Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Data Protection

New Heartbleed Attack Vectors Impact Enterprise Wireless, Android Devices

While most organizations have patched the Heartbleed bug in their OpenSSL installations, a security expert has uncovered new vectors for exploiting the vulnerability, which can impact enterprise wireless networks, Android devices, and other connected devices.

While most organizations have patched the Heartbleed bug in their OpenSSL installations, a security expert has uncovered new vectors for exploiting the vulnerability, which can impact enterprise wireless networks, Android devices, and other connected devices.

Dubbed “Cupid,” the new attack method was recently presented by Portuguese security researcher Luis Grangeia, who debunked theories that Heartbleed could only be exploited over TCP connections, and after the TLS handshake.

Cupid

Unlike the initial Heartbleed attack, which took place on TLS connections over TCP, the Cupid attack happens on TLS connections over the Extensible Authentication Protocol (EAP), an authentication framework typically used in wireless networks and peer-to-peer connections.

It’s worth noting that EAP is not an actual authentication mechanism, but a framework that provides common functions and negotiation of authentication methods. The EAP methods impacted by the Cupid attack are the ones that use TLS, namely EAP-PEAP, EAP-TLS and EAP-TTLS.

The attack, which affects both clients and servers, relies on modifications made to “hostapd” and “wpa_supplicant,” applications that share a lot of code since they’ve been developed by the same author.

Vulnerable clients can be exploited with the modified hostapd application, which is designed for deploying configurable Access Points on Linux. The attacker sets up a network that sends malicious heartbeat requests when a vulnerable client requests a TLS connection. In the case of servers, the attack relies on an altered version of the wpa_supplicant application.

Webcast June 12: Managing Heartbleed Fallout – Register Now

“We request a connection to a vulnerable network and then send a heartbeat request right after the TLS connection is made,” Grangeia, Partner and Security Services Manager at SysValue S.A., explained in his report.

Advertisement. Scroll to continue reading.

The expert noted that it’s not necessary to establish a full TLS connection in order to perform these Cupid attacks since heartbeat responses can be sent or received before keys and certificates are exchanged. Furthermore, the attacker doesn’t need a valid password to exploit the vulnerability, only a valid username that might be requested to redirect the user to the proper authentication server.

If successful, an attacker can gain access to the contents of the memory, which can include the private key of the certificate used on the TLS connection, and authentication credentials.

The researcher has confirmed that default installations of wpa_supplicant, hostapd, and freeradius (RADIUS server implementation) can be exploited on Ubuntu if a vulnerable version of OpenSSL is utilized. Mobile devices running Android 4.1.0 and 4.1.1 also use wpa_supplicant to connect to wireless networks, so they’re also affected.

As far as servers are concerned, home routers don’t use EAP, but organizations running managed wireless solutions ­are likely impacted if they’re using OpenSSL. Grangeia also highlights that 802.1x Network Access Controlled wired networks could also be impacted.

Essentially everything that uses a vulnerable version of OpenSSL for EAP TLS is susceptible to Cupid attacks. While he hasn’t been able to confirm it, the expert believes iPhones, iPads, OS X, other RADIUS servers besides freeradius, VoIP phones, printers, and various commercial managed wireless solutions could be affected.

The Cupid patches for hostapd and wpa_supplicant have been made available on GitHub.

Upcoming Webcast June 12: Managing Heartbleed Fallout – Register Now

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Understand how to go beyond effectively communicating new security strategies and recommendations.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Protection

The cryptopocalypse is the point at which quantum computing becomes powerful enough to use Shor’s algorithm to crack PKI encryption.

Identity & Access

Zero trust is not a replacement for identity and access management (IAM), but is the extension of IAM principles from people to everyone and...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Artificial Intelligence

The CRYSTALS-Kyber public-key encryption and key encapsulation mechanism recommended by NIST for post-quantum cryptography has been broken using AI combined with side channel attacks.

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Vulnerabilities

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...