Vulnerabilities:
CVE-2023-52160 (wpa_supplicant) and CVE-2023-52161 (Intel’s iNet Wireless Daemon) allow attackers to:
- Trick users into joining fake Wi-Fi networks: Attackers can create malicious clones of legitimate networks and steal user data.
- Gain unauthorized access to secure Wi-Fi networks: Attackers can join password-protected networks without needing the password, putting devices and data at risk.
Affected devices:
- CVE-2023-52160: Android devices using wpa_supplicant versions 2.10 and prior (requires specific configuration).
- CVE-2023-52161: Linux devices using iNet Wireless Daemon versions 2.12 and lower (any network using a Linux access point).
Mitigation:
- Update your Linux distribution and ChromeOS (version 118 or later).
- Android fix not yet available, but manually configure CA certificate for any saved enterprise networks as a temporary workaround.
Exploitation:
- Attacker needs SSID and physical proximity for CVE-2023-52160.
- CVE-2023-52161 requires no special knowledge, affecting any vulnerable network.
Links:
Business Email Compromise (BEC)? (╯°□°）╯︵ ┻━┻
The CVE-2023-52160, which applies to Android/linux/ChromeOS devices connecting to WPA2/WPA3 Enterprise, allows an attacker to fool the user to connect to a malicious SSID and intercept the traffic. So unencrypted traffic can be compromised. So, their listing of sensitive data, BEC, and password theft sound scary but probably affects very few services that don’t encrypt the data.
Please don’t compromise my business emails, just my personal ones.
=)
Considered it done. ;-)
Once more we will ignore the elephant in the room which is owned by a advertising giant. Android. Their OEM agreement was designed so bad that it makes you wonder if it does serve a purpose? I can theoretically easily compile the wpa_supplicant on the phone itself however I won’t be able to install/run it. Manufacturer even gave up the brand name itself. Billions of walking zombie devices as the result.
