New Wi-Fi Vulnerabilities Expose Android and Linux Devices to Hackers

Cybersecurity scientists have determined two authentication bypass flaws in open-source Wi-Fi program found in Android, Linux, and ChromeOS units that could trick customers into signing up for a destructive clone of a reputable network or allow for an attacker to sign up for a trustworthy network without the need of a password.

The vulnerabilities, tracked as CVE-2023-52160 and CVE-2023-52161, have been found out next a security analysis of wpa_supplicant and Intel’s iNet Wireless Daemon (IWD), respectively.

The flaws “allow for attackers to trick victims into connecting to malicious clones of dependable networks and intercept their visitors, and sign up for otherwise secure networks with no needing the password,” Major10VPN said in a new analysis carried out in collaboration with Mathy Vanhoef, who has beforehand uncovered Wi-Fi attacks like KRACK, DragonBlood, and TunnelCrack.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

CVE-2023-52161, in particular, permits an adversary to get unauthorized accessibility to a guarded Wi-Fi network, exposing existing buyers and devices to potential attacks these kinds of as malware infections, facts theft, and enterprise email compromise (BEC). It impacts IWD versions 2.12 and reduced.

On the other hand, CVE-2023-52160 affects wpa_supplicant versions 2.10 and prior. It can be also the much more urgent of the two flaws owing to the reality that it truly is the default program made use of in Android units to cope with login requests to wi-fi networks.

That mentioned, it only impacts Wi-Fi consumers that aren’t effectively configured to confirm the certification of the authentication server. CVE-2023-52161, even so, affects any network that takes advantage of a Linux gadget as a wi-fi entry place (WAP).

Prosperous exploitation of CVE-2023-52160 banking companies on the prerequisite that the attacker is in possession of the SSID of a Wi-Fi network to which the sufferer has formerly linked. It also needs the risk actor to be in bodily proximity to the sufferer.

“1 achievable these scenario could be where by an attacker walks about a company’s developing scanning for networks just before concentrating on an employee leaving the office environment,” the scientists explained.

Important Linux distributions these kinds of as Debian (1, 2), Purple Hat (1), SUSE (1, 2), and Ubuntu (1, 2) have released advisories for the two flaws. The wpa_supplicant issue has also been tackled in ChromeOS from variations 118 and later, but fixes for Android are however to be made offered.

“In the meantime, it can be critical, consequently, that Android people manually configure the CA certificate of any saved organization networks to stop the attack,” Leading10VPN said.

Uncovered this report intriguing? Abide by us on Twitter  and LinkedIn to examine extra distinctive written content we article.