Security Experts:

Connect with us

Hi, what are you looking for?


Data Protection

New Heartbleed Attack Vectors Impact Enterprise Wireless, Android Devices

While most organizations have patched the Heartbleed bug in their OpenSSL installations, a security expert has uncovered new vectors for exploiting the vulnerability, which can impact enterprise wireless networks, Android devices, and other connected devices.

While most organizations have patched the Heartbleed bug in their OpenSSL installations, a security expert has uncovered new vectors for exploiting the vulnerability, which can impact enterprise wireless networks, Android devices, and other connected devices.

Dubbed “Cupid,” the new attack method was recently presented by Portuguese security researcher Luis Grangeia, who debunked theories that Heartbleed could only be exploited over TCP connections, and after the TLS handshake.


Unlike the initial Heartbleed attack, which took place on TLS connections over TCP, the Cupid attack happens on TLS connections over the Extensible Authentication Protocol (EAP), an authentication framework typically used in wireless networks and peer-to-peer connections.

It’s worth noting that EAP is not an actual authentication mechanism, but a framework that provides common functions and negotiation of authentication methods. The EAP methods impacted by the Cupid attack are the ones that use TLS, namely EAP-PEAP, EAP-TLS and EAP-TTLS.

The attack, which affects both clients and servers, relies on modifications made to “hostapd” and “wpa_supplicant,” applications that share a lot of code since they’ve been developed by the same author.

Vulnerable clients can be exploited with the modified hostapd application, which is designed for deploying configurable Access Points on Linux. The attacker sets up a network that sends malicious heartbeat requests when a vulnerable client requests a TLS connection. In the case of servers, the attack relies on an altered version of the wpa_supplicant application.

Webcast June 12: Managing Heartbleed Fallout – Register Now

“We request a connection to a vulnerable network and then send a heartbeat request right after the TLS connection is made,” Grangeia, Partner and Security Services Manager at SysValue S.A., explained in his report.

The expert noted that it’s not necessary to establish a full TLS connection in order to perform these Cupid attacks since heartbeat responses can be sent or received before keys and certificates are exchanged. Furthermore, the attacker doesn’t need a valid password to exploit the vulnerability, only a valid username that might be requested to redirect the user to the proper authentication server.

If successful, an attacker can gain access to the contents of the memory, which can include the private key of the certificate used on the TLS connection, and authentication credentials.

The researcher has confirmed that default installations of wpa_supplicant, hostapd, and freeradius (RADIUS server implementation) can be exploited on Ubuntu if a vulnerable version of OpenSSL is utilized. Mobile devices running Android 4.1.0 and 4.1.1 also use wpa_supplicant to connect to wireless networks, so they’re also affected.

As far as servers are concerned, home routers don’t use EAP, but organizations running managed wireless solutions ­are likely impacted if they’re using OpenSSL. Grangeia also highlights that 802.1x Network Access Controlled wired networks could also be impacted.

Essentially everything that uses a vulnerable version of OpenSSL for EAP TLS is susceptible to Cupid attacks. While he hasn’t been able to confirm it, the expert believes iPhones, iPads, OS X, other RADIUS servers besides freeradius, VoIP phones, printers, and various commercial managed wireless solutions could be affected.

The Cupid patches for hostapd and wpa_supplicant have been made available on GitHub.

Upcoming Webcast June 12: Managing Heartbleed Fallout – Register Now

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Protection

The CRYSTALS-Kyber public-key encryption and key encapsulation mechanism recommended by NIST for post-quantum cryptography has been broken using AI combined with side channel attacks.

Data Protection

The cryptopocalypse is the point at which quantum computing becomes powerful enough to use Shor’s algorithm to crack PKI encryption.

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

Identity & Access

Zero trust is not a replacement for identity and access management (IAM), but is the extension of IAM principles from people to everyone and...

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.