Slashdot Mirror
MS: Windows Phone 8 Wi-Fi Vulnerable, Cannot Be Patched
Freshly Exhumed writes "Microsoft advises that a cryptographic problem in the PEAP-MS-CHAPv2 protocol used in Windows Phone 8 to provide WPA2 authentication allows a victim's encrypted domain credentials to be collected by an attacker posing as a typical WiFi access point. Redmond further states that this problem cannot be patched, although a set of manually entered configuration changes involving root certificates on all WP8 phones and on WiFi access points will apparently address the issue. WP7.8 phones are likewise vulnerable."
If it can be fixed through manual configuration changes, why can't a patch make those same configuration changes?
If you ignore ACs because they are anonymous - you're an idiot.
So that's why all of the wifi pineapples sold out at DEF CON...
Every phone which implements CHAPv2 is vulnerable, because that's a broken algorithm. You can't patch it, because then it wouldn't be that algorithm anymore and stop working with other implementations of the algorithm. The right thing to do is to encapsulate it in a securely encrypted tunnel, but to have that, you have to check the certificates. If you don't secure the tunnel, an attacker can MITM you and crack the CHAPv2 inside. Not properly securing tunnels is a problem everywhere.
What's so special about Windows Phone 8/7.8 with regards to this issue? If you're not requiring a cert validating the identity of your radius server/access point/whatever, ANY device is going to be vulnerable to a spoofed SSID kind of attack, right?
They ought to just call the guy who bought one and explain it to him.
Do you have ESP?
Never met a Zune user, either.
This is quite the "Oops" on the part of MSFT which, even if this is nothing more than anti-MS FUD, can ill-afford this kind of bad press with a platform which has less than 4% of market share.
Probably the result of an office memo, which came down from the top, worded something like this: More animations, more inexplicable navigation, don't worry about security or adhering to the APIs, we can fix that later .. or not.
A feeling of having made the same mistake before: Deja Foobar
Innovation is the key, he said, pointing out that Microsoft had completely failed to get itself noticed in the tablet and smartphone markets.
"Since I've left [Microsoft], what have they done that's interesting? Microsoft [Xbox] Kinect is the only thing I can think of and for a company that has 90,000 employees, to have only one product that you can point to that's innovative, that's pretty disappointing I think,” he said according to The Age.
"Compare that to Google, which is showing you self-driving cars, Google Glass and a phone that you can talk to, the Moto X, and on and on — automatic picture improvements on Google+ — It's a much more innovative company that is driving the future harder and faster."
One of the reasons why Microsoft fails to innovate right now is the current leadership, Scoble explained, revealing that Steve Ballmer is actually trying to make more money by rolling out innovative technologies.
“I just don't believe Steve Ballmer really likes the future. When I interviewed [him] he said innovation is something cool that makes a lot of money. And that's absolutely not true. [Google Glass] might never make a dollar but it's new, it's interesting [and] it causes conversations. If you're an innovator, you push the future ahead. You don't care whether it necessarily makes a dollar,” he continued.
http://news.softpedia.com/news/Former-Employee-Says-That-Microsoft-Is-Not-Longer-Cool-Blames-Steve-Ballmer-373770.shtml
Real Slashdot users don't have girlfriends (or boyfriends for that matter).
So it's 1984, and I'm in a high school math class where I have to write a very simple calendar program on a Sperry computer, never knowing that years later the guy that did the same thing on the Zune would have got a zero and be held up as an epic failure to programmers today. How the fuck do you forget leap years? How the fuck do you mess things up so badly that your device will not even turn on on some days due to that calendar bug? How bad is the quality control to miss such a thing that was a high school level exercise decades ago?
Every year there is a story on slashdot where the perfect response is 'Use Windows, get screwed.' It seems things have not changed much in the last 15 years.
This is quite the "Oops" on the part of MSFT which, even if this is nothing more than anti-MS FUD, can ill-afford this kind of bad press with a platform which has less than 4% of market share.
The Microsoft mantra has always been that they only get cracked because they have most of the market share. Here they have 4% of the market share and they are still getting cracked.
Maybe the things MS make are just no good?
