0

Most Wi-Fi security is focussed on blocking authorised access to the network providing a wireless access point; but considering the smorgasbord of background app-to-cloud communication on a mobile phone, connecting to verified Wi-Fi access points is as least as important as SSL/TLS website verification.

How, if at all, are Wi-Fi access points verified? Is any of this verification implicit to the Wi-Fi standard?

1

2 Answers 2

3

Simply put, unless you're talking about WPA2-Enterprise with EAP, there's no verification. Wifi networks are identified by SSID alone, so if you rename your home wifi network to "attwifi" and remove the password, chances are you'll get quite a few strangers' devices automatically connecting to it. This would be called a rogue access point.

Of course, if the app-to-cloud communication is encrypted (with SSL/TLS), then it really wouldn't matter if the app sends information through a rogue access point. It's the unencrypted communication that would pose a security risk.

Edit:
I believe recent developments have potentially made it possible to authenticate hotspots using EAP-TLS, though I'm not very familiar with how exactly this procedure works, so perhaps someone else can elaborate. I did find the following on Wikipedia:

On 22 August 2012 hostapd (and wpa_supplicant) added support in its Git repository for an UNAUTH-TLS vendor-specific EAP type (using the hostapd/wpa_supplicant project RFC 5612 Private Enterprise Number),[7] and on 25 February 2014 added support for the WFA-UNAUTH-TLS vendor-specific EAP type (using the Wi-Fi Alliance Private Enterprise Number),[8][9] which only do server authentication. This would allow for situations much like HTTPS, where a wireless hotspot allows free access and does not authenticate station clients but station clients wish to use encryption (IEEE 802.11i-2004 i.e. WPA2) and potentially authenticate the wireless hotspot. There have also been proposals to use IEEE 802.11u for access points to signal that they allow EAP-TLS using only server-side authentication, using the standard EAP-TLS IETF type instead of a vendor-specific EAP type.[10]

Source

3
  • Could you elaborate upon "unless you're talking about WPA2-Enterprise with EAP"? Couldn't an attacker easily fake a WPA2-Enterprise secured access point which accepts any login?
    – Michael
    Oct 13, 2014 at 6:34
  • @Michael see my edit
    – tlng05
    Oct 13, 2014 at 20:15
  • Thanks, however the Wikipedia article does not explain things very clearly to me. I posted a new question, specifically about the EAP-TLS protocol: security.stackexchange.com/questions/70625/…
    – Michael
    Oct 14, 2014 at 6:54
1

There is absolutely no way to verify an AP out in the wild. Like user54791 said, you only see the SSID, and there are no built-in safeguards in the AP nor smartphones that can guarantee that the AP you want to connect to is actually the correct one. This is exactly why I do not trust ANY wifi, free or not. And as a matter of fact, its the "paid" wifi you should really be concerned about. Are you willing to give your credit card info just because it looks official? I hope not. Connecting to an AP is simply connecting to the internet, that simple! The only difference is that you trust connecting to your home AP, but after that, even a MITM attack can happen to your connection!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .