InfoSecBulletin Cybersecurity for mankind
New Wi-Fi authentication bypass vulnerabilities were discovered in open source software. These vulnerabilities could put both enterprise and home networks at risk of attacks.
Mathy Vanhoef, a professor at the KU Leuven research university in Belgium, and Heloise Gollier, a student at KU Leuven, discovered the vulnerabilities in collaboration with VPN testing company Top10VPN. Vanhoef is well known for his research in Wi-Fi security.
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
Oracle Issues 943 Security Patches, Including Critical WebLogic Flaw
500+ critical infrastructure hit by Medusa ransomware
Critical WordPress Plugin Flaw Exposes 600,000 Sites to Attacks
New Wi-Fi authentication bypass vulnerabilities have been found in Wpa_supplicant and Intel’s iNet Wireless Daemon (IWD) software.
Wpa_supplicant supports WPA, WPA2, and WPA3. It is available on Android devices, most Linux devices, and the ChromeOS for Chromebook.
There is a vulnerability in Wpa_supplicant, known as CVE-2023-52160, that can affect people using enterprise Wi-Fi networks. This flaw allows an attacker to deceive users by creating a fake Wi-Fi network that looks like a legitimate enterprise network. Once connected, the attacker can intercept the user’s data.
“The vulnerability can be exploited against Wi-Fi clients that are not properly configured to verify the certificate of the authentication server, which unfortunately still often occurs in practice, in particular with ChromeOS, Linux, and Android devices,” the researchers wrote in a paper describing the flaws.
No interaction is needed from the user to exploit the vulnerability. The attacker just needs to be within range of the victim and know the SSID of an enterprise network that the victim has connected to before.
A security hole in IWD, tracked as CVE-2023-52161, allows access to home or small business Wi-Fi networks. Attackers can abuse the network to connect to the internet, attack other devices, intercept data, and deliver malware.
“The vulnerability allows an adversary to skip message 2 and 3 of the 4-way handshake, enabling an adversary to complete the authentication process without knowing the network’s password,” the researchers said.
