Windows Wireless Networking Flaw Identified

An anonymous reader writes "Washingtonpost.com is reporting from the 2nd annual Shmoocon hacker conference about the release of a previously undocumented vulnerability in Windows. The flaw takes advantage of a feature on Windows laptops that have wireless cards built-in. Security researcher Mark Loveless found that Windows laptops which cannot find a wireless connection are configured to broadcast the name of the last SSID they associated with. They assign themselves an ad-hoc 'link local' (think 169.254.x.x.) address, and an attacker can configure his machine to broadcast an SSID of the same name. Thus, the attacker associates with that 'network' and communicates directly with the victim's machine. The funny part from the Post blog entry is that Microsoft helped author the RFC for link local."

Class Action Lawsuite

Are there ever class action lawsuites filed over large scale vunerabilities like this?

Re:Class Action Lawsuite

Ever read the EULA? You hold microsoft not responsible by agreeing. So the answer would be no, no class action suits.

I wonder...

I wonder how many "undocumented" flaws made into US-CERT vul. list.

That's cool

I think I will go test this out on my parents...

Damn!!!!

There goes my mobile botnet...

Should be standard on all laptops and desktops

Also, many laptops have a button you can push that disables the built-in wireless feature until you hit that button again. Turning off the wireless connection when you are not using it also prevents this from being a problem.

Best advice in the article...

Re:Should be standard on all laptops and desktops

I hope he's not referring to the power button.

Re:Should be standard on all laptops and desktops

This isn't really good advice in my opinion; if your computer's security is ready for the 21st century it won't be a problem at all. The only reasons this may be a vulnerability you should care about are:

• You are not running a firewall
• Your firewall doesn't block access to unsecured services
• Your firewall makes exceptions solely based on IP subnets

The no firewall design is great if your computer is on a secured wired network that uses IPv4 networking. However, secured networks should be defined as having:

• No unsecured wireless access points
• No WEP secured wireless access points
• No internet-accessable computers
• No internet-exposed computers that may contract any form of malware
• A system that ensures that computers may only be used by the intended user
• No possibility of a disgruntled workers or pranksters

This effectively means that you should treat your local area network as you treat your internet connection unless you are only working on your personal home network consisting only of computers behind a network address translator, and exposing no services to the internet. With the coming of IPv6 network address translation should become less popular, and this method of securing your computers will become even more dangerous.
Run a properly configured firewall on all your computers. Do not use services that do not require authentication or base their authentication off of IP subnets.

Dont panic

FTA
First of all, if you are running any kind of network firewall -- including the firewall that comes built in to Windows XP -- you won't have to worry about some stranger connecting to your laptop. In fact, I had to shut down my firewall for both of us to successfully conduct our test.

its one of those "if you have no firewall and ignore all the alerts and warnings and have filesharing enabled and have a wifi card set to auto DHCP and an attacker is targeting you specifically" flaws

yawn, seems like much ado over nothing, you have more chance dropping and breaking your laptop than you have of being exploited by this "flaw" and if you goto Starbucks (and support their disgusting business model) you deserve everything you get

Encryption?

What if the laptop's last SSID required WEP or WPA (and has it configured in a profile)? Will it still connect if _less_ security is required?

Security?

Does anyone actually secure their wireless network? I actually have the problem that, on startup, my computer connects to my neighbour's wireless network instead of my own!

Re:Security?

No they don't. True story:

I bought a new wireless card for Christmas. I was working on getting the madwifi stuff working in Debian and I decided not to set up my AP until I had my wireless card working. Besides, I'm a n00b to wireless under linux so I wanted to take appropriate precauitons.

I got the card working, and iwlist brought up two APs in my neighborhood. One name "simpsons" and one name "zr45ytg" or something similar with WEP enabled. Not being 1337, I left the WEP one alone (for now) and decided to hop onto simpsons. As you can probably guess, I was given a private IP and internet access. A quick nmap showed two Windows machines connected, using smbclient I found an open printer share.

Digging farther, I tried to log into the AP itself. Linksys WRT54G with, you guessed it, defult passwords. Oh, let the fun begin! I changed his SSID to "0wn3d" and sent the relevant sections of the Linksys WRT54G manual to his printer. This guy now should know how to set up WEP and change his admin password. He should also notice that his SSID changed.

One week later, still broadcasting an SSID of 0wn3d, no WEP, and default admin password. Either he didn't get the message or he's illiterate. Oh well, free internet for me!

Re:Security?

