Slashdot Mirror

← Back to Stories (view on slashdot.org)

MS: Windows Phone 8 Wi-Fi Vulnerable, Cannot Be Patched

Posted by timothy on from the is-there-a-workaround-for-the-workaround? dept.

Freshly Exhumed writes "Microsoft advises that a cryptographic problem in the PEAP-MS-CHAPv2 protocol used in Windows Phone 8 to provide WPA2 authentication allows a victim's encrypted domain credentials to be collected by an attacker posing as a typical WiFi access point. Redmond further states that this problem cannot be patched, although a set of manually entered configuration changes involving root certificates on all WP8 phones and on WiFi access points will apparently address the issue. WP7.8 phones are likewise vulnerable."

5 of 146 comments (clear)

  1. Why can't it be patched? by metrix007 · · Score: 5, Insightful

    If it can be fixed through manual configuration changes, why can't a patch make those same configuration changes?

    --
    If you ignore ACs because they are anonymous - you're an idiot.
    1. Re:Why can't it be patched? by i+kan+reed · · Score: 5, Funny

      Because the NSA won't let them?

    2. Re:Why can't it be patched? by Anonymous Coward · · Score: 5, Informative

      because the root certificate being installed is for the internal domain and Microsoft doesn't have that certificate.

      please note: this is only for PEAP using domain credentials. not standard WPA2-PSK that just about everyone uses.

  2. Oh please by Anonymous Coward · · Score: 5, Informative

    Every phone which implements CHAPv2 is vulnerable, because that's a broken algorithm. You can't patch it, because then it wouldn't be that algorithm anymore and stop working with other implementations of the algorithm. The right thing to do is to encapsulate it in a securely encrypted tunnel, but to have that, you have to check the certificates. If you don't secure the tunnel, an attacker can MITM you and crack the CHAPv2 inside. Not properly securing tunnels is a problem everywhere.

  3. Re:Can't you protect it with HOST files? by Anonymous Coward · · Score: 5, Interesting
    Robert Scoble is a former technology evangelist at Microsoft who decided to leave the company in June 2006 to become the vice president of Podtech.net. At that time, it was believed that Scoble had resigned because he was looking for a higher salary elsewhere.

    Innovation is the key, he said, pointing out that Microsoft had completely failed to get itself noticed in the tablet and smartphone markets.

    "Since I've left [Microsoft], what have they done that's interesting? Microsoft [Xbox] Kinect is the only thing I can think of and for a company that has 90,000 employees, to have only one product that you can point to that's innovative, that's pretty disappointing I think,” he said according to The Age.

    "Compare that to Google, which is showing you self-driving cars, Google Glass and a phone that you can talk to, the Moto X, and on and on — automatic picture improvements on Google+ — It's a much more innovative company that is driving the future harder and faster."

    One of the reasons why Microsoft fails to innovate right now is the current leadership, Scoble explained, revealing that Steve Ballmer is actually trying to make more money by rolling out innovative technologies.

    “I just don't believe Steve Ballmer really likes the future. When I interviewed [him] he said innovation is something cool that makes a lot of money. And that's absolutely not true. [Google Glass] might never make a dollar but it's new, it's interesting [and] it causes conversations. If you're an innovator, you push the future ahead. You don't care whether it necessarily makes a dollar,” he continued.

    http://news.softpedia.com/news/Former-Employee-Says-That-Microsoft-Is-Not-Longer-Cool-Blames-Steve-Ballmer-373770.shtml