WPA2 vulnerability found
networkworld.com
networkworld.com
Jennifer's a friend of mine who knows her stuff when it comes to 802.1X, NAC and WiFi. It looks like it's only related to broadcast traffic, and you have to be authenticated. Also, I can't tell, but it sounds like it might be restricted to radius-authenticated networks (WPA / WPA2 Enterprise, not PSK like you'd find in a coffee shop)
1) Bob and Alice go to a coffee shop that uses WPA2, but gives the password to paying customers.
2) Alice uses the exploit to acquire Bob's PSK.
3) Alice records and decrypts all of Bob's traffic.
WPA(2) largely just made it more difficult to brute force network passwords (vs WEP) but did nothing for privacy of the users. Unless you're using certificates for authentication, everything you do is visible to anyone else who has the password.
It's a shame, because it would have been very easy to address by just using Diffie Hellman when determining the session key.
"it would have been very easy to address by just using Diffie Hellman when determining the session key"
Since WPA is implemented in hardware you must add gates to support Diffie Helman. This adds cost, resulting in a cost/security trade off.
Unicast traffic has safeguards against spoofing. Multicast does not. Spoof yourself as the AP, send out multicast traffic, and clients respond with unicast traffic with their key.
OK... seriously? Session keys! If you never send them out after negotiating them, the attacker would never get the key, and all your past traffic would still be secure.
The state of "security" with wireless communications continually strikes me as an ass-backwards place... wtf keeps going wrong? A couple standard, basic security techniques would seem to resolve nearly every cracking problem, and a large number of MITM ones too (certificates!).