Slashdot Mirror
Wi-Fi WPA2 Vulnerability Found
BobB-nw sends along news based on yet another press release in advance of the Black Hat conference: a claimed vulnerability in WPA2 Enterprise that leaves traffic open to a malicious insider. "...wireless security researchers say they have uncovered a vulnerability in the WPA2 security protocol, which is the strongest form of Wi-Fi encryption and authentication currently standardized and available. Malicious insiders can exploit the vulnerability, named 'Hole 196' by the researcher who discovered it at wireless security company AirTight Networks. The moniker refers to the page of the IEEE 802.11 Standard (Revision, 2007) on which the vulnerability is buried. Hole 196 lends itself to man-in-the-middle-style exploits, whereby an internal, authorized Wi-Fi user can decrypt, over the air, the private data of others, inject malicious traffic into the network, and compromise other authorized devices using open source software, according to AirTight. 'There's nothing in the standard to upgrade to in order to patch or fix the hole,' says Kaustubh Phanse, AirTight's wireless architect who describes Hole 196 as a 'zero-day vulnerability that creates a window of opportunity' for exploitation." Wi-Fi Net News has some more detail and speculation.
so rather than a hole, its more a forced proxy? a user who knows your password, is decrypting your traffic, and re-broadcasting it with different content... if this user has your password, you need to have a think about who you give your password to
portfolio
Can't anybody design any piece of hardware or software that does not have some lame vulnerability?
+1 for consumers, -1 for enterprises?
This vulnerability is only useful if the attacker knows your WPA key. In other related news, it has been discovered that those who know your root password can delete all your files.
your home wpa2/psk environment is still safe, so don't worry about your neighbours virtual break-in.....
In other news, people on your wired ethernet segment can also see your "private" traffic. If you care so much, use SSL. Next scaremongering non-story in 3, 2, 1.
nooo problemo.
if this is supposed to be a new economy, how come they still want my old fashioned money?
"I'm starting with the man in the middle
I'm asking him to change his ways
Every packet is encrypted just a little
If you wanna make your network a safer place
Find the man in the middle and punch his face."
...even in principle to create a secure over-the-air encryption system with no out-of-band key exchange. Does there exist a proof of this?
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
So deploy ipsec everywhere...
I use ROT13. TWICE!
Mommy, Jimmy's sniffing my packets again, make him stop!
Actually that's not entirely a bad idea.
One frequent problem is that many people that think they are too important to obey pesky IT rules and they will give out the WPA key to any visitor that wants to check their email. Thus you have to assume to a point that the network is open and restrict things to certain MAC addresses or similar anyway.
Assuming the wireless network is completely open (but not actually doing so), sticking it on the outside of a firewall and letting laptop users in with some sort of VPN actually makes a bit of sense.
I will make sure he is gonna look like Michael Jackson himself, after I am done.
Or just create separate open wireless networks outside the firewall for visitors along with the WPA(2) wireless networks.
I've been telling people to use VPN over WiFi connections forever. Even better, put your wireless devices on the outside of the firewall, so they have no choice but to VPN in. This also makes giving a random guest access to your wireless no big deal. Any one who thinks wireless networking will ever be safer than an old-fashioned hub is deluding themselves.
One frequent problem is that many people that think they are too important to obey pesky IT rules and they will give out the WPA key to any visitor that wants to check their email.
Most enterprise grade access points will support multiple SSIDs and VLANs. It's child's play to setup a VLAN for guests that provides internet access without putting them on your corporate network. I did this at my job because I was sick of explaining to the bosses why it was a bad idea to put vendors and salespeople on our corporate network just so they could check their e-mail. It took all of ten minutes to setup with Cisco access points, switches and routers.
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
Of course, if you really want to limit it to visitors, you could use WPA(2)-Personal for the visitor network.
Hi.
We recently had some security tests with a consulting firm and, while no WiFi test was done (we have no WiFi), I was curious and asked the guy about WiFi security. He told me that, given that there was a constant traffic, he could break any WiFi in about two hours. So I do not know if this vulnerability is a completely different thing or that guy was just too much optimistic.
Anyone does have first hand info?
Why can't
Some wireless vendors can detect soft "fake" APs because the entire wireless system knows which packets are generated by itself, and which are spoofed. These systems can also triangulate the rogue device. See arubanetworks.com for just one example.
He also didn’t mention how long it took, although it can’t have been that long. Crank down the rekey interval on the ptk and that would help some, although a script could be ran on the attacking machine to continually repoll for updated keys.