And suppose he doesn't want to have to worry about securing his wireless network if all he uses it for is checking the news on his laptop? Little scroats like you who think it's helpful to mess around with other people's equipment should be shot.

If you're capable of doing that, why didn't you just print off something telling him his network was unsecure, include your phone number and offer to go over and sort it out for him? Let me guess, you're about 13 years old?

I'm unfortunate enough to have one of those WRT54G access points, and due to a hardware flaw I can't run it with WEP *OR* WMA *OR* MAC filtering. I need to get a replacement, but right now I don't have the time to sort it out. So it's unsecured (but I did change the admin password.)

What you need to do is try to help other people, rather than lord it over them. This is why anyone that works in IT is treated like shit, because end users assume we hate them and won't do anything to help.

Get a life, and to hell with my karma.

RTFA - Nothing to See . . . Move Along

O.K. Folks, if you program your Linux laptop to connect to an ad-hoc network and broadcast SSIDs, this behaviour is going to occur on Linux too.

This isn't just an MS Windows flaw . . . it is a flaw in the way that the administrators (users) manage the machines.

I wish you all would quit pointing fingers. This isn't some kind of new thing.

Re:RTFA - Nothing to See . . . Move Along

The point is that you would have to program your Linux machine to behave like this whereas the Windows machine comes configured this way by default.

What?! NO!

Another Networking Flaw? Dam, i mean the first 74 were completely predictable, but i have to say this one caught me completely off guard. You win this round malicious hackers *shakes fist into air*.

I'm sorry, this is old info

This is old info and has been known for a while. Anyone having used Kismet or some other sniffer at a public place has see this.

String quartet?

Loveless then created an ad hoc network with the same name, and told his computer to go ahead and connect to "hackme." Viola!

Violin! Cello!

Seriously, though, TFA doesn't seem to say quite the same thing as the summary. The demonstration the reporter saw involved him setting up an ad-hoc network, and then the security researcher was able to connect to it. Err... that's how it's supposed to work.

The article then goes on to assume that this will happen when you connect to access points and then leave them, but you don't usually set up an ad hoc network for that process. Has he just got something wrong? Missed a step out or something? Is there a URL for a technical level article on this flaw?

Should you at a later date happen to open up your laptop in the vicinity of another Windows user who also had recently gotten online at Starbucks, those two machines may connect to each other without any obvious notification to either user

You mean other than the big speech bubble thing popping up and saying "Wireless Network Connection now connected to T-MOBILE"?

Useless functionality..

This is a common security problem: useless or rarely used functionality. As I've said before, functionality sells whereas security doesn't. Spend a million dollars on functionality and you (hopefully) get a product that can sell for more money. Spend a million dollars on security and you have almost nothing tangiable to show for it.

Before this article, I didn't even know that "link local" thing existed. I guessing that this is probably quite representive of the Slashdot crew. The question is, then, is why on earth is it on by default and why is it even there in the first place?

This is not just a Microsoft issue, this is an issue that applies to nearly every computing project. I was recently playing with Knoppix and two things struck me:

1. Holy shit, out of the box you can actually do real work with this software.
2. Holy shit, I have three different products that do exactly the same thing. That's a lot of surface area for attack.

My parents got a new HP computer a month or so ago and I've just gotten round to doing a proper security shake-down on the XP box. I was surprised to find the Python runtime on the computer. Most of you would say, so what? Or perhaps, even applaud HP for doing this. From a security perspective, I think it's downright silly. What possible use could my parents have for the Python runtime? Absoutely none. They'll be running Open Office, Gmail and Itunes to the cows come home so all this does is opens another vector for attack. Don't install stuff on computers that your customers will likely never need.

Of all the pieces of software out there at the moment, Windows XP is the most frustrating. In terms of security, XP should completly out-class Linux/Unix in every metric of measurement. Instead, it's the most disease ridden piece of shit ever concieved by humanity. It's a shame because it could have set a really high standard for everybody in the industry but through a choice of poor defaults they condemed their own product to be a liability to CTOs everywhere. If they'd had some sense, they would have choosen defaults like this:

1. This is an obvious one: Users should not run as administrator by default.
2. Software Restriction Policies should be on by default - in both XP Pro and XP Home
   • Everywhere should be marked "No-Execute" except for C:\Program Files and C:\Windows.
3. The user should only be able to write to their user directory structure by default. Everywhere else should be read-only.
4. The Windows Scripting Host should not be install by default.
5. ActiveX should be off by default in IE.

