Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was wondering if there are any known attacks against PEAP used in wireless authentication/authorization?

I'm specifically looking for attacks that would allow:

  • bypassing the authentication
  • session hijacking
share|improve this question
add comment

2 Answers

up vote 4 down vote accepted

From what I've seen of PEAP setups, attacks usually revolve around MITM attacks. If the client isn't set to validate the server certificates used, it may be possible to setup a fake AP and RADIUS server and persuade client to connect and authenticate to that.

From there once you've got the users creds you may be able to replay them to the valid server to get access (Depending on how authentication is done).

share|improve this answer
add comment

PEAP is actually an enterprise EAP WPA/802.11i Enterprise protocol that attempts to mitigate the "one" vulnerability with EAP - identity being sent in the clear between AP and Radius server. PEAP allows for the tunneling of this information. An implementation of this for instance is EAP-TTLS.

That said, the MiTM attack that is mentioned above is a very nasty one that can be produced by what appears on the surface as a "more secure" implementation.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.