You put it in quotes so I assumed you were quoting one of the two links you put in but neither state that. I know there's a lot of anti-MS people here but stick to the facts please. I understand that the current solution they offer is not a patch but something that the user needs to do manually, but seriously when you quote something use what they actually said. "Recommendation. Apply the suggested action to require a certificate verifying a wireless access point before starting an authentication process. Please see the Suggested Actions section of this advisory for more information." - from: http://technet.microsoft.com/en-us/security/advisory/2876146
The problem is that you can't really turn off this behaviour and it does it automatically. Every client (laptop, tablet, phone, other wireless device) that does this fully automatic, may leak Active Directory account data that could be used to actually log on to file servers as well. It's not just MicroSoft that has this problem with PEAP, but that it's apparently not possible (at least not easily) to put some safety measures on the phone so you can mitigate this. I'm sure there will be other PEAP client implementations on other vendors devices that will suffer from this "automatically leaking AD logon data", but apparently, most vendors don't do it as bad as MS?
I was promised a flying car. Where is my flying car?
Reeks of a data funnel for the NSA
Jack of all trades,master of none
I personally contacted MS security people about this years ago before WP8 was released and they told me they would look into this and get back to me guess what I tried to follow up and they never did.
To be very clear the problem is complete lack of necessary levers and knobs to validate the TLS certificate and common name of certificate in WP7-8. Without these options TLS is trivially MITMd this leaves only MS-CHAPv2 which has known to have been completely and publically broke for years.
What is worse they don't even try there is not even a leap of faith latch as there is in other mobile platforms whereby if the cert changes it at least tells you it is different... The system never warns you or anything.
To be even more clear this is not a problem that Microsoft just stumbled on... They knew full goddamn well what the implications of leaving those levers and knobs out of WP7 were... They knew about them circa 2002-2003 when their wireless supplicant was released for XP. They just didn't give a shit.
.....You do realize Windows Phone market share is growing faster than any other currently?
Statistics are like bikinis. What they reveal is suggestive, but what they hide is vital. :
Take this simple example
Company A as only 1 user of their phone. Then another person buy the phone. Now there is only two user, but they just doubled their users, 100% increase !
Company B as 100 users of their phone. Then another person buy the phone. Now there is 101 usersm but only 1% increase
If you only look at the stats, Company A is growing way faster than Company B.
Avoid the MS tax, always buy I.B.M. PC's (I Built-it Myself)
Why, yes, they could double their market share by selling a relatively small amount of units, but that doesn't mean that there is really a significant amount of them in use.
According to this:
Ooooh, Microsoft has gained 0.6% of the market over the last 12 months. I'm impressed, and I can only imagine the competitors are all running scared.
And in case you'd like to claim that's not what it says, let's go straight to IDC here, it's the first table on the page. They may have shipped 8.9M units this year vs 4.7M units last year, but how many of them have actually sold?
Yes, especially when they cling to a lame statistic which doesn't say what they think it says. Next you'll try to tell me the Zune was a raging success.
It's true that, as a percentage increase from what they had last year, Microsoft phones are 'growing faster' relative to itself (NOT faster relative to the overall market), but in terms of overall magnitude in the market, it's still a dud. Compared to what it did last year, it make huge gains ... compared to what everybody else did last year, Windows phone is a drop in the bucket.
That doesn't equate to "Windows Phone market share is growing faster than any other" -- not by a bloody longshot.
But, hey, you keep consoling yourself that it's the fanboys of competing technologies who are spreading lies and propaganda that Windows Phone is a joke and a failure. You console yourself that, if they'd only listen to the statistics which demonstrate it's a superior phone, we could all get along.
And I'll keep assuming you're a drooling idiot who doesn't know how to read the statistics. All that stat says is how fast Microsoft's share increased over the last year compared to where Microsoft's share was last year.
But growing from 3.1% of a market to 3.7% of a market isn't the success story you seem to think it is.
Lost at C:>. Found at C.
They lack innovation because they lack imagination. Ballmer isn't a futurist. Until he, and the entire VP layer, are gone, we will not see innovation from Microsoft. "There's no chance that the iPhone is going to get any significant market share. No chance." That, in a world with craptastic cell phone UX. The typical houseplant knew it was a dead paradigm on life support, and anyone who came in to do a half way decent job would get significant market share. Microsoft desktop OS lifespan is 12+ years to the point most of it's users not only don't expect innovation, they don't want it. And then for the past ~4 years did the polar opposite with their mobile strategy by having zero legacy compatibility, to the degree hardware was being abandoned (no software updates) days after being announced.
You must have set Google to Safe Browsing...
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
They all use iPhones...
About 3.7% of smartphone users.
It's not unique to WP8 either; MS just happens to have issued an advisory about it. By default, I don't believe Android validates the SSL certs used for PEAP either.
There's no place I could be, since I've found Serenity...
will it blend?!