Hole 196: WPA2 vulnerability discovered by Indian security researcher

Hole 196: WPA2 vulnerability discovered by Indian security researcher

Hole 196 refers to the page 196 of the 802.11 standard, which specifies the statement that is the basis for this attack, which I will explain to you later in the post.

This vulnerability can let a malicious insider to decrypt traffic originating from other wireless devices on-the-fly. The upside of this attack, from a security point if view, is that the attacker has to first successfully authenticate with the access point. The downside, that means large organizations using WPA2 in trouble – as generally most damage comes from the inside. Md Sohail Ahmad is earlier known to have introduced the Cafe Latte attack along with our very own Vivek Ramachandran which they presented at ToorCon. Md Sohail Ahmad is going to demo the exploit at 2 upcoming conferences (Black Hat and DEF CON 18) so I’ll be looking out for the slides and videos on that.

WPA2 uses two types of keys: 1) Pairwise Transient Key (PTK), which is unique to each client, for protecting unicast traffic; and 2) Group Temporal Key (GTK) to protect broadcast data sent to multiple clients in a network. PTKs can detect address spoofing and data forgery. “GTKs do not have this property,” according to page 196 of the IEEE 802.11 standard. These six words comprise the loophole, Ahmad says.

FOR FULL STORY CLICK HERE