Twitter | Github | Email
< Other articles

WPA2 Key Generation Vulnerability: Linksys / D-Link

AuthorAlexandro Sanchez Date2013-03-31

After finding the TP-Link WPA2 Key Generation Vulnerability, I reverse-engineered assistants provided by other vendors. It turns out that some Linksys and D-Link routers user nearly identical algorithms to generate the default WPA2 keys as TP-Link routers use. For more information about this vulnerability and its consequences, please refer to the report linked above as redundant information will be omitted here.

This time, the vulnerability affects the Linksys EasyLink Advisor and D-Link Quick Setup Wizard assistants, both based in Network Magic, a software created by Pure Networks, a company belonging to Cisco/Linksys. Since Pure Networks actually sold their software to third parties, e.g. D-Link, there might be a chance of other affected assistants.

The reversed generator is:

blacklist_windows = "1I2Z0O5SUV"
blacklist_macosx  = "B8DO0I1S5UVZ2"
blacklist = blacklist_windows  # Change me

def gen(seed):
    key = ""
    for i in range(10):
        while True:
            seed = ((seed * 0x343FD) + 0x269EC3) % (2**32)
            edx = ((seed >> 0x10) & 0x7FFF) % 0x24
            if edx >= 0xA:
                edx += 0x37
            else:
                edx += 0x30
            if chr(edx) not in blacklist:
                key += chr(edx)
                break
    return key

The seeds used by this function are obtained in the exactly same way as in the TP-Link assistant. The only difference this time is that rather than pseudorandomly choosing characters from a whitelist, it adds random characters in range [0-9A-Z], filtering out those found in a hardcoded blacklist, meant to prevent adding visually similar characters such as '0' and 'O' to the key.

As explained in the TP-Link vulnerability report, the low entropy can be exploited to bruteforce the key in a matter of minutes with a powerful GPU or hours with a CPU.

Affected routers

The complete list of affected Linksys routers is:

The complete list of affected D-Link routers is:

Resources

Solutions