Why Wi-Fi Direct Isn’t as Secure as You Think
Pinterest Whatsapp
Advertisement

Transferring data between two devices is often a time consuming mess. Cables, unreliable Bluetooth connections, and significant patience are all part of our collective suffering.

Fortunately, an alternative exists in the form of Wi-Fi Direct. Developed by the Wi-Fi Alliance, Wi-Fi Direct promises to deliver the speed of a traditional Wi-Fi network. Two devices are able to communicate directly, without the need of an internet connection.

Of course, no new technology is without downsides. According to research presented at Black Hat Europe 2017, Wi-Fi Direct may be compromising our security. In doing so, it unwittingly grants hackers an easy way into our digital lives—all in the pursuit of convenience.

How exactly does Wi-Fi direct make us vulnerable, and what can we do about it?

What Is Wi-Fi Direct?

Bluetooth has been around since 1994, and it was once considered the easiest, fastest solution for wireless file transfer. However, it wasn’t the best: speeds were slow and reliability was poor.

In the almost quarter of a century since, we’ve been propelled into the digital age, creating, consuming, and transferring files far larger than existed in 1994. The Wi-Fi Alliance thought they could help, and created Wi-Fi Direct—combining the ease of Bluetooth and the speed of Wi-Fi WiFi Direct: Windows Wireless File Transfer That's Faster Than Bluetooth WiFi Direct: Windows Wireless File Transfer That's Faster Than Bluetooth Wireless data sharing from a Windows 8 computer to another device comes with its challenges. With Bluetooth and WiFi Direct we tested two popular and widely available solutions. This is what we found... Read More .

Although we associate Wi-Fi with the internet, it is actually a way to create a local wireless network. It just so happens that most of the time the Wi-Fi Access Point (AP) is connected to the internet. Wi-Fi Direct is not constrained by an internet connection. Instead it allows two devices to set up a peer-to-peer (P2P) Wi-Fi network, without the need for a wireless router.

Although it uses different technology, the reality is that Wi-Fi Direct is a lot like Bluetooth The Differences Between Bluetooth 4.0 and Wi-Fi Direct You Need To Know The Differences Between Bluetooth 4.0 and Wi-Fi Direct You Need To Know If you take a peek into the future, it's hard not to envision an always-on society that features a multitude of connected devices that work in unison to make your life more convenient. Read More —except with speeds up to 250Mbps (ten times the speed offered by Bluetooth 4.0) and AES 256-bit encryption.

How Does Wi-Fi Direct Work?

Wi-Fi Direct is a fairly confusing name. In fact, it sounds strangely like a service used to easily connect to a Wi-Fi network. Although, that already exists as Wi-Fi Protected Setup (WPS).

During development, Wi-Fi Direct had an alternative name (Wi-Fi P2P) which better summarizes the protocol. Instead of connecting to a central Access Point (AP), two devices are able to connect directly to each other.

why wi-fi direct is insecure
Image Credit: Andrés Blanco

The Discovery Procedure, which allows for the creation of the Wi-Fi Direct connection, consists of two device states: listen, and search. When in a listening state, the device waits to receive a probe request which it can answer, known as passive scanning.

The search state, or active scanning, sends out requests, waiting for responses from devices in a listening state. To create the P2P network, both devices need to actively switch between both states.

Once two devices have located each other, they enter negotiations as to which device will act as the P2P Group Owner (P2P GO). The P2P GO closely resembles the AP in a traditional network, allowing the other device to connect to it.

why wi-fi direct is insecure
Image Credit: Andrés Blanco

Printers, Smart TVs, and similar Internet of Things (IoT) devices are often designed to act by default P2P GOs. They emit beacon frames, so that other devices can find them, and determine if they are suitable to connect to. This means there is no need for the GO negotiation, with the end result that the Wi-Fi Direct and Wi-Fi connections seem functionally similar.

A Problem With Wi-Fi Direct’s Implementation

In practice, none of these technologies works in isolation. Many devices that support Wi-Fi Direct are also connected to a standard Wi-Fi network at the same time. Your home printer, for example, may be able to accept photos directly from your smartphone via Wi-Fi Direct, but it is also probably connected to your home network.

