Researcher Hints 802.1X WPA2 Flaw

AirTight Networks' researcher Md Sohail Ahmad will present a WPA2/802.1X weakness at DEFCON18 next week: The press release from AirTight doesn't give away too many details, but I believe this an 802.1X problem because it requires an authenticated user on a network that has unique master key material for multiple users. Hence, 802.1X, where WPA2 is used to secure the connection, and a user login causes a master key to be generated.

My suspicion is that there's a weakness in broadcast key implementation, since that's a natural place. That's confirmed by the name the researcher has given the weakness: "Hole 196," which the press release says refers to page 196 of the revised IEEE 802.11-2007 specification.

The note at the bottom, in a section on Robust Security Network Association (RSNA) used for the 4-way handshake for authentication dealing with the group temporal key (used to protect broadcast and multicast data), reads:

"NOTE—Pairwise key support with TKIP or CCMP allows a receiving STA to detect MAC address spoofing and data forgery. The RSNA architecture binds the transmit and receive addresses to the pairwise key. If an attacker creates an MPDU with the spoofed TA, then the decapsulation procedure at the receiver will generate an error. GTKs do not have this property."

This could be a serious exploit for corporations, government, and academic institutions that use 802.1X, and rely on the intra-network security of having one user unable to sniff the traffic of any other user. This is not a generic WPA2 or AES-CCMP key extraction exploit; I'm not sure any key recovery is involved at all.

Class-Action Suit against Google Has Gaping Hole