We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,258 News Articles

Wi-Fi security warning for BT Home Hub users

Researcher points finger at default encryption keys

A security researcher claims to have found a significant weakness in the wireless encryption of a BT Home Hub DSL home gateway made by Thomson.

Exploiting the weakness could enable someone to connect to a victim's Wi-Fi router for malicious purposes such as snooping on their internet traffic or hacking other machines using the same network, according to GNUCitizen, a group of blogging security researchers.

BT's Home Hub ships with default encryption keys to encrypt wireless network traffic using either Wired Equivalent Privacy (WEP) or Wi-Fi Protected Access (WPA).

Router manufacturers use an algorithm to generate those WEP and WPA default keys, wrote Adrian Pastor, one of the GNUCitizen's researchers, on its blog. But the algorithm is predictable and only creates a limited number of easily-guessed keys, Pastor wrote.

"Chances are that if you own a wireless router which uses a default WEP or WPA key, such keys can be predicted based on publicly-available information such as the router's Media Access Control (MAC) address or Service Set Identifier (SSID)," Pastor wrote.

"In other words: it's quite likely that the bad guys can break into your network if you're using the default encryption key," he wrote.

Pastor wrote that the information was passed to GNUCitizen by Kevin Devine, who has previously done research into wireless security. Using a software tool built by Devine in addition to information already known about the router, it's possible to come up with 80 possible default encryption keys for WEP, Pastor wrote. Devine created another software tool to try each of those keys on the router until the valid one is found.

The attack worked on three different BT Home Hubs, Pastor wrote. The researchers, however, are not publishing the software tools used in the attack.

But BT Home Hub users can take two steps to avoid this kind of attack: change the default encryption key and opt to use the WPA standard, which is considered stronger encryption than WEP.

BT did not have an immediate comment.

IDG UK Sites

Best camera phone of 2015: iPhone 6 Plus vs LG G4 vs Galaxy S6 vs One M9 vs Nexus 6

IDG UK Sites

In defence of BlackBerrys

IDG UK Sites

Why we should reserve judgement on Apple ditching Helvetica in OS X/iOS for the Apple Watch's San...

IDG UK Sites

Retina 3.3GHz iMac 27in preview: Apple cuts £400 of price of Retina iMac with new model