The ability for a device to connect to multiple networks concurrently is usually a positive one. It is also one of Wi-Fi Direct’s greatest vulnerabilities.

why wi-fi direct is insecure
Image Credit: Andrés Blanco

However, Wi-Fi Direct as a specification isn’t to blame. Instead, it is the implementation and poor security practices of the many device manufacturers that put you at risk.

This problem isn’t unique to Wi-Fi Direct. Indeed, it is a common weakness in IoT devices Is Your Smart Home at Risk From Internet of Things Vulnerabilities? Is Your Smart Home at Risk From Internet of Things Vulnerabilities? Is the Internet of Things safe? You would hope so, but a recent study has highlighted that security concerns raised several years ago have yet to be addressed. You smart home could be at risk. Read More . Among the many examples presented by Andrés Blanco at Black Hat Europe, were printers from HP and Samsung, and a media streaming device from Western Digital.

The Point of Entry

Blanco used HP’s OfficeJet Pro 8710 as a case study. The printer supports Wi-Fi Direct, and is also able to accept concurrent connections to standard Wi-Fi networks. The printer’s security management includes; HTTPS, WPA2, 802.1x wireless authentication, PSK, and a firewall amongst other things.

After reading the specification sheet, you might be left thinking you’ve invested in a bulletproof device. The printer is setup as a P2P GO, so that it broadcasts its existence and allows other devices to connect to it.

why wi-fi direct is insecure
Image Credit: Andrés Blanco

The Wi-Fi Direct standard mandates that once a connection is requested, the devices then use the WPS connection protocol to establish the connection. The WPS pin is a numerical eight digit code, which is easily subjected to brute force attack. HP’s implementation of the WPS protocol is to automatically allow Wi-Fi Direct connections, using the default WPS password of ‘12345678’.

In effect, this allows anyone to establish a Wi-Fi connection to the printer, without any authentication or notification. The attacker then has full access to the printer—potentially including its print memory and history—as well as an entry point to the wider Wi-Fi network that the printer is connected to.

why wi-fi direct is insecure
Image Credit: Andrés Blanco

Another example of poor implementation can be found in the Western Digital TV Live Media Player. The device supported Wi-Fi Direct as standard, and it was automatically enabled, allowing anyone within range to connect.

The connected device then had full access to the remote control features, as well as the web server, and read/write access to the media server and all connected devices. All of these permissions were granted with no authentication or notification. Perhaps unsurprisingly, the WD TV Live was discontinued in 2016.

Is Wi-Fi Direct Really an Issue?

Many manufacturers claim that the vulnerabilities around Wi-Fi Direct aren’t a concern down to the protocol’s distance limitations of around 100m. Standard Wi-Fi networks also have a range of around 100m and this does little to prevent attacks How People Are Hacking Wireless Networks & How To Protect Yourself How People Are Hacking Wireless Networks & How To Protect Yourself Read More .

The Wi-Fi Direct protocol has flaws. However, as is the case across the tech industry, the main flaws come from hardware manufacturers doing little to secure their devices.

Eager to part you with your hard-earned cash, technological developments are rebranded as features, but with no time invested in securing them. As the vulnerabilities differ by device, the best you can do is be aware of the devices on your network How to Check Your Wi-Fi Network for Suspicious Devices How to Check Your Wi-Fi Network for Suspicious Devices Are you worried that strangers or hackers might be on your Wi-Fi network? Here's how you can check and how to do something about it. Read More .

When setting up a device change the default settings, disable insecure features, and make your network secure 10 Ways Your Router Isn't as Secure as You Think 10 Ways Your Router Isn't as Secure as You Think Here are 10 ways your router could be exploited by hackers and drive-by wireless hijackers. Read More . Until companies are forced to face the cost of their poor security standards, it’s left to us as users to prevent the damage they cause.

Enjoyed this article? Stay informed by joining our newsletter!

Enter your Email

Leave a Reply

Your email address will not be published. Required fields are marked *

  1. dragonmouth
    March 7, 2018 at 6:23 pm

    How can we expect WiFi Direct to be secure when WiFi itself is not too secure?

    • James Frew
      March 8, 2018 at 11:41 am

      At least with traditional Wi-Fi networks you have additional control over security measures. Wi-Fi Direct (mostly) leaves you powerless against the vulnerabilities.