4

I came across this question a while ago and read about hole 196.

Is there something I can install on my laptop to protect it against WPA2 Hole196?

Software (such as Snort or DecaffeintID) can be installed on some Windows and Linux laptops to detect ARP poisoning, though it's not practical to manually install software on large number of endpoints. Further, the software is not supported on most endpoints (e.g., iPhones, iPads, Blackberry, Windows Mobile, Windows 7, etc.) that will continue to be at risk from the WPA 2 Hole196 vulnerability. Besides, those softwares cannot stop a malicious insider from launching other Hole196 based attacks such as malware injection, port scanning, denial of service, etc.

My question is, technically speaking, what other things can I do to possibly cover myself?

Improve this question
1
  • 1
    I don't understand what you are talking about: which "malware injection, port scanning, denial of service, etc." techniques are related with "Hole196"? Port scanning is a legitimate non-intrusive remote examination technique of any network-connected computer. "open" vs. "closed" ports is not a secret. You just have to accept that. ARP poisoning is an Ethernet thing, it isn't specific to Wifi.
    – curiousguy
    May 14, 2012 at 15:08

3 Answers 3

Reset to default
7

Most security researchers consider "hole 196" to be more of a technical break than something that is very useful to the attacker. I think that the WPA-PSK handshake, and the lack of encryption for for management frames are far more serious threats.

Although hole 196 can be used in conjunction with these attacks. 1) de-auth a client, 2) capture the handshake when they re-auth and then brute force the challenge response 3) use hole 196 to obtain traffic

However, you can defend against hole 196 by using a VPN. The problem is that if someone else is authenticated to the wireless network then they are able to observe some of your traffic. Simple, if you use an SSL VPN to get out of the wireless network, then they won't be able to see anything useful.

Improve this answer
12
  • "Most security researchers consider "hole 196" to be more of a technical break than something that is very useful to the attacker." It isn't either things. "I think that the WPA-PSK handshake, [is] far more serious threats" If you are using PSK you cannot be worried about said "hole 196".
    – curiousguy
    May 14, 2012 at 15:52
  • @curiousguy Care to clarify that last statement? I thought Hole 196 applied to bot PSK and Enterprise implementations? So, how is it that we should not be worried about it?
    – Iszi
    May 14, 2012 at 16:26
  • 2
    @Iszi The "just break the glass" vulnerability applies to all windows, opened or closed. It is much less relevant to opened windows. If you are worried about this vuln, you don't leave your windows open either (or you shouldn't). If you leave your windows open you should rather worry about the "just go through the open window without breaking the glass". The "hole 196" applies to all variants of WPA, but I can't see its relevance to a Shared (as in shared by every Wifi client) Key set-up. If you worry about insiders you don't share the master key. That would be insane.
    – curiousguy
    May 14, 2012 at 16:44
  • 1
    @curiousguy and Rook - I think you agree on the same point. The insecurities of a WPA2-PSK handshake allows an eavesdropper to decrypt all traffic intended for another client, if they intercept the initial unencrypted nonce from the AP and also have the shared passphrase -- making it an "open window". If an insider didn't intercept the initial nonce, and has the shared passphrase they cannot decrypt all of the other users' traffic (but could do hole 196 for MITM-style attacks).
    – dr jimbob
    May 14, 2012 at 17:37
  • 1
    @drjimbob "If an insider didn't intercept the initial nonce" then all they have to do is to force dissociation.
    – curiousguy
    May 16, 2012 at 6:43
4

Some obvious, albeit general, possibilities:

