Short paper: exploiting WPA2-enterprise vendor implementation weaknesses through challenge response oracles

Abstract

Many of today's enterprise-scale wireless networks are protected by the WPA2-Enterprise Protected Extensible Authentication Protocol (PEAP). In this paper it is demonstrated how an attacker can steal a user's credentials and gain unauthorized access to such networks, by utilizing a class of vulnerable devices as MSCHAPv2 challenge response oracles. More specifically this paper explains how on these devices, Lightweight EAP (LEAP) MSCHAPv1 credentials can be captured and converted to PEAP MSCHAPv2 credentials by using a rogue Access Point. This man-in-the-middle vulnerability was found to be present in all current versions of Apple's iOS and OS X operating systems, and may impact other devices as well. A proof-of-concept implementation is available that shows how Authentication Server certificate validation and certificate pinning mechanisms may be bypassed. Mitigation strategies for the attack and protective actions which can be undertaken by end-users are also described in this paper.