0

I just read about a post linked to from archived Michał Zalewski's archived post on wireless security and heard of an insider-only WPA2 flaw that lets anyone who knows the wireless password snoop on other people's traffic and inject their own in the middle of the communication.

I noticed that there are only 9 posts about hole196 on security.stackexchange.com and the only informative ones date back to 2012. I would expect a lot to change for the last over three years, thus the question - are there any feasible server-side solutions/workaround to the hole196 problem as of today, apart from using a VPN? If no, is there any stronger wireless encryption standard?

|improve this question
2

There are solutions already on the market provided by several vendors. These include client isolation (clients are not allowed to talk to eachother using the wireless access point as medium).

Other mitigating techniques include wireless IPS which detect MAC spoofing. MAC spoofing is nescesary when the attacker wants to trick the client in thinking he/she is the gateway.

Of course these mitigations are not part of the protocol but rather additional controls you can opt to implement.

|improve this answer
  • Thanks! Just curious, could client isolation be also enforced at client level? – d33tah Jan 25 '16 at 4:08
  • 1
    No, because how the attack works, means you, as a client, don't know who you are talking to. That's what allows the attack in the first place. – Lucas Kauffman Jan 25 '16 at 4:29
  • I see, thanks again. And could clients detect the presence of client isolation reliably? – d33tah Jan 25 '16 at 4:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.