WPA2 Hole 196. During the reporting period of this deliverable, one particular perceived vulnerability of the WPA2 standard hit general media coverage. It was reported that the WPA2 standard contains a hole which cannot easily be fixed. It is believed that the hole affected WPA2-Enterprise encryption in particular. For more details see the announcement from AirTight networks [HOLE196]. Since eduroam relies on Enterprise encryption and suggests the use of WPA2 as current best practice, such vulnerability affects the core operations of eduroam. JRA3 T1 monitored the situation and analysed the vulnerability following its complete disclosure at the conferences DEFCON 18 and Black Hat Arsenal (both in July 2010). The intention is to create a service advisory with possible workarounds and background information, and with possible consequences for new versions of the eduroam Service Description. It turned out that the importance and impact of the reported vulnerability was far less significant than feared at first. The core of the so-called vulnerability is that broadcast traffic in wireless LANs is sent using one single key for all authorised users (the Group Temporal Key, GTK), and that the sender address used to send the broadcast traffic is not verified. This very fact is well-known because it is documented in the IEEE 802.11i security standard on page 196. Since an attacker must have the GTK prior to launching malicious activity, the vulnerability is immediately reduced to an insider attack. The attacker needs to hold a valid eduroam account and be logged in with that account. A second important point to note is that every authenticated user in a WPA2 network must be able to send broadcast traffic and have it received by all other stations in the LAN, since broadcast is part of basic operations in any IP network. This is not at all an attack. AirTight however emphasised the fact that an attacker can send malicious broadcast traffic to conduct ARP spoofing attacks or to act as a rogue DHCP server (as explained in section 2.2.4). It is very important to note that such spoofing attacks are a general problem for any IP network; whether or not it is encrypted or wireless. The only actual point in AirTight’s disclosure is that a maliciously intended insider user who wants to conduct broadcast-traffic-based attacks can do so in complete anonymity, because he can change his sender MAC address at his discretion. In particular, he can disguise himself as being the Access Point when ...
