MS: Windows Phone 8 Wi-Fi Vulnerable, Cannot Be Patched 146
Freshly Exhumed writes "Microsoft advises that a cryptographic problem in the PEAP-MS-CHAPv2 protocol used in Windows Phone 8 to provide WPA2 authentication allows a victim's encrypted domain credentials to be collected by an attacker posing as a typical WiFi access point. Redmond further states that this problem cannot be patched, although a set of manually entered configuration changes involving root certificates on all WP8 phones and on WiFi access points will apparently address the issue. WP7.8 phones are likewise vulnerable."
Oh please (Score:5, Informative)
Every phone which implements CHAPv2 is vulnerable, because that's a broken algorithm. You can't patch it, because then it wouldn't be that algorithm anymore and stop working with other implementations of the algorithm. The right thing to do is to encapsulate it in a securely encrypted tunnel, but to have that, you have to check the certificates. If you don't secure the tunnel, an attacker can MITM you and crack the CHAPv2 inside. Not properly securing tunnels is a problem everywhere.
Re:Why can't it be patched? (Score:5, Informative)
because the root certificate being installed is for the internal domain and Microsoft doesn't have that certificate.
please note: this is only for PEAP using domain credentials. not standard WPA2-PSK that just about everyone uses.
Re:Why can't it be patched? (Score:4, Informative)
Parent must be spam (Score:3, Informative)
Re:Why can't it be patched? (Score:5, Informative)
If it can be fixed through manual configuration changes, why can't a patch make those same configuration changes?
The configuration change is enabling server certificate validation. If the network is set up for this, all is well: just like SSL, the server demanding the credentials from the client connecting to the network has a certificate, which the client can verify before attempting to authenticate. Spoofing becomes effectively impossible without access to a suitably signed cert.
However, if the authentication server is not set up to use a certificate, or is set up to use a certificate not signed by one of the CAs in the client's list of trusted authorities, enabling server certificate validation will cause the client to freak out and never attempt to authenticate (since validation will, correctly, fail.)
Re:Oh please (Score:5, Informative)
Other phones don't automatically give out your corporate domain login details using it though.
Re:Oh please (Score:5, Informative)
Well, to be fair to the blasters and lambasters:
- This is a protocol developed by Microsoft, and it's fundamentally broken
- Knowing it's fundamentally broken, Microsoft still included it on their phone and enabled its use by default
Where does it say that it cannot be patched? (Score:4, Informative)
Re:Where does it say that it cannot be patched? (Score:4, Informative)