Date: Thu, 22 Apr 2010 14:45:16 +0200 From: Ludwig Nussel <ludwig.nussel@...e.de> To: oss-security@...ts.openwall.com Subject: Check your WPA2 Enterprise setup Hi, Recently I had to explain to a friend why turning off certificate checks for wireless networks that use WPA2 Enterprise methods for authentication is a bad idea. Unfortunately merely enabling some checkbox in the UI isn't necessarily sufficient either. If the RADIUS server uses a certificate signed by a public CA one can easily forget to apply additional constraints (e.g. matching subject, common name etc) to restrict acceptable certificates. Failure to set such constraints allows anyone with a valid domain to forge the wireless network and impersonate the RADIUS server. That finding isn't exactly new, yet it's hardly mentioned anywhere. So I've decided to write a paper¹ about it. I've also contacted NetworkManager upstream since NetworkManager's certificate handling is rather limited. Using NetworkManager for WPA2 Enterprise is basically only safe if a private CA is used. It's planned but not a priority for them to improve the situation. So if you are using WPA2 Enterprise better check your setup. cu Ludwig  http://www.suse.de/~lnussel/The_Evil_Twin_problem_with_WPA2-Enterprise_v1.1.pdf -- (o_ Ludwig Nussel //\ V_/_ http://www.suse.de/ SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.