Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 22 Apr 2010 14:45:16 +0200
From: Ludwig Nussel <>
Subject: Check your WPA2 Enterprise setup


Recently I had to explain to a friend why turning off certificate
checks for wireless networks that use WPA2 Enterprise methods for
authentication is a bad idea. Unfortunately merely enabling some
checkbox in the UI isn't necessarily sufficient either. If the
RADIUS server uses a certificate signed by a public CA one can
easily forget to apply additional constraints (e.g. matching
subject, common name etc) to restrict acceptable certificates.
Failure to set such constraints allows anyone with a valid domain to
forge the wireless network and impersonate the RADIUS server. That
finding isn't exactly new, yet it's hardly mentioned anywhere. So
I've decided to write a paperĀ¹ about it.

I've also contacted NetworkManager upstream since NetworkManager's
certificate handling is rather limited. Using NetworkManager for
WPA2 Enterprise is basically only safe if a private CA is used.
It's planned but not a priority for them to improve the situation.

So if you are using WPA2 Enterprise better check your setup.



 (o_   Ludwig Nussel
SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.