Please use this identifier to cite or link to this item:
Title: Short paper: exploiting WPA2-enterprise vendor implementation weaknesses through challenge response oracles
Authors: ROBYNS, Pieter 
BONNE, Bram 
QUAX, Peter 
Issue Date: 2014
Publisher: ACM
Source: WiSec '14 Proceedings of the 2014 ACM conference on Security and privacy in wireless & mobile networks, p. 189-194
Abstract: Many of today's enterprise-scale wireless networks are protected by the WPA2-Enterprise Protected Extensible Authentication Protocol (PEAP). In this paper it is demonstrated how an attacker can steal a user's credentials and gain unauthorized access to such networks, by utilizing a class of vulnerable devices as MSCHAPv2 challenge response oracles. More specifically this paper explains how on these devices, Lightweight EAP (LEAP) MSCHAPv1 credentials can be captured and converted to PEAP MSCHAPv2 credentials by using a rogue Access Point. This man-in-the-middle vulnerability was found to be present in all current versions of Apple's iOS and OS X operating systems, and may impact other devices as well. A proof-of-concept implementation is available that shows how Authentication Server certificate validation and certificate pinning mechanisms may be bypassed. Mitigation strategies for the attack and protective actions which can be undertaken by end-users are also described in this paper.
Keywords: Network security; WPA2-Enterprise; PEAP; LEAP
Document URI:
ISBN: 9781450329729
DOI: 10.1145/2627393.2627411
Rights: Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from
Category: C1
Type: Proceedings Paper
Validations: vabb 2018
Appears in Collections:Research publications

Files in This Item:
File Description SizeFormat 
p189-robyns.pdfExploiting WPA2-Enterprise Vendor544.64 kBAdobe PDFView/Open
Show full item record


checked on Sep 2, 2020

Page view(s)

checked on May 18, 2022


checked on May 18, 2022

Google ScholarTM



Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.