I haven't got any figures on how many viruses/malware this configuration would stop but I imagine it's somewhere in the region of 99%. If Microsoft had taken the time to consider the platform in a more paranoid sense they could have produced a product of barn-storming quality. Instead, they listened to the marketing people and we all know what result that lead to.

Simon

Re:Useless functionality..

If ActiveX was off by default, how would people use Windows Update?

Simple! Change Windows Update! Why should Windows Update be a web-application anyway? Actually, It's damn scarey that it's a web-application. Doesn't it strike you as odd that a web-application can so throughly inspect your system to determine your patch-level on a whole host of products?

There is no excuse for ActiveX being on by default and the proof of Microsoft's commitment to security will come with the launch of Internet Explorer 7. If it's still on by default in their latest version then we know their grand security initiative was nothing but hot air.

Simon

Connecting to a network is a vulnerability now?

I mean, I know windows security is bad, but is it really considered a compromise to simply be on the same network as the attacker's machine?

Ad-hoc networks vs link-local

It seems like there are two different issues in play here. The RFC referenced in the article [faqs.org] talks about link-local addressing, which is simply a way to assign an address in the 169.254/16 subnet if no DHCP server is found. It is not wireless-specific at all.

What we have here is that, in addition to doing this, Windows is also offering to set up an ad-hoc (i.e. computer-to-computer) network on the link-local subnet with the same SSID as that of the last network the laptop connected to. I wonder what the rationale for doing this could have been. It seems to me that a machine should not offer to set up an ad-hoc network unless specifically directed to do so by the user. When such a network is set up then it is appropriate to use link-local addressing to auto-configure the interface.

large violins

Viola! His machine was assigned a different 169.254.x.x address...

Good to see that technology journalists are so enthusiastic about orchestra instruments.

Err...vulnerability?

I would hardly call this a vulnerability. You're certainly no more vulnerable if someone exploits this little "feature" than you are at any other time you're
connected to a network.

This is such a complete non-issue, it's like a freaking joke. Read the article - all a hacker might gain some this vulnerability is the ability to connect to your computer, as if it was still on a wireless network, after you've moved outside the range of an access point. Big deal. But the author and "discoverer" both talk about it like this is a remote root exploit or something. At one point, the author includes this little gem: "As Loveless pointed out, this "feature" of Windows actually behaves somewhat like a virus." Virus, my ass.

What's with all the foaming-at-the-mouth hype about these minor little things lately? It's counterproductive - going beserk over every slight issue that might, in some fantastic combination of circumstances be a security problem, takes away attention from flaws that actually matter.

Mostly annoying for network admins

This explains why we get a lot of laptops broadcasting our AP names on campus. What makes it annoying is that XP defaults to connect to the first available network it finds with the name you have given it. You can check off a box that says something to the effect of "ignore ad-hoc networks" but how many users do you know that would have any idea that is the reason their wireless card "isn't working"?

Not reall that funny

"The funny part from the Post blog entry is that Microsoft helped author the RFC for link local."

I really don't see how MS helping to author a usefull RFC is funny, or even relevant. What's funny is that someone at MS somehow thought it would be a good idea to open up a system to the entire world, since its clearly a thinking flaw as opposed to the usual QA flaw.

Speaking of thinking flaws, how about this one: If a laptop running XP has a wired and wireless connections going, XP asks the user if they want to share their connection. User clicks 'yes'. XP bridges wired and wireless for them. XP also broadcasts on both sides that it will be a gateway for other systems running XP (via netbios-over-ip, IIRC). Those systems get on board, and make that computer their default gateway.

Then the computer 'sharing' its connection, and all its 'victims' are suddenly very slow. There never seemed to be a straightforward way to prevent the other XP computers from making the dual-connected XP system their default gateway. If you manually change the default gateway on the victim systems, they just switch back to the dual-connected XP box. I don't know if XP still does this, but talk about stupid.

Seriously, who the hell thinks this kind of thing up? Do they have brain stem storming sessions or something?

Please just look and leave!

I have to agree that it would be easier to steal my whole laptop and probaly more profitable. My only concern if you break into my laptop, either via networking stupidity on my account or that you are really talented, is that please just copy what ever usless porn or emulators you want. But dont destroy anything!!! I dont keep sensetive material on my portable systems. So who cares!

HELP! NIC works as intenden1?!!?!?!!?

Oh noes! If my network interface is up you can send me packets that I have to accept or reject?1!!?!? HWATEVER SHALL I DO PLEASE HELPE ME

i have heard of an even worse vulnerabelity! if you hack yuor micthorwave oven to have teh door open it will JAM MY 80211 packets!!?!!?!!?!?!?!!?!

