Windows Phones open to hackers when connecting to rogue Wi-Fi
A new Microsoft security advisory warns that smartphones running the Windows Phone operating system could be susceptible to infiltration when connecting to a rogue Wi-Fi hotspot.
A rogue access point, also known as a rogue AP, is a Wi-Fi access point installed on a network, operating without authorization and not under the control of a systems administrator. If installed, rogue APs could allow anyone to connect to your network through Wi-Fi, and may not adhere to WLAN security policies.
The bulletin, advisory 2876146, says that hackers could exploit a known weakness in the Wi-Fi authentication protocol known as PEAP-MS-CHAPv2 (Protected Extensible Authentication Protocol with Microsoft Challenge Handshake Authentication Protocol version 2). The protocol is used in Windows Phones for WPA2 wireless authentication.
The tech giant says that an attacker can exploit a weakness in the protocol when the mobile device attempts to automatically authenticate with a hotspot posing as Wi-Fi. Once the attempt to connect is made -- without user permission -- a hacker can intercept the victim's encrypted domain credentials before decrypting and lifting the data.
"To exploit this issue, an attacker controlled system could pose as a known Wi-Fi access point," the advisory warns. "An attacker could then exploit cryptographic weaknesses in the PEAP-MS-CHAPv2 protocol to obtain the victim's domain credentials. Those credentials could then be re-used to authenticate the attacker to network resources, and the attacker could take any action that the user could take on that network resource."
Microsoft has not received any reports of this vulnerability being used to steal corporate data, passwords or breach a network to date. There is no security patch available for this; instead, Microsoft suggests that you enable the certificate verification process before executing the PEAP-MS-CHAPv2 protocol to connect to Wi-Fi hotspots.
The bulletin contains instructions for configuring your Windows Phone versions 7.8 or 8 to fix the security flaw. Older versions are not affected.