1. Security issues in RADIUS
based Wi-Fi AAA
Karri Huhtanen, 2018-10-13

2. What is RADIUS based Wi-Fi AAA?
● RADIUS based Wi-Fi AAA is usually called WPA2 Enterprise
Wi-Fi authentication as opposed to WPA Personal
● WPA Personal is shared secret based Wi-Fi authentication
intended for home networks
● WPA2 Enterprise is Wi-Fi authentication, which uses and
requires AAA infrastructure to work
● The credentials in WPA2 Enterprise can be anything from
shared secret to username&password to certificates to SIM
card in mobile phone.

3. Where is this WPA2 Enterprise used?
● In any secure company/organisation Wi-Fi
network
● Roaming federations: eduroam, govroam,
roam.fi ...
● Carrier Wi-Fi networks

4. Why WPA2 Enterprise is used?
● Most secure of Wi-Fi authentication standards
● Scalable authentication, authorisation and
accounting
● Device/session specific encryption (AES) over the
air
● Secure authentication between end device and
home organisation RADIUS server while roaming

5. How does WPA2 Enterprise AAA work?
EAP-PWD EAP method based on elliptic
Curves, real identity shown
EAP-TTLS, TLS secured “envelope”
EAP-PEAP outer identity can be anonymous
or real identity
EAP-TLS Certificate based EAP method,
certificate details can be seen
EAP-SIM, SIM card based EAP method,
EAP-AKA(‘) temporary identities etc.
User credentials
(username+password, certificate,
SIM card) travel within encrypted
EAP envelope
Network Access
Server (NAS):
E.g Wi-Fi
controller, Wi-Fi
AP
RADIUS AAA
server software
RADIUS protocol
WPA2 Enterprise
Authentication

6. Visited organisation
(VO) Wi-Fi network
How does RADIUS roaming work?
NAS
Roaming visitor’s device
Outer identity: anonymous@tut.fi
Inner identity: realusername@tut.fi
1 I (anon@tut.fi) want
to join to this Wi-Fi
network
2 NAS forwards
request to VO
RADIUS server. As
tut.fi is not VO realm,
RADIUS server
proxies request to its
default server
3 Federation Top Level RADIUS server knows that
realm tut.fi is handled by TUT RADIUS server and
proxies request to it
4 Home organisation (tut.fi) RADIUS
server and TUT user device negotiate
and arrange TLS secured tunnel for
authentication. Authentication
happens between TUT user device and
TUT RADIUS server using the
infrastructure in between.
5 Home organisation RADIUS server
makes OK or NOT decision based on
the authentication and returns
access decision response via same
infrastructure route
6 NAS lets TUT user device connect
(or not) to the VO Wi-Fi network
based on the proxied RADIUS
response

7. So where does WPA2 Enterprise AAA fail?
● Very rarely with technology
● Sometimes with network and security
design
● Often with misconfiguration or lack of
configuration provisioning
● Most commonly with end users and
manual device configuration

8. Why
should
we
care?
https://www.dailymail.co.uk/news/article-6242927/Bungling-Russian-spies-biggest-blunder-Passports-help-identify-300-G
RU-agents.html

9. Why
should
we
care?
https://english.defensie.nl/binaries/defence/documents/publications/2018/10/04/gru-close-access-cyber-operation-against
-opcw/ppt+pressconference+ENGLISH+DEF.pdf

10. Technology issues
● Usually only implementation bugs in end user device,
NAS or RADIUS server
● Rarely protocol weaknesses (although some
weaknesses do exist)
● Privacy may be a technology issue in RADIUS based
AAA roaming with certain EAP methods and not using
RADIUS over TLS (RadSec)
● Person-in-the-Middle attacks rely on misconfiguration
and end user issues

11. Network design issues
● The most common mistake is to trust the Wi-Fi network and
its authentication.
● Wi-Fi AAA should never be your first and only line of defense
● Wi-Fi network should never be treated as a trusted network,
it should be treated as an access network similar to Internet
● Access to confidential services should be secured with
additional levels of security (e.g. VPN, Google’s
BeyondCorp. etc)

12. Security design issues
● The same username and password used for
network authentication as for
single-sign-on/AD/domain login
● Valuable credentials, which can be copied should
not be used for Wi-Fi network authentication
● One solution is using certificates or other Wi-Fi
EAP methods, which cannot reveal password
(hashes) e.g EAP-PWD

13. Misconfiguration and configuration provisioning issues
● The most common misconfiguration is to set
‘do not check server certificate’ “on”
● The second most