At Ars Technica, you can read my long explanation of the group key weakness in WPA/WPA2 Enterprise-protected networks: The information I was given was originally under embargo, but the firm and unrelated researchers released essentially all the data except a video of an exploit in action and some of the mitigation information. Hence, the long Ars Technica piece.
Boiled down, I don't think anyone need worry about Hole196, which describes how an insider with an account on a WPA/WPA2 Enterprise network can send group broadcast packets spoofed to appear as if they originate from the access point for clients attached to that access point.
It's a hole, all right, but it requires so many particular circumstances to be met, that a spy or thief working for a company (or an outsider having gained credentialed access) would most likely have easier methods to get in--or would be detected by other means.
The best lesson I can take away from this hole? Make sure you're running virtual SSIDs if you have that option to separate guests, contractors, and others from employees; or to isolate different kinds of operations within your company.
Because each virtual SSID on an access point is treated nearly as a virtual AP, the group key isn't shared across the access point among different virtual SSID. The BSSID, or AP identifer, is unique for each virtual network on each AP.
Leave a comment