  • Use a wired network instead - this avoids the vulnerability altogether
  • Encrypt your critical traffic (at the application/endpoint level, since you don't trust the network).
  • Put non-technical controls in place against malicious insiders. (e.g. background checks of employees.)
Improve this answer
6
  • 1
    @curiousguy - Wired is preferred to Wireless when mobility is not an issue. You need physical access to the actual ethernet cable/router to do any sort of eavesdropping/DOS attack. If I want to DOS a wifi connection its as simple as turning on a nearby interfering microwave oven or other source of noise in the bandwidth range. If I want to monitor whether packets are being sent (which may be useful in and of itself; indicating nearby activity) with wifi its transparent to anyone reasonably nearby who is listening.
    – dr jimbob
    May 14, 2012 at 17:03
  • @drjimbob "If I want to DOS a wifi connection its as simple as turning on a nearby interfering microwave oven" Choosing a low Wifi channel helped me with my Wifi vs. MW conflict (the 5 GHz band would help even more, I don't have such Wifi card). EOAnectode. Of course what you say is correct, and it applies to to any radio communication that is not very focussed, or uses military, unpredictable channel hoping. There is nothing special with the Wifi protocol here, it's about the physical media. Note that DSL is wired and also has similar EM noise issues.
    – curiousguy
    May 14, 2012 at 17:12
  • @curiousguy - Agree; my point is radio less secure than other physical media. But I think Iszi statements about "from security standpoint, wired preferred over wifi when mobility is not issue" was fair. Wifi makes it trivial for anyone nearby to eavesdrop or interfere and only starts to be comparable in security when you have add in strong encryption layers implemented in a secure method (which is non-trivial to do as seen from flaws in WEP/WPA/WPA2). Granted eavesdropping on a wired connection is possible as well, but requires getting to the actual cabling/routers and altering somehow.
    – dr jimbob
    May 14, 2012 at 17:56
  • @drjimbob "Wifi makes it trivial for anyone nearby to eavesdrop or interfere" Obviously, "open" (cleartext) Wifi is trivial to attack for anyone in range. "and only starts to be comparable in security" Which "security" properties? As you said, encrypted Wifi is still detectable and can easily be jammed (and some people even say it gives you cancer!). It all depends on the security properties you need. I am happy to let my neighbours know I use Wifi, and they never tried to jam my signal (my MW oven tried to jam my Wifi, but then changed channels).
    – curiousguy
    May 14, 2012 at 20:18
  • This is getting repetitive. I think the original statement was fair; when you don't care about mobility and everything else being equal its much safer to go with a ethernet cable (also can be much faster). Most wifi setups do not use RADIUS authentication servers, instead opting for (often-weak) pre-shared keys that allow eavesdropping by others which most modern networks with a star based topology would not allow (unless you control/attack the router; though these attacks similarly could be done on even if the first hop is through a wifi router).
    – dr jimbob
    May 14, 2012 at 22:08
0

From http://www.airtightnetworks.com/WPA2-Hole196 :

WPA2 Hole196 Vulnerability - FAQs

Then in what way can an insider exploit the Hole196 vulnerability?

(...) the attacker can decrypt the traffic (including login credentials, emails and other sensitive data).

This is a big joke, am I correct?

I mean, you fear internal attack, and don't at least encrypt login credentials???

This story is a PR stunt.

Improve this answer
3
  • 2
    Please explain the downvote.
    – curiousguy
    May 14, 2012 at 16:47
  • 2
    Didn't down vote this and agree login credentials should be encrypted (e.g., https connection). But this allows a MITM attack; where you can trick a less-savvy, non-careful user to go to an attacker-controlled http site (that's otherwise similar to the real site) rather than an https site whether the login credentials are not encrypted and are intercepted.
    – dr jimbob
    May 14, 2012 at 16:56
  • @drjimbob Indeed. You should always go directly to the https URL. You should bookmark this URL, not the HTTP URL. The HTTP URL should immediately redirect to the HTTPS URL, so people don't have a chance to bookmark it. You can also define as HTTPS-only with a header whose spelling I forgot. Anyway I do not think that the Web browser should be used for anything really sensitive unless it is totally castrated to only be able to access a few trusted servers.
    – curiousguy
    May 14, 2012 at 17:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .