The latest big security exploit is a mechanism by which WPA2 secured wireless networks can be compromised to disclose previously encrypted traffic in the clear, and to insert malicious traffic. The original web site announcing the vulnerability can be found here with a translation into more ordinary language here.
Although a serious vulnerability, there are several elements that make this attack somewhat harder to carry out :-
- It is a very technical attack that has not been “bundled” into a ready to use form.
- The attack involves creating a “fake” access point with the same name as the network under attack. This implies physical proximity, although with wireless networks that can be a great deal further than you imagine – an attacker able to use this vulnerability is quite likely to be more sophisticated than usual, and have access to specialist wireless equipment that can extend the range of wireless networks.
- Whilst all WPA2 networks are vulnerable, impersonating a enterprise wireless network is somewhat more complex than impersonating a personal/home wireless network. This means that the EDUROAM wireless network may be somewhat safer than your home network.
Having said that, this vulnerability is harder to fix than usual and is likely to remain around long enough that it will be regularly used. Fixing just the wireless access points isn’t sufficient; it is necessary to fix those and the client devices connecting to the network. And in many cases (IoT devices and/or older Android phones), the client devices will never be fixed.
Remediations
To prevent this attack there are a number of things you can do yourself :-
- Use a VPN. The University runs a VPN service, and any traffic that goes over the VPN is not subject to this attack. To put it another way, if you have the VPN turned on, an attacker can be busy compromising your wireless network as much as she likes, but your traffic will be safe. We recommend the use of a VPN when working whilst travelling anyway.
- Upgrade your wireless router’s firmware as soon as possible. We are. If your wireless router is supplied by your ISP, nag your ISP about an update. Otherwise check with the manufacturer for a firmware update.
- Upgrade all your client wireless devices – laptops, phones, and all those “IoT” devices that you have.
Bear in mind that advice elsewhere suggests using tethering; if you set up your phone as a mobile wireless hot-spot then you may still be vulnerable if one of the phone or the connecting device has not been updated.