We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
79,812 News Articles

Wi-Fi security warning for BT Home Hub users

Researcher points finger at default encryption keys

A security researcher claims to have found a significant weakness in the wireless encryption of a BT Home Hub DSL home gateway made by Thomson.

Exploiting the weakness could enable someone to connect to a victim's Wi-Fi router for malicious purposes such as snooping on their internet traffic or hacking other machines using the same network, according to GNUCitizen, a group of blogging security researchers.

BT's Home Hub ships with default encryption keys to encrypt wireless network traffic using either Wired Equivalent Privacy (WEP) or Wi-Fi Protected Access (WPA).

Router manufacturers use an algorithm to generate those WEP and WPA default keys, wrote Adrian Pastor, one of the GNUCitizen's researchers, on its blog. But the algorithm is predictable and only creates a limited number of easily-guessed keys, Pastor wrote.

"Chances are that if you own a wireless router which uses a default WEP or WPA key, such keys can be predicted based on publicly-available information such as the router's Media Access Control (MAC) address or Service Set Identifier (SSID)," Pastor wrote.

"In other words: it's quite likely that the bad guys can break into your network if you're using the default encryption key," he wrote.

Pastor wrote that the information was passed to GNUCitizen by Kevin Devine, who has previously done research into wireless security. Using a software tool built by Devine in addition to information already known about the router, it's possible to come up with 80 possible default encryption keys for WEP, Pastor wrote. Devine created another software tool to try each of those keys on the router until the valid one is found.

The attack worked on three different BT Home Hubs, Pastor wrote. The researchers, however, are not publishing the software tools used in the attack.

But BT Home Hub users can take two steps to avoid this kind of attack: change the default encryption key and opt to use the WPA standard, which is considered stronger encryption than WEP.

BT did not have an immediate comment.

IDG UK Sites

45 Best Android games: top Android games for your smartphone or tablet in 2014 (24 are free!)

IDG UK Sites

How Apple, Adobe, Microsoft and others have let us down over UltraHD and hiDPI screens

IDG UK Sites

Do you have the X-Factor too? Mix Off app puts fans in the frame

IDG UK Sites

iPad Pro release date, rumours and leaked images - 12.9 screen 'coming in 2015'