But, So what? A malicious INSIDER can sniff or inject other users traffic while being already connected to the wpa2 network. The malicious insider could also go plug in a wired device and do a whole lot more damage, easier, and faster.
There is no vulnerability from an UNauthorized wireless attacker. Wake me when that happens.
The whole point of a switch is that it sends data only to the host that it is for. So you don't get my data out your switch port. If you clone a MAC, that doesn't do the trick as it just confuses the switch and some data goes to one computer, some to the other, and the connection works poorly. Back in the day you could overload the switches in various ways and make them act like hubs, but that is also noticeable, and it doesn't work on new high quality switches.
Wired networks are actually pretty secure from snooping over all. It's not impossible, but it is damn hard.
With cryptographic theory, we have many systems which seem to be really hard to break. We have stuff which we can prove is secure unless the attacker uses brute force, a quantum computer, or solves a "hard" problem in number theory.
Why is it so difficult to make an actual secure cryptosystem?
So, if you grant someone access to your encrypted wireless network, the person you granted access to can access data on that network? Who would have thunk it?
Just to make sure (I've never read the WPA2-EAP specs), the login username/password for access to the wireless is encrypted with another layer and isn't now cleartext to any malicious authenticated user? Any place with single sign-on for Wireless and Computers could be seriously exposed to internal baddies.
Statements like, "I could break any WiFi in about two hours," are red flags that you should higher a different security researcher...
The terms "any", "ever" or "all" are not in most security researcher's vocabularies when talking about unknowns or speculative situations.
We prefer to use terms that imply some degree of uncertainty such as "mostly", "almost never", and "nearly all" since the one thing we know
as security researchers is "trust no one", followed closely by "there is almost always an exception to the rule".
I'm certain that there is at least one "WiFi" your researcher could not break in approximately two hours, thus voiding the "any" term they used.
When in doubt just say, "Prove It."
In other words, if someone is already logged into a network they can perform a MITM attack against user(s) on that network?
Maybe it's just me, but I never considered traffic *within* a network to be secure from other network users, even on a wired network.
If there is a reason you don't want someone seeing it, don't Wi-Fi it. Its not a 100% solution but it gets Wi-Fi vulnerabilities out of the way. I've always been too paranoid to do anything financial over a Wi-Fi and I only get more reasons to support that paranoia.
"They confiscated everything, even the stuff we didn't steal!"
Is there any wi-fi crypto left standing?
I understand that only applies to Enterprise mode; so will enterprises revert to using passphrases? Or if you use passphrases you already don't have protection from your peers?
Also, TFA talks only abou WPA2. However, there seems to be no reason to think it does not apply to WPA as well. Is anyone sure?
entropy happens
Wouldn't it be easier for said malicious insider to just give the man-in-the-middle the PSK?
Anyone else note the gratuitous dig at open source:
So I guess everything would be OK except for those pesky kids and their free software. *sigh*
-- MarkusQ
First of all (Attn TFA author) if you've read the 802.1x spec theres a huge honkin warning its not suitable in situations where the transport is not physically secure. IE if you don't trust the wired path from the switch providing port access to the system its plugged into then you shouldn't be using 802.1x in the first place as the path is obviously subject to trivial MITM.
The same idea applies to WPA. If your using a shared key and you don't trust others in posssesion of said key then your a moron if you think the key is doing you or anyone else any good.
Holy crap, I am really sentimental now.
I remember the good old days of security world, where BH/CCC/Defcon/etc presentations were technical marvels and work of extremely bright people.
Ah, good old days...
...I'm using WEP, so I am perfectly safe!
My first program:
Hell Segmentation fault
Which is no longer used in current Linux kernels (and won't even compile properly without major tweaks.
And admin level access to the system to perform MAC spoofing. Sure, another user could see your broadcast transmission, but the user credentioals are not used during broadcast.
And ye shall know the truth, and the truth shall make you free.
John 8:32(King James Version)
Indeed - we have a Draytek 2820 broadband wireless router at HQ and it can be setup with up to four SSIDs that can be individually rate limited and isolated from each other (if wanted), giving guest users only broadband access but no corporate LAN connectivity.
AT&ROFLMAO
Connect to an open access point. Establish a VPN connection to the router. Configure the router to only route traffic from VPNed clients. What is the problem? Why can VPN be secure but they cannot seem to manage to build a wireless security system?
Go green: turn off your refrigerator.
I heard a saying once before. I can't remember who said it but, "Security is a myth, no system is secure"- unknown
In that case the Australian government can have access to user logs with 90% censoring... we'll let them see the protocol part of the requested URLs.