Slashdot Mirror
Windows Wireless Networking Flaw Identified
An anonymous reader writes "Washingtonpost.com is reporting from the 2nd annual Shmoocon hacker conference about the release of a previously undocumented vulnerability in Windows. The flaw takes advantage of a feature on Windows laptops that have wireless cards built-in. Security researcher Mark Loveless found that Windows laptops which cannot find a wireless connection are configured to broadcast the name of the last SSID they associated with. They assign themselves an ad-hoc 'link local' (think 169.254.x.x.) address, and an attacker can configure his machine to broadcast an SSID of the same name. Thus, the attacker associates with that 'network' and communicates directly with the victim's machine. The funny part from the Post blog entry is that Microsoft helped author the RFC for link local."
I think I will go test this out on my parents...
If that was possible the richest man in the world would be a lawyer...
Ever read the EULA? You hold microsoft not responsible by agreeing. So the answer would be no, no class action suits.
---- Booth was a patriot ----
There goes my mobile botnet...
Also, many laptops have a button you can push that disables the built-in wireless feature until you hit that button again. Turning off the wireless connection when you are not using it also prevents this from being a problem.
Best advice in the article...
FTA
First of all, if you are running any kind of network firewall -- including the firewall that comes built in to Windows XP -- you won't have to worry about some stranger connecting to your laptop. In fact, I had to shut down my firewall for both of us to successfully conduct our test.
its one of those "if you have no firewall and ignore all the alerts and warnings and have filesharing enabled and have a wifi card set to auto DHCP and an attacker is targeting you specifically" flaws
yawn, seems like much ado over nothing, you have more chance dropping and breaking your laptop than you have of being exploited by this "flaw" and if you goto Starbucks (and support their disgusting business model) you deserve everything you get
What if the laptop's last SSID required WEP or WPA (and has it configured in a profile)? Will it still connect if _less_ security is required?
ZEN is a prime number in base-36
Ever read the EULA? You hold microsoft not responsible by agreeing.
Disclaimers of warranty are not necessarily legally binding. A decision in court would involve questions of how fair it is for MS to disclaim liability for this.
Does anyone actually secure their wireless network? I actually have the problem that, on startup, my computer connects to my neighbour's wireless network instead of my own!
Czech language for absolute beginners
You have to try to connect, and FAIL, to be assigned a 169.254.x.y address.
O.K. Folks, if you program your Linux laptop to connect to an ad-hoc network and broadcast SSIDs, this behaviour is going to occur on Linux too.
This isn't just an MS Windows flaw . . . it is a flaw in the way that the administrators (users) manage the machines.
I wish you all would quit pointing fingers. This isn't some kind of new thing.
Another Networking Flaw? Dam, i mean the first 74 were completely predictable, but i have to say this one caught me completely off guard. You win this round malicious hackers *shakes fist into air*.
Mike
I heart the RIAA & MPAA, im sure its mutual...
This is old info and has been known for a while. Anyone having used Kismet or some other sniffer at a public place has see this.
Loveless then created an ad hoc network with the same name, and told his computer to go ahead and connect to "hackme." Viola!
Violin! Cello!
Seriously, though, TFA doesn't seem to say quite the same thing as the summary. The demonstration the reporter saw involved him setting up an ad-hoc network, and then the security researcher was able to connect to it. Err... that's how it's supposed to work.
The article then goes on to assume that this will happen when you connect to access points and then leave them, but you don't usually set up an ad hoc network for that process. Has he just got something wrong? Missed a step out or something? Is there a URL for a technical level article on this flaw?
Should you at a later date happen to open up your laptop in the vicinity of another Windows user who also had recently gotten online at Starbucks, those two machines may connect to each other without any obvious notification to either user
You mean other than the big speech bubble thing popping up and saying "Wireless Network Connection now connected to T-MOBILE"?
