Microsoft has warned Windows Phone users of a security weakness in a Wi-Fi authentication protocol that, ironically, was designed to make Wi-Fi more secure.
In an Aug. 4 security advisory, the company said this known vulnerability could let attackers obtain, decrypt and reuse the domain credentials of a handset running Windows Phone 7.8 or 8, but only if the phone uses a specific authentication method: PEAP-MS-CHAPv2, for Wi-Fi Protected Access 2 (WPA2) wireless authentication.
From July 2012: Tools released at Defcon can crack widely used PPTP encryption in under a day
Follow our continuing coverage of this year's DefCon in Las Vegas:
Malware-as-a-service blossoms in Russia, vendor research finds
Android one-click Google authentication method puts users, businesses at risk
Researchers reveal methods behind car hack at Defcon
The full name of the method, which combines two protocols, is Protected Extensible Authentication Protocol with Microsoft Challenge Handshake Authentication Protocol version 2. It's apparently the Microsoft protocol that is the source of the vulnerability. The alert says that "Microsoft is not currently aware of active attacks or of customer impact at this time. Microsoft is actively monitoring this situation to keep customers informed and to provide customer guidance as necessary."
It's unclear how widely used MS-CHAPv2 is among Windows Phone users in particular, or among enterprise deployments in general. It was introduced by Microsoft in Windows NT 4.0 Service Pack 4. It has been widely used as the main authentication method for many of today's PPTP virtual private network (VPN) clients.
Though its weaknesses have been known in the security community since 1999, they were decisively exposed a year ago at DefCon 2012. David Hulton and Moxie Marlinspike together demonstrated and released two tools that could reduce the handshake's security to a single DES (Data Encryption Standard) key, and then crack it in less than a day via CloudCracker.com -- a commercial online password cracking service. Marlinspike posted his detailed analysis at that site.
According to the latest Microsoft alert, to exploit this vulnerability in Windows Phone devices, the attacker impersonates a known Wi-Fi access point. A victim handset automatically tries to authenticate to this fake. The attacker intercepts the victim's encrypted domain credentials. Then, he exploits the cryptographic weakness in MS-CHAPv2 to decrypt the credentials. After that, the attacker impersonates the victim, re-using the valid credentials to authenticate himself to network resources. Once cleared, the attacker has that victim's full set of on-network privileges.
There are two actions to counter this weakness, according to Microsoft, but one of them is to shut off the Wi-Fi radio in the phone.
The other is to configure a Windows Phone 8 device to require a certificate that verifies the Wi-Fi access point making sure the access point is a legitimate one and not a phony - before launching the authentication process between access point and phone. To do that, the IT group creates a "root certificate" used to verify the access point, and emails it to all users.
Then it's up to the user to walk through the next steps:
+ Delete the previously configured Wi-Fi connection
+ In "Settings, Wi-Fi," tap "Advanced"
+ Tap and hold over the selected Wi-Fi network, and choose delete
+ Create a new connection and enable server certificate validation
+ In Wi-Fi settings, tap on the enterprise Wi-Fi network access point which will open a Sign-in page
+ Enter username and password; toggle "Validate Server Certificate" to On; tap to choose a certificate; in the list of certificates to select, pick the root certificate issued from Corporate IT (for example, "Contoso Corporate Root Certificate"), and tap Done
John Cox covers wireless networking and mobile computing for Network World.Twitter: http://twitter.com/johnwcoxnwwEmail: john_cox@nww.com
Read more about anti-malware in Network World's Anti-malware section.
