Slashdot Mirror
MS: Windows Phone 8 Wi-Fi Vulnerable, Cannot Be Patched
Freshly Exhumed writes "Microsoft advises that a cryptographic problem in the PEAP-MS-CHAPv2 protocol used in Windows Phone 8 to provide WPA2 authentication allows a victim's encrypted domain credentials to be collected by an attacker posing as a typical WiFi access point. Redmond further states that this problem cannot be patched, although a set of manually entered configuration changes involving root certificates on all WP8 phones and on WiFi access points will apparently address the issue. WP7.8 phones are likewise vulnerable."
If it can be fixed through manual configuration changes, why can't a patch make those same configuration changes?
If you ignore ACs because they are anonymous - you're an idiot.
Every phone which implements CHAPv2 is vulnerable, because that's a broken algorithm. You can't patch it, because then it wouldn't be that algorithm anymore and stop working with other implementations of the algorithm. The right thing to do is to encapsulate it in a securely encrypted tunnel, but to have that, you have to check the certificates. If you don't secure the tunnel, an attacker can MITM you and crack the CHAPv2 inside. Not properly securing tunnels is a problem everywhere.
What's so special about Windows Phone 8/7.8 with regards to this issue? If you're not requiring a cert validating the identity of your radius server/access point/whatever, ANY device is going to be vulnerable to a spoofed SSID kind of attack, right?
They ought to just call the guy who bought one and explain it to him.
Do you have ESP?
Hello! Nice to meet you. My girlfriend has one, too.
I don't respond to AC's.
Innovation is the key, he said, pointing out that Microsoft had completely failed to get itself noticed in the tablet and smartphone markets.
"Since I've left [Microsoft], what have they done that's interesting? Microsoft [Xbox] Kinect is the only thing I can think of and for a company that has 90,000 employees, to have only one product that you can point to that's innovative, that's pretty disappointing I think,” he said according to The Age.
"Compare that to Google, which is showing you self-driving cars, Google Glass and a phone that you can talk to, the Moto X, and on and on — automatic picture improvements on Google+ — It's a much more innovative company that is driving the future harder and faster."
One of the reasons why Microsoft fails to innovate right now is the current leadership, Scoble explained, revealing that Steve Ballmer is actually trying to make more money by rolling out innovative technologies.
“I just don't believe Steve Ballmer really likes the future. When I interviewed [him] he said innovation is something cool that makes a lot of money. And that's absolutely not true. [Google Glass] might never make a dollar but it's new, it's interesting [and] it causes conversations. If you're an innovator, you push the future ahead. You don't care whether it necessarily makes a dollar,” he continued.
http://news.softpedia.com/news/Former-Employee-Says-That-Microsoft-Is-Not-Longer-Cool-Blames-Steve-Ballmer-373770.shtml
Real Slashdot users don't have girlfriends (or boyfriends for that matter).
Nah, whats the fun in hacking all 5 people who've bought Windows Phones?
Apple Newton probably has bigger marketshare right now.
Mod me down, my New Earth Global Warmingist friends!
You put it in quotes so I assumed you were quoting one of the two links you put in but neither state that. I know there's a lot of anti-MS people here but stick to the facts please. I understand that the current solution they offer is not a patch but something that the user needs to do manually, but seriously when you quote something use what they actually said. "Recommendation. Apply the suggested action to require a certificate verifying a wireless access point before starting an authentication process. Please see the Suggested Actions section of this advisory for more information." - from: http://technet.microsoft.com/en-us/security/advisory/2876146
Some folks argue that the stories (or, rather, the presentation and discussion of them) are unfairly slanted against Microsoft. For me, it comes down to this:
When a company has a warchest in excess of 500 billion US dollars, as well as immense market penetration in a variety of domains -- desktop operating systems, web browser, word processing software, spreadsheet software, etc. -- it is expected to have its act together.
Koans and fables for the software engineer
Some folks argue that the stories (or, rather, the presentation and discussion of them) are unfairly slanted against Microsoft. For me, it comes down to this:
When a company has a warchest in excess of 500 billion US dollars, as well as immense market penetration in a variety of domains -- desktop operating systems, web browser, word processing software, spreadsheet software, etc. -- it is expected to have its act together.
(CompanyX AND 500 billion dollars) != "its act together"
For example:
Windows ME
Windows Vista
Zune
Games for Windows Live/Steam DRM
Surface RT
Xbox One and their DRM strategy (until it was revoked)
I personally contacted MS security people about this years ago before WP8 was released and they told me they would look into this and get back to me guess what I tried to follow up and they never did.
To be very clear the problem is complete lack of necessary levers and knobs to validate the TLS certificate and common name of certificate in WP7-8. Without these options TLS is trivially MITMd this leaves only MS-CHAPv2 which has known to have been completely and publically broke for years.
What is worse they don't even try there is not even a leap of faith latch as there is in other mobile platforms whereby if the cert changes it at least tells you it is different... The system never warns you or anything.
To be even more clear this is not a problem that Microsoft just stumbled on... They knew full goddamn well what the implications of leaving those levers and knobs out of WP7 were... They knew about them circa 2002-2003 when their wireless supplicant was released for XP. They just didn't give a shit.
Oh, I agree ... Microsoft doesn't have its act together. My point was that given its war chest and the demands of its current user base, it should. There's simply no excuse.
I think that's why some of us on /. come down harder on Microsoft then on smaller companies. Sure, all software shops produce buggy code from time to time. And many vendors ship products that they hope will be game changers but that, ultimately, people aren't interested in. But most of these companies don't have a zillion dollars to spend on usability studies, development, and testing.
Koans and fables for the software engineer
.....You do realize Windows Phone market share is growing faster than any other currently?
Statistics are like bikinis. What they reveal is suggestive, but what they hide is vital. :
Take this simple example
Company A as only 1 user of their phone. Then another person buy the phone. Now there is only two user, but they just doubled their users, 100% increase !
Company B as 100 users of their phone. Then another person buy the phone. Now there is 101 usersm but only 1% increase
If you only look at the stats, Company A is growing way faster than Company B.
Avoid the MS tax, always buy I.B.M. PC's (I Built-it Myself)
How the fuck do you forget leap years?
The same way you forget the month December from calendar I guess. It is strange, though.
It is what it is.
First point: it didn't "forget" leap years, there was just a logic error in the special-case code that handled them. Forgot to test, perhaps, but not actually forgot.
Second point: Microsoft didn't write that code. It was part of the clock module that was built into the hardware that they used. Again, perhaps they should have tested it themselves, but the clock module's code quality itself wasn't Microsoft's fault.
There's no place I could be, since I've found Serenity...
Just a nitpick, you're a wee bit off there with $500B. Actual cash on balance sheet is $76B. Market cap is approximately $273B.
My bad: the Forbes article I grabbed it from is a year old:
http://www.forbes.com/sites/afontevecchia/2012/01/20/dont-underestimate-microsoft-but-watch-out-for-margin-compression/
"Bing is another powerful tool Microsoft can juice. Despite “continuing to rack up operating losses,” Bing is “inching up the search ladder,” according to Caris, growing revenues 13% to $784 million. Microsoft is sitting on a massive $512.7 billion war chest with which it supports acquisitions and businesses like Bing, which are strategic in tapping into Google and Yahoo’s all-important search revenues. According to comScore, Bing’s market share is now up to 15.1% (as of December), compared to 14.5% for Yahoo and 66% for Google."
Koans and fables for the software engineer
Yes, definitely a typo on their part. Decimal point should be shifted one place to the left.