This is a common security problem: useless or rarely used functionality. As I've said before, functionality sells whereas security doesn't. Spend a million dollars on functionality and you (hopefully) get a product that can sell for more money. Spend a million dollars on security and you have almost nothing tangiable to show for it.
Before this article, I didn't even know that "link local" thing existed. I guessing that this is probably quite representive of the Slashdot crew. The question is, then, is why on earth is it on by default and why is it even there in the first place?
This is not just a Microsoft issue, this is an issue that applies to nearly every computing project. I was recently playing with Knoppix and two things struck me:
My parents got a new HP computer a month or so ago and I've just gotten round to doing a proper security shake-down on the XP box. I was surprised to find the Python runtime on the computer. Most of you would say, so what? Or perhaps, even applaud HP for doing this. From a security perspective, I think it's downright silly. What possible use could my parents have for the Python runtime? Absoutely none. They'll be running Open Office, Gmail and Itunes to the cows come home so all this does is opens another vector for attack. Don't install stuff on computers that your customers will likely never need.
Of all the pieces of software out there at the moment, Windows XP is the most frustrating. In terms of security, XP should completly out-class Linux/Unix in every metric of measurement. Instead, it's the most disease ridden piece of shit ever concieved by humanity. It's a shame because it could have set a really high standard for everybody in the industry but through a choice of poor defaults they condemed their own product to be a liability to CTOs everywhere. If they'd had some sense, they would have choosen defaults like this:
I haven't got any figures on how many viruses/malware this configuration would stop but I imagine it's somewhere in the region of 99%. If Microsoft had taken the time to consider the platform in a more paranoid sense they could have produced a product of barn-storming quality. Instead, they listened to the marketing people and we all know what result that lead to.
Simon
This isn't a vulnerability, it's just how all network interfaces work on Windows. If you're really that paranoid then just disable the interface.
I mean, I know windows security is bad, but is it really considered a compromise to simply be on the same network as the attacker's machine?
I am trolling
What we have here is that, in addition to doing this, Windows is also offering to set up an ad-hoc (i.e. computer-to-computer) network on the link-local subnet with the same SSID as that of the last network the laptop connected to. I wonder what the rationale for doing this could have been. It seems to me that a machine should not offer to set up an ad-hoc network unless specifically directed to do so by the user. When such a network is set up then it is appropriate to use link-local addressing to auto-configure the interface.
Viola! His machine was assigned a different 169.254.x.x address...
Good to see that technology journalists are so enthusiastic about orchestra instruments.
This guy's the limit!
I agree with what you are saying but the only thing that could become an issue is depending on how the laptop is configured (i.e ICS is enabled), theoretically someone could use the wireless access that they have now acquired to get access to the rest of the network. I have seen with so many companies how the three top rules are ignored:
1. No admin access with a user account. If the person is required in their job to need that level of access, create them an account that they can run the necessary app with.
2. Utilize proxies to get access to the internet, no direct connection through the firewall. Reduces specific applications from getting out (oh and log everything)
3. Patch your machines dammit. Hell using MS's SAS will make your job easier. Once you have tested to make sure it doesn't break anything then approve the patch for your users.
Yes. Windows trusts the network. Think Active Directory. If you can trick a Windows machine into thinking you are on its network, it will happily let you be its partner (or maybe even its server) on that network. Though you probably can't trick it into being an AD client right off, you can find out all kinds of things about it, such as any shares it has open.
This vulnerability is an enabler, rather than a gaping hole.
What I hate is Windows' inability to route on multiple network cards. If a user is on a wireless link and they go somewhere where they plug in, Windows still thinks the wireless card is the active connection. It's been that way for years, going back to modem-PPP connections.
Also, if you have both a wired connection and a wireless (or modem) connection and leave the wired network (connecting over wireless (or modem)), Windows can't find IP addresses that are on the wired subnet. If you have a web server on a network at work, you can't connect there over the wireless/modem link. You have to disable the wired network connection, and then it works. What a design!Raise your children as if you were teaching them to raise your grandchildren, because you are.
