Encrypted Wi-Fi Vulnerable Despite AES Encryption and 802.1x Authentication
Mountain View, Calif. - July 22, 2010 -- AirTight Networks, the leading provider of wireless intrusion prevention systems and services (WIPS) announced today that senior wireless security researcher, Md Sohail Ahmad has uncovered. just how easy it is to hack into an encrypted wireless network without breaking the encryption key. A documented, yet little known, vulnerability of the Wi-Fi WPA2 security protocol, which AirTight has named 'Hole 196', exposes secured wireless networks to a key "loophole" that allows authorized users to bypass private key encryption and authentication. AirTight researcher, Md. Sohail Ahmad, will be demonstrating this vulnerability at the Black Hat Arsenal and at DEFCON18 in a presentation entitled "WPA Too?!" in Las Vegas on July 29th and July 31th respectively.
Additional information on Ahmad's presentation is available at http://www.airtightnetworks.com/WPA2-Hole196 and AirTight will present a public Webinar after the conferences on August 4 to detail its findings. Those wishing to register for the Webinar, may do so on that page.
While AirTight's findings indicate that this vulnerability is only exploitable by an authorized user of the wireless network, insider threats continue to be the biggest challenge to IT and source of loss to the business. In the January 2010 Cybersecurity Watch Survey by CERT, CSO and Deloitte noted, "51% of respondents who experienced a cyber security event were still victims of an insider attack," even though most of the top 15 security policies were aimed at preventing insider attacks. Additionally, the report said that "Insider incidents are more costly than external breaches," which makes this vulnerability even more concerning.
"This important vulnerability is in fact buried on the last line of page 196 of the IEEE 802.11 Revised Standard published in 2007," said Pravin Bhagwat, CTO of AirTight. "That's the reason we gave the vulnerability the moniker 'Hole196'."
"Unlike the TJX breach where data was stolen over unsecured Wi-Fi, this finding is concerning because organizations are relying on WPA2 for its strong encryption and authentication. Since there is no fallback in the 802.11 standard to address this hole, AirTight felt it was important to raise awareness around it," added Bhagwat. "As any security best practice you need a layered approach because one size does not fit all.
How "Hole196" Works
Unlike the WPA-TKIP vulnerability (announced in November 2008) that was largely of theoretical interest, the "Hole 196" vulnerability can be practically exploited using existing open source software as the basis. And the footprint of such insider attacks is limited to the air, making them among the stealthiest of insider attacks known requiring no key cracking and no brute force! The only way to detect this is by monitoring traffic over the air.
