NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.

Forum Discussion

GWild's avatar
GWild
Guide
Jan 28, 2021

WPS is ON all the time, and can't be disabled

Orbi RBS20/CBR40 System

 

WiFi Monitor is showing the network as WPS enabled: so it seems it is susceptible to the WPS hacks out there. There is also no visible way to disable WPS within the Orbi Login controls.

 

Has anyone figured this out?

 

ps: the article people refer to in other threads says all three methods are used, so please don't contradict what Netgear by saying PIN mode isn't used.  Sure, we can't enter or change the PIN, but the router seems to have the code to support it running 24/7 (the router will respond to a PIN request my WiFi tool is probing). And it's the WPS protocol that is hackable, not by the brute force method which Netgear says they defend against.

 

Ideas?

12 Replies


  • GWild wrote:

    WiFi Monitor is showing the network as WPS enabled: so it seems it is susceptible to the WPS hacks out there. There is also no visible way to disable WPS within the Orbi Login controls.


    The Wikipedia article on WPS gives the impession that WPS is a mandatory WiFi feature.

    https://en.wikipedia.org/wiki/Wi-Fi_Protected_Setup 

    The WPS "button" method has proved useful for connecting a number of devices.

     

    When I look at Orbi parameters, there are several that have "wps", including:

    wps_lock_down=0

    WPS_type=0

    wps_pin_attack_check=1

     

    I guess a person could telnet into the Orbi and set wps_lock_down to some other value ("1"?)

     

    I would also guess that turning on Access Control and checking "Do not allow new devices to connect" might block WPS connections.

    If it will block devices that present the correct WiFi SSID/password, it would seem reasonable to block new devices which use WPS.

    That should be easy to verify.

     

    • CrimpOn's avatar
      CrimpOn
      Guru

      I am exploring how much effort it will be to hack the Orbi WPS PIN. While looking for hacking tools, I ran across this comment on the Cyber Weapons Lab web site: (emphasis mine)

      https://null-byte.wonderhowto.com/how-to/hack-wi-fi-breaking-wps-pin-get-password-with-bully-0158819/ 

       

      "It's important to note, though, that new APs no longer have this vulnerability. This attack will only work on APs sold during that window of 2006 and early 2012. Since many families keep their APs for many years, there are still many of these vulnerable ones around."

       

      Orbi came on the market in 2016. The WPS PIN method is not mentioned in the Orbi User Manual, and a WPS PIN is not printed on the product label or (as far as I can tell) shown on the Orbi web interface or through telnet.

       

       

      • FURRYe38's avatar
        FURRYe38
        Guru

        I might presume that NG may employ some form of there own WPS handling and syncing that is proprietary on Orbi or NGs MESH systems which only is behind the scenes and is apart of there core non GPL code. Something that can't be access or changed by access from telnet. 

  • Please visit and post about this over in the Orbi with Cable modem forum:

    https://community.netgear.com/t5/Orbi-with-Built-in-Cable-Modem/bd-p/en-home-orbi-cable

     

    Thank you. 


    GWild wrote:

    Orbi RBS20/CBR40 System

     

    WiFi Monitor is showing the network as WPS enabled: so it seems it is susceptible to the WPS hacks out there. There is also no visible way to disable WPS within the Orbi Login controls.

     

    Has anyone figured this out?

     

    ps: the article people refer to in other threads says all three methods are used, so please don't contradict what Netgear by saying PIN mode isn't used.  Sure, we can't enter or change the PIN, but the router seems to have the code to support it running 24/7 (the router will respond to a PIN request my WiFi tool is probing). And it's the WPS protocol that is hackable, not by the brute force method which Netgear says they defend against.

     

    Ideas?


     

  • I think this is the way the units link and there doesn't appear to be a WPS code to use/hack