Ever read the EULA?
By reading this you agree to stand on your head, cluck like a chicken and send me a Godzillion dollars.
EULAs are like newspapers. Just because you read something in one doesn't make it so. You cannot be legally bound to that which is not legally binding, no matter how many times you click "I Agree." EULAs are wet dreams, not contracts.
How do you find out if you are legally bound?
Well, you file a lawsuit to put the matter before a judge, that's how.
KFG
An EULA, however restricting, is not a legal document in many countries because it conflicts with the laws of that particular country.
For example the Microsoft EULA that ships with every Microsoft product is infact in violation of several laws in several EU countries but because no one has taken it to the court, it hasn't been deemed invalid.
Naturally such a decision (to rule that EULA is invalid and people are entitled to compensation) would have long lasting and massive reprocussions.
I would hardly call this a vulnerability. You're certainly no more vulnerable if someone exploits this little "feature" than you are at any other time you're
connected to a network.
This is such a complete non-issue, it's like a freaking joke. Read the article - all a hacker might gain some this vulnerability is the ability to connect to your computer, as if it was still on a wireless network, after you've moved outside the range of an access point. Big deal. But the author and "discoverer" both talk about it like this is a remote root exploit or something. At one point, the author includes this little gem: "As Loveless pointed out, this "feature" of Windows actually behaves somewhat like a virus." Virus, my ass.
What's with all the foaming-at-the-mouth hype about these minor little things lately? It's counterproductive - going beserk over every slight issue that might, in some fantastic combination of circumstances be a security problem, takes away attention from flaws that actually matter.
This space intentionally left blank.
Disclaimers of warranty are not necessarily legally binding. A decision in court would involve questions of how fair it is for MS to disclaim liability for this.
Unfortunately it's not even about fair. With regards to security, Windows is provided "AS IS". Show me one place where Microsoft even makes the slightest guarantee about security. The product was never engineered to be secure and barring a complete rewrite it never will be. They're not dumb, they know it's not very secure, and they don't advertise it as such. They don't need to "disclaim liability", the courts need to prove why it should be assigned to them in the first place.
Anyone who has an expectation of security in Windows is a sucker, plain and simple. Think about the common excuses: "99% of our customers use it so we have to also." "We store all our data on it, it OUGHT to be secure." "It's too expensive to switch to something else." You choose to use Windows, you get what you pay for. If you failed to do proper research and just created an assumption of security inside your head, it's your own fault. Quit whining about it.
Everyone wants to sue Microsoft just because they exploit human stupidity, and they're really good at it. Great use of the court system.
"The funny part from the Post blog entry is that Microsoft helped author the RFC for link local."
I really don't see how MS helping to author a usefull RFC is funny, or even relevant. What's funny is that someone at MS somehow thought it would be a good idea to open up a system to the entire world, since its clearly a thinking flaw as opposed to the usual QA flaw.
Speaking of thinking flaws, how about this one: If a laptop running XP has a wired and wireless connections going, XP asks the user if they want to share their connection. User clicks 'yes'. XP bridges wired and wireless for them. XP also broadcasts on both sides that it will be a gateway for other systems running XP (via netbios-over-ip, IIRC). Those systems get on board, and make that computer their default gateway.
Then the computer 'sharing' its connection, and all its 'victims' are suddenly very slow. There never seemed to be a straightforward way to prevent the other XP computers from making the dual-connected XP system their default gateway. If you manually change the default gateway on the victim systems, they just switch back to the dual-connected XP box. I don't know if XP still does this, but talk about stupid.
Seriously, who the hell thinks this kind of thing up? Do they have brain stem storming sessions or something?
"We are all geniuses when we dream"
- E.M. Cioran
What we'd need is a flaw in Windows that is damaging without a specialized attack program being involved. If there were something about Windows that needed repairing because you could just press Ctrl Alt Insert instead of Delete, and bypass the login for instance, then that would in my opinion qualify as being negelgent enough for Microsoft to settle a lawsuit.
