We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Wi-Fi security warning for BT Home Hub users

Researcher points finger at default encryption keys

A security researcher claims to have found a significant weakness in the wireless encryption of a BT Home Hub DSL home gateway made by Thomson.

Exploiting the weakness could enable someone to connect to a victim's Wi-Fi router for malicious purposes such as snooping on their internet traffic or hacking other machines using the same network, according to GNUCitizen, a group of blogging security researchers.

BT's Home Hub ships with default encryption keys to encrypt wireless network traffic using either Wired Equivalent Privacy (WEP) or Wi-Fi Protected Access (WPA).

Router manufacturers use an algorithm to generate those WEP and WPA default keys, wrote Adrian Pastor, one of the GNUCitizen's researchers, on its blog. But the algorithm is predictable and only creates a limited number of easily-guessed keys, Pastor wrote.

"Chances are that if you own a wireless router which uses a default WEP or WPA key, such keys can be predicted based on publicly-available information such as the router's Media Access Control (MAC) address or Service Set Identifier (SSID)," Pastor wrote.

"In other words: it's quite likely that the bad guys can break into your network if you're using the default encryption key," he wrote.

Pastor wrote that the information was passed to GNUCitizen by Kevin Devine, who has previously done research into wireless security. Using a software tool built by Devine in addition to information already known about the router, it's possible to come up with 80 possible default encryption keys for WEP, Pastor wrote. Devine created another software tool to try each of those keys on the router until the valid one is found.

The attack worked on three different BT Home Hubs, Pastor wrote. The researchers, however, are not publishing the software tools used in the attack.

But BT Home Hub users can take two steps to avoid this kind of attack: change the default encryption key and opt to use the WPA standard, which is considered stronger encryption than WEP.

BT did not have an immediate comment.


IDG UK Sites

iPhone 6 review: best ever iPhone is very good... but no longer the best phone you can buy

IDG UK Sites

Why Apple and Samsung, Google and Microsoft's schoolyard spats make them all look stupid

IDG UK Sites

How to successfully bridge the gap between clients and creatives

IDG UK Sites

How to update your iPhone or iPad to iOS 8: including how to install iOS 8 if you don't have room ()......