bit WEP key for the wireless router provided by
Verizon to FiOS (fiber optic) and possibly DSL customers is set to the
last 40 bits of the router's 48-bit MAC address. This is significant
because the router's MAC address (the MAC address of it's WAN-side
ethernet port) is easily discoverable using kismet without even
needing to know the WEP key.

The MAC will usually be listed by kismet in the list of
connected/associated clients (the 'c' key in kismet). You can tell it
is the router's MAC because it will have the same first 3 octets as
the BSSID (wifi-MAC) but different last 3 octets.

This is true for every Actiontec router I've tested. In each case,
the MAC was listed by kismet in the list of connected clients, and in
every case the WEP key was the last 40 bits of this MAC.

Verizon FIOS (and DSL?) access points are detectable due to their
predictable default ESSID' which is a 5 character string of random
letters and numbers (ie A1BC3 or AB123, etc).

[Larry Seltzer]

It's WEP. What would it matter if the key were not predictable?

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
http://blogs.pcmag.com/securitywatch/
Contributing Editor, PC Magazine
larry.seltzer@ziffdavisenterprise.com


-----Original Message-----
From: Paul [mailto:paul14075@gmail.com]
Sent: Sunday, September 28, 2008 6:03 PM
To: wifisec@securityfocus.com; bugtraq@securityfocus.com
Subject: Verizon FIOS (and DSL?) wireless access point insecure default
WEP key

By default, the 40-bit WEP key for the wireless router provided by
Verizon to FiOS (fiber optic) and possibly DSL customers is set to the
last 40 bits of the router's 48-bit MAC address. This is significant
because the router's MAC address (the MAC address of it's WAN-side
ethernet port) is easily discoverable using kismet without even
needing to know the WEP key.

The MAC will usually be listed by kismet in the list of
connected/associated clients (the 'c' key in kismet). You can tell it
is the router's MAC because it will have the same first 3 octets as
the BSSID (wifi-MAC) but different last 3 octets.

This is true for every Actiontec router I've tested. In each case,
the MAC was listed by kismet in the list of connected clients, and in
every case the WEP key was the last 40 bits of this MAC.

Verizon FIOS (and DSL?) access points are detectable due to their
predictable default ESSID' which is a 5 character string of random
letters and numbers (ie A1BC3 or AB123, etc).

[Michael Scheidell]

> It's WEP. What would it matter if the key were not predictable?
>
> Larry Seltzer
> eWEEK.com Security Center Editor
> http://security.eweek.com/
> http://blogs.pcmag.com/securitywatch/
> Contributing Editor, PC Magazine
> larry.seltzer@ziffdavisenterprise.com
Makes it easier than just using 'default' :-)

I would much prefer how verizon did it then the bizillion 'lynksys' WEP keys
in the neighborhood.


--
Michael Scheidell, CTO
>|SECNAP Network Security
Winner 2008 Network Products Guide Hot Companies
FreeBSD SpamAssassin Ports maintainer


__________________________________________________ _______________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.spammertrap.com
__________________________________________________ _______________________