Re: IEEE spectrum article on Wifi Worms

On Jan 23, 2008, at 2:10 PM, Keith Lofstrom wrote:

> http://www.spectrum.ieee.org/jan08/5877
>
> The article doesn't explain how it is possible to inject new firmware
> into a wifi router without a hardwire link;  the APs I know about
> are normally managed over the user-side hardwired ethernet ports.

It seems to me that a fairly simple defense would be to only allow 5  
login attempts from a single DHCP lease. With a typically configured  
router (24 hour lease time, /24), that would be only 1270 login  
attempts a day, or a ponderous 51 days to try every word in the  
article-referenced 65,000 word dictionary.

Changing the password to anything but the default would result in a  
reasonably secure device without forcing the average (lazy) user to  
introduce difficult to recall passwords.

Michael

-- 
The Personal Telco Project - http://www.personaltelco.net/
Donate to PTP: http://www.personaltelco.net/donate
Un/Subscribe:  http://lists.personaltelco.net/mailman/listinfo/general/
Archives:  http://news.gmane.org/gmane.network.wireless.portland.general/
Etiquette: http://www.personaltelco.net/index.cgi/MailingListEtiquette