3

I just watched this video https://www.offensive-security.com/penetration-testing/hacking-wpa-enterprise-with-kali-linux/ and the authors readily admit that the title is click-bait but I am still wondering what is going on.

Shouldn't there be a certificate warning on the phone? (Edit: This may indeed not have anything to do with the protocol and be just a client issue. There could however have been some other problem that allows them to fake a valid certificate.)

Why is the password so easily retrieved from the challenge response messages? (Has that been fixed in WPA2?)

2 Answers 2

1

Shouldn't there be a certificate warning on the phone?

There should be a warning but this depends on the client side implementation.

For example in europe there is a academia wide wireless network called eduroam which is available at almost every university. Eduroam is utilizing WPA2 Enterprise and email + password as credentials. Some month ago the local universitys IT department announced that eduroam should not be used from smartphones because some of them don't do the certificate validation properly/at all which makes them vulnerable to attacks like the one you referenced.

1
  • One can still use smartphone if cert is installed
    – Aria
    Dec 1, 2016 at 11:17
0

Are there any exploitable protocol flaws in WPA Enterprise?

is a question orthogonal to

Shouldn't there be a certificate warning on the phone?

because a protocol can't actually force a client to warn a user if the certificate isn't verifiable.

So, protocol-wise, I'm not aware of any current flaws.

Why is the password so easily retrieved from the challenge response messages?

Because it needs to be – it's what the AP normally sends to the authenticator service to get back auth.

1
  • I think the challenge should be sent by the authenticator service and the response should only be passed back as well, no? Dec 1, 2016 at 11:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .