InfoSecBulletin Cybersecurity for mankind
New Wi-Fi authentication bypass vulnerabilities were discovered in open source software. These vulnerabilities could put both enterprise and home networks at risk of attacks.
Mathy Vanhoef, a professor at the KU Leuven research university in Belgium, and Heloise Gollier, a student at KU Leuven, discovered the vulnerabilities in collaboration with VPN testing company Top10VPN. Vanhoef is well known for his research in Wi-Fi security.
ALERT
Thousands of IP addresses compromised nationwide: CIRT warn
New Android Malware ‘Crocodilus’ Targets Banks in 8 Countries
Qualcomm Patches 3 Zero-Days Used in Targeted Android Attacks
Critical RCE Flaw Patched in Roundcube Webmail
Hacker claim Leak of Deloitte Source Code & GitHub Credentials
CISA Issued Guidance for SIEM and SOAR Implementation
Linux flaws enable password hash theft via core dumps in Ubuntu, RHEL, Fedora
Australia enacts mandatory ransomware payment reporting
Why Govt Demands Foreign CCTV Firms to Submit Source Code?
CVE-2023-39780
Botnet hacks thousands of ASUS routers
New Wi-Fi authentication bypass vulnerabilities have been found in Wpa_supplicant and Intel’s iNet Wireless Daemon (IWD) software.
Wpa_supplicant supports WPA, WPA2, and WPA3. It is available on Android devices, most Linux devices, and the ChromeOS for Chromebook.
There is a vulnerability in Wpa_supplicant, known as CVE-2023-52160, that can affect people using enterprise Wi-Fi networks. This flaw allows an attacker to deceive users by creating a fake Wi-Fi network that looks like a legitimate enterprise network. Once connected, the attacker can intercept the user’s data.
“The vulnerability can be exploited against Wi-Fi clients that are not properly configured to verify the certificate of the authentication server, which unfortunately still often occurs in practice, in particular with ChromeOS, Linux, and Android devices,” the researchers wrote in a paper describing the flaws.
No interaction is needed from the user to exploit the vulnerability. The attacker just needs to be within range of the victim and know the SSID of an enterprise network that the victim has connected to before.
A security hole in IWD, tracked as CVE-2023-52161, allows access to home or small business Wi-Fi networks. Attackers can abuse the network to connect to the internet, attack other devices, intercept data, and deliver malware.
“The vulnerability allows an adversary to skip message 2 and 3 of the 4-way handshake, enabling an adversary to complete the authentication process without knowing the network’s password,” the researchers said.