Saskboy's blog is good. 9 out of 10 dentists agree.
i have heard of an even worse vulnerabelity! if you hack yuor micthorwave oven to have teh door open it will JAM MY 80211 packets!!?!!?!!?!?!?!!?!
Also risk of cooking!
tell steve gibson of GRC he will save us
TO BUY A NEW CAR WOULD MAKE YOU SEXUALLY ATTRACTIVE.
I'm not sure if this will help your exact situation, but you could try going to the network connections box, then the advanced menu, then click on advanced settings. In there, you can change the preferred order of your networks. I've used this at work, as the laptops are set by default to use the wireless connection first, but if the wireless connection is flakey, the computer gives many network errors. Setting the wired connection as a higher priority fixes a lot of problems. The only time I've had problems switching between is if it is in the middle of a file transfer during the switch.
warning: This post is likely to contain gobs of dripping sarcasm. Consume at your own risk.
So what if your computer automatically sets up an IP that doesn't clash, and then sets up adhoc wireless networking with the previous SSID _if_ you have your wlan interface on?
How is that a flaw? That's a _feature_ in many cases. Especially if you really want to share files and you don't have a WAP.
From the article: "First of all, if you are running any kind of network firewall -- including the firewall that comes built in to Windows XP -- you won't have to worry about some stranger connecting to your laptop. In fact, I had to shut down my firewall for both of us to successfully conduct our test. "
Doh.
If you actually care about security you'd already know that wireless networking is a lot less secure than wired networking.
To "wise guys" trying to connect to other peoples stuff. You yourself could be exploited if you connect to any untrusted wireless LAN and try using the internet or connecting to "open" shares[1]. There's so much that can be done to _you_ that it's not funny.
What are you going to do if your computer gets "owned" or fubared after you open a share that's called "Do Not Open" or something like that?
People who think they are smart and connect to "open" wireless LANs run by "stupid" people should also assume the possibility that someone can sniff, hijack and fake their traffic.
If turns out those "stupid" people aren't that stupid and are evil, your usernames and passwords could be taken, or your data. Or you could be victim of a MITM attack. What you see may not be the real thing.
Even if they aren't actively hostile, they could log your activities too and I doubt they are under the same limitations/restrictions as ISPs.
The company I work for provides systems that make it _easy_ for people to get connected to the internet and do their stuff - they don't have to fool around with their internet or browser settings.
Malicious folk can do the sort of stuff we do and more for nefarious purposes.
[1] You're running windows and you think you're smart to open some "stupid" person's unsecured shared folder? Well you better make sure you've set your My Computer and Local Intranet security settings to something safe[2]. And it's probably best to turn off "view as a webpage" and all that junk...
Whatever O/S you are using, you better be fully patched when you expose yourself to an untrusted network. I believe many modern Linux distros have file managers that generate image previews, and there was an image library bug not so long ago.
[2] See: http://support.microsoft.com/?kbid=315933 and http://support.microsoft.com/?kbid=182569
You mean like this:
user@machine:~> gcc --version
gcc (GCC) 4.0.2 20050901 (prerelease) (SUSE Linux)
Copyright (C) 2005 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Just "gittin-r-done," day after day.
I think you meant SMS. However, to exploit this flaw requires an aweful lot of work. I would have to know which network you've been trying to connect to, then change my set up to be that. Then your settings in Windows would have to allow me to connect to you (no firewall, some other exploit that would take considerable time). People would have to be specifically targetted for this to work (minus the handful of people that have unrestricted access to their root shares and last connected to "linksys")
Here's how to fix this on Windows:
Start->Control Panel->Network Connections->Double Click on your Wireless Connection->Properties->Wireless Networks->Advanced->Choose "Access point (infrastructure) networks only. Click the Close button then Click OK all the way back. Done.