The Channel logo

News

By | Dan Goodin 26th February 2008 21:19

That Wi-Fi network you thought was secure? It ain't

'Pwnage Edition' on the prowl

Businesses using some of the more advanced methods for securing connections to Wi-Fi access points need to take a hard look at the configuration settings of client computers. So say researchers who have documented a simple way to impersonate trusted networks.

The attack works on access points that use the Wi-Fi Protected Access (WPA) in concert with Protected Extensible Authentication Protocol (PEAP) or other so-called Extensible Authentication Protocols (EAPs). Such technologies use public-key certificates to authenticate a trusted network to a laptop or other connected device and provide an encrypted SSL tunnel through which the two can communicate.

Problem is, laptops running Windows, OS X and various versions of Linux frequently have the security settings mis-configured, according to researchers Brad Antoniewicz and Josh Wright. Using a program called FreeRADIUS-WPE (short for FreeRADIUS Wireless Pwnage Edition), it's easy to dupe the clients into connecting to imposter networks and giving up critical information, they say.

The attack relies on a technology known as a wireless supplicant, which sits on the client and checks the validity of a network's credentials. All too frequently, the researchers say, it's not configured to validate a certificate at all, or at the very least, not to properly validate a server's RADIUS TLS certificate.

"In either of these scenarios, FreeRADIUS-WPE (our modified version of the open source RADIUS server) can be used to gain access to the inner authentication credentials passed in the TLS tunnel that is established between client and the authentication server," Antoniewicz writes here. "In some cases these protocols reveal the client's username and password in clear text, while other cases require a brute force attack. Due to active directory integration, these credentials may also be those used for domain authentication."

The researchers envision a scenario where a vulnerable client could be induced to give up sensitive information while connected to a public hotspot that's in close proximity to a corporate access point.

Microsoft's Windows Zero Configuration (WZC) by default is set to validate server certificates and we suspect the same can be said about wireless supplicants contained in competing operating systems. But Antoniewicz says these settings are frequently turned off, presumably at the first sign of connectivity problems, and then never turned back on. What's more, Windows users can easily be misled by prompts that ask if they want to connect to a network whose validation doesn't check out.

"When using WZC and other supplicants, you'll want to make sure that the client clearly validates the server certificate by only trusting certificates that match the signing authority, and hostname of the RADIUS server," Antoniewicz advises. ®

comment icon Read 23 comments on this article alert Send corrections

Opinion

Memristor_wafer

Chris Mellor

Execution warrant close to being signed for Fink's folly
Woman cuddles 'sly-looking' Fennec fox. Photo by Shutterstock
Cartoon of employee asking wky boss makes hium wear suspenders (while pincer through open trapdoor remains poised above his head) illustration by Cartoon resource for Shutterstock

Frank Jennings

It's not like my boss painstakingly nurtured the contacts, right?

Features

Wind turbine, image via Shutterstock
Girl and computer, photo via Shutterstock
Middle-class terror of engineering also part of problem
Nerd fail photo via Shutterstock