Also risk of cooking!

tell steve gibson of GRC he will save us

Proves Nothing! Seriously

Like someone mentioned before, the actual demonstration invovled somthign that appears as legit as it should be. Someone set up a ad-hoc network, it worked. The third person supposedly trying to join the 'hackme' network could have obviously detected the ssid if it was boradcast, and seing an unsecured network would have just tried to join in. nothing to see here dammit. Has anyone demonstrated that windows starts an ad-hoc network, unless specifically set up by the user? this looks, worst case (also not demonstrated i think), more like a case of if someone sets up an ad-hoc network for some reason, and does not disable it, he next time it will still be there. I could be wrong, but the article albeit detailed is not particularly convincing.

And an attacker on my ad-hoc...

is any more of a threat than one on an Infrastructure?

Packets are packets. This article should have been titled, "DANGER: WiFi at Hotels and Starbucks are safe, ad-hocs are not." ...Unless you've configged your laptop to always assume it will be constrained behind a NAT, exposed to a subnet of trusted hosts only. Yeah, right.

Undocumented != unknown

Anyone who has worked with a decent wireless scanning tool has probably seen this. We saw it while using Airmagnet Surveyor to baseline a site. We kept seeing an SSID being broadcast even though we were in a location where nothing could have been in range and there weren't any detectable wireless devices on site. It turned out to be our own laptops broadcasting the SSID from the hotel we were staying at.

Is this really that big of a flaw?

In the end, the "victims" computer is simply connected on a network with the attacker. That is all. It's the same vulnerability as if you're on a normal network. This time, you just don't realize that you're on a network.

If you're running windows firewall, I think you'll be all right. Unless you have other security problems already, this won't hurt you at all.

Not news

This is no news. Just because it is done by a local network doesn't make it interesting. For instance, the same thing can be done with devices seeking an access point. If you don't know this already, be informed that 'regular' PCs can be used as an access point with the proper drivers and OS. The Fake AP problem really hasn't been exploited to the extent it could be. As far as I know -- maybe in some places, it has.

This is an old vulneribility

The Wireless Zero Configuration service (WZC) Ad-Hoc vulneribility is a very old one. I knew about this for a long time before this article came out. There is also a vulneribility that will allow you to acquire the wireless keys on WZC. The program wzcook.exe which is part of aircrack will give you the keys for the wireless networks that are stored by the WZC.

Solution for Windows

Here's how to fix this on Windows:

Start->Control Panel->Network Connections->Double Click on your Wireless Connection->Properties->Wireless Networks->Advanced->Choose "Access point (infrastructure) networks only. Click the Close button then Click OK all the way back. Done.

Conflicting opnions on what is vulnerable

After reading several of the comments, we should just trump our previous definition of "vulnerability".

  If you have a computer and it's power is *ON*, it's vulnerable to something.

  Next week I will show that even a computer in which it's power is *OFF* is vulnerable to the 8lb sledge hack.

Built in XP Wireless

Built in XP Wireless stinks.

It does not give a detailed level of signal strength, it is limited to 1-5 bars.

It will drop the connection far more often than manufacturer's utilities. In other words, don't bother playing online games on it.

The window isn't resizable. When did Microsoft think this was a good idea?*

Security passcodes have to be entered twice. That's terrible when the passcode is 10+ characters, and you can't see what you've typed in either.

It won't re-enable at times for no appearant reason. * Anyone know a way to force apps to be resizable?

Re:Hmmm

You have to try to connect, and FAIL, to be assigned a 169.254.x.y address.

Re:Hmmm

How about an airplane? I see plenty of laptops open on airplanes.

Re:Hmmm

I'm working at a conference in Vegas this week. I just set up 40 wireless networks for 1400 laptops. (Win XP SP1 and SP2) You're only partially incorrect.

Windows will keep broadcasting its last SSID, looking for the network of that name. When it finds the network it's looking for, it will jump on the network automatically, without asking you.

If it doesn't find that network, it will not give itself a 169.254 (APIPA) address, at least not on the surface. The interface will show up as "Media link disconnected" or whatever the term is. However, if it finds the SSID, but cannot get an IP, it will give itself an APIPA address.

I'm guessing that you can sniff the name of the SSID that's being broadcast by the laptop, and then set up your own AP or whatever. At that point, the attacked laptop will give itself an APIPA address if it can't get an IP from your AP. I'm not really sure what the significance of the APIPA stuff is, since the SSID is the important part. I'd just set up a DHCP server on my attacking AP.

Ok, back to rolling out networks.. :-)