Security Experts:

Connect with us

Hi, what are you looking for?


Data Protection

New Heartbleed Attack Vectors Impact Enterprise Wireless, Android Devices

While most organizations have patched the Heartbleed bug in their OpenSSL installations, a security expert has uncovered new vectors for exploiting the vulnerability, which can impact enterprise wireless networks, Android devices, and other connected devices.

While most organizations have patched the Heartbleed bug in their OpenSSL installations, a security expert has uncovered new vectors for exploiting the vulnerability, which can impact enterprise wireless networks, Android devices, and other connected devices.

Dubbed “Cupid,” the new attack method was recently presented by Portuguese security researcher Luis Grangeia, who debunked theories that Heartbleed could only be exploited over TCP connections, and after the TLS handshake.


Unlike the initial Heartbleed attack, which took place on TLS connections over TCP, the Cupid attack happens on TLS connections over the Extensible Authentication Protocol (EAP), an authentication framework typically used in wireless networks and peer-to-peer connections.

It’s worth noting that EAP is not an actual authentication mechanism, but a framework that provides common functions and negotiation of authentication methods. The EAP methods impacted by the Cupid attack are the ones that use TLS, namely EAP-PEAP, EAP-TLS and EAP-TTLS.

The attack, which affects both clients and servers, relies on modifications made to “hostapd” and “wpa_supplicant,” applications that share a lot of code since they’ve been developed by the same author.

Vulnerable clients can be exploited with the modified hostapd application, which is designed for deploying configurable Access Points on Linux. The attacker sets up a network that sends malicious heartbeat requests when a vulnerable client requests a TLS connection. In the case of servers, the attack relies on an altered version of the wpa_supplicant application.

Webcast June 12: Managing Heartbleed Fallout – Register Now

“We request a connection to a vulnerable network and then send a heartbeat request right after the TLS connection is made,” Grangeia, Partner and Security Services Manager at SysValue S.A., explained in his report.

The expert noted that it’s not necessary to establish a full TLS connection in order to perform these Cupid attacks since heartbeat responses can be sent or received before keys and certificates are exchanged. Furthermore, the attacker doesn’t need a valid password to exploit the vulnerability, only a valid username that might be requested to redirect the user to the proper authentication server.

If successful, an attacker can gain access to the contents of the memory, which can include the private key of the certificate used on the TLS connection, and authentication credentials.

The researcher has confirmed that default installations of wpa_supplicant, hostapd, and freeradius (RADIUS server implementation) can be exploited on Ubuntu if a vulnerable version of OpenSSL is utilized. Mobile devices running Android 4.1.0 and 4.1.1 also use wpa_supplicant to connect to wireless networks, so they’re also affected.

As far as servers are concerned, home routers don’t use EAP, but organizations running managed wireless solutions ­are likely impacted if they’re using OpenSSL. Grangeia also highlights that 802.1x Network Access Controlled wired networks could also be impacted.

Essentially everything that uses a vulnerable version of OpenSSL for EAP TLS is susceptible to Cupid attacks. While he hasn’t been able to confirm it, the expert believes iPhones, iPads, OS X, other RADIUS servers besides freeradius, VoIP phones, printers, and various commercial managed wireless solutions could be affected.

The Cupid patches for hostapd and wpa_supplicant have been made available on GitHub.

Upcoming Webcast June 12: Managing Heartbleed Fallout – Register Now

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.


Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet

Network Security

NSA publishes guidance to help system administrators identify and mitigate cyber risks associated with transitioning to IPv6.

Identity & Access

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the...

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.