www.uhasselt.be
DSpace

Document Server@UHasselt >
Research >
Research publications >

Please use this identifier to cite or link to this item: http://hdl.handle.net/1942/17013

Title: Short paper: exploiting WPA2-enterprise vendor implementation weaknesses through challenge response oracles
Authors: ROBYNS, Pieter
BONNE, Bram
QUAX, Peter
LAMOTTE, Wim
Issue Date: 2014
Publisher: ACM
Citation: WiSec '14 Proceedings of the 2014 ACM conference on Security and privacy in wireless & mobile networks, p. 189-194
Abstract: Many of today's enterprise-scale wireless networks are protected by the WPA2-Enterprise Protected Extensible Authentication Protocol (PEAP). In this paper it is demonstrated how an attacker can steal a user's credentials and gain unauthorized access to such networks, by utilizing a class of vulnerable devices as MSCHAPv2 challenge response oracles. More specifically this paper explains how on these devices, Lightweight EAP (LEAP) MSCHAPv1 credentials can be captured and converted to PEAP MSCHAPv2 credentials by using a rogue Access Point. This man-in-the-middle vulnerability was found to be present in all current versions of Apple's iOS and OS X operating systems, and may impact other devices as well. A proof-of-concept implementation is available that shows how Authentication Server certificate validation and certificate pinning mechanisms may be bypassed. Mitigation strategies for the attack and protective actions which can be undertaken by end-users are also described in this paper.
URI: http://hdl.handle.net/1942/17013
DOI: 10.1145/2627393.2627411
ISBN: 9781450329729
Category: C1
Type: Proceedings Paper
Validation: vabb, 2018
Appears in Collections: Research publications

Files in This Item:

Description SizeFormat
Exploiting WPA2-Enterprise Vendor544.64 kBAdobe PDF

Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.