TL;DR Summary: Our Network Assessment found a Linksys router using outdated encryption, exposing clients to eavesdropping via the Sweet32 attack and making it easier to crack the Wi-Fi password.
Client Profile
Client Orchid Llama* – a self-employed finance professional, is a certified foodie, travels frequently, and is obsessed with crocheting. Their home hardware includes wireless speakers, mobile devices and a smart vacuum cleaner.
Issues in Summary
Router allows outdated protocols, making it open to eavesdropping
As part of our Network Scan, a deep scan uncovered that the Linksys router accepts an outdated cipher, which is susceptible to an attack type ‘Sweet32’. Disabling the protocol was not an available option on the GUI and firmware upgrades were not available.
CVE‑2016‑2183, also called Sweet32, targets a weak encryption method called Triple DES (3DES). This method uses 64-bit data “chunks” to scramble your information.
Why is it dangerous?
- Collision risk: Because 3DES scrambles data in 64-bit blocks, after encrypting about 32 GB of information, patterns start repeating—this is called a birthday collision.
- Attack method: An attacker who can eavesdrop (i.e. through the Wi‑Fi) could capture a long session, like many web requests during a bank visit, and piece together your data.
Weak Wifi password would have allowed access in seconds
Choosing an easy-to-remember password also meant it would be easy for bad guys to infiltrate and listen in. The strength of the password was rated to 5 seconds. Threat actors have been found to leverage weak wifi setups to attack direct networks and others nearby.
Fixes now and for later
The immediate issue of the wifi password was addressed and the new password rated to 4 years! This addressed the immediate threat of the network being compromised by someone in the area.
Two options were considered for the weak protocol issue – the first was a forced update of the firmware, the second was manually disabling the protocol through the operating system. Both options were considered intrusive and risked affecting the router in unexpected ways. However, the client was expecting to upgrade the router in the near future and as such, the recommended option was to minimise the risk of potential disruption by upgrading the router.
Key Takeaways
- Popular routers increase functionality but can also lag behind new methods of compromise. Regular scans maintain awareness of any gaps.
- Wifi is an easy attack vector if set up with only convenience in mind.
- Simple remediation actions can significantly raise the barrier to being easy prey.
*Client names have been changed to avoid identification
