Apple Implementation of WPA2-Enterprise (Wi-Fi) Security Protocol Gives Rise to Potential Enterprise Network Security Breaches

Hasselt, Belgium - August 27, 2014. At a conference in Oxford (UK), Pieter Robyns – a Computer Science student at Hasselt University (UHasselt) – highlighted a substantial security issue when Apple devices are used in combination with the WPA2-Enterprise protocol, a universal standard to secure wireless enterprise networks. Apple’s implementation of this protocol allows cybercriminals to intercept the credentials of employees who log in to their enterprise network with an Apple device. Researchers from iMinds and the Expertise Center for Digital Media (EDM) of UHasselt who assisted Pieter during his research, alerted Apple of their findings earlier this year. With the launch of Apple’s new operating system iOS8 – at the end of 2014 – the issue should be solved. This security issue demonstrates once again that solely relying on the security mechanisms of a wireless access network is not sufficient when it comes to keeping sensitive company data safe from hackers.

The Most Trusted Protocol for Securing Wireless Enterprise Networks

Enterprise networks contain loads of mission-critical information – ranging from (future) product roadmap info to detailed marketing plans, customer files and financial data. It is therefore very important to protect those data properly, especially when employees can access them via a wireless access network. That is one of the reasons why IEEE, an international standardization organization, developed the Wi-Fi Protected Access II (WPA2)-Enterprise protocol. It is currently the most trusted security mechanism for the protection of wireless enterprise networks.

Apple's Implementation of WPA2-Enterprise Opens the Door to Cyber Attacks

Unfortunately, security mechanisms can be circumvented, especially when standards give room to manufacturers to fill in implementation details. Such a problem was highlighted in the master thesis of Pieter Robyns, who studies Computer Science at UHasselt. Under the supervision of iMinds researchers, Robyns discovered that a particular implementation of the WPA2-Enterprise protocol enables cybercriminals to gain access to enterprise networks (and potentially to the data that are stored on them). It is primarily the Apple implementation of WPA2-Enterprise that opens the door to cyber attacks.

"Attackers can gain access to the enterprise network without having a valid username and password," explains Pieter Robyns. "Due to the specific implementation of Apple, a cybercriminal can intercept and use the credentials that are sent through the air when an employee connects to the enterprise Wi-Fi network with his or her Apple device (iPhone/iPad and Mac OS X). As such, the employee’s identity and access rights are taken over without the user noticing this."

Breach in Enterprise Network a Gateway for More Severe Cybercrime; Home Networks Unaffected

"Pieter’s findings might have a significant impact," adds Bram Bonné from iMinds - EDM - UHasselt. "WPA2-Enterprise is the world's most trusted security protocol for wireless enterprise networks, as IT managers are convinced of its robustness. And under normal circumstances, WPA2-Enterprise indeed enables a perfect encryption of the login details that are sent over Wi-Fi; it is just that something went wrong with the specific Apple implementation. And given the large number of Apple devices in use, this obviously implies a certain security risk: building on this security breach, more complex attacks can be launched – using (and abusing) employees’ credentials. Fortunately, home networks are not impacted – as they encrypt data using a different protocol (WPA2-PSK), which, as far as we know, has been implemented correctly on every major platform."

“We have shared our findings with Apple, and normally the introduction of iOS8 later this year should solve the issue," concludes Pieter Robyns. "But in the meantime, we recommend that managers of enterprise networks store confidential data on servers that are protected with separate access rights – instead of simply relying on the security mechanisms of their wireless access networks.”

Pieter Robyns wrote his master thesis within the department of Computer Science at UHasselt, under the supervision of Prof. Dr. Peter Quax and Prof. Dr. Wim Lamotte, and assisted by iMinds researcher Bram Bonné. As from September 2014, Pieter will work as a doctoral student affiliated with iMinds - EDM - UHasselt.



About iMinds

iMinds – the digital research center of Flanders, Belgium – combines the strength of its 850+ researchers at five Flemish universities to conduct strategic and applied research in areas such as ICT, Media and Health. Together with its research partners (companies, governments and non-profit organizations), iMinds translates digital know-how into concrete products and services. In addition, iMinds supports researchers, young entrepreneurs and start-ups in the successful market introduction of their ideas. More info at www.iminds.be (Twitter: @iMinds).

About Hasselt University

Hasselt University (Dutch: Universiteit Hasselt, UHasselt) is a university with campuses in Hasselt and Diepenbeek, Belgium. True to its baseline ‘Knowledge in action’, Hasselt University has grown into an innovative and dynamic university – an institution which provides for a qualified workforce, locally adapted research, appropriate services and technologies for the region. The university has six faculties (Law, Sciences, Business Economics, Medicine & Life Sciences, Architecture & Arts and Engineering Technology) and seven research institutes (which cover a wide range of research areas: biomedical, environmental, statistical, material, transportation research, innovation management research and media technology research). UHasselt is home to about 5,500 students and 1,200 academic, administrative and technical staff members. More info: www.uhasselt.be (Twitter: @uhasselt / Facebook: www.facebook.com/uhasselt).

Contact: 

  • Pieter Robyns - Master, Computer Science, UHasselt, +32 11 26 84 11 
  • Bram Bonné - Researcher, iMinds - EDM - UHasselt, +32 11 26 84 59 
  • Prof. Dr. Wim Lamotte, iMinds - EDM - UHasselt,+32 11 26 84 23 
  • Prof. Dr. Peter Quax, iMinds - EDM - UHasselt, +32 11 26 84 52
  • Wim Van Daele, iMinds Media Relations, +32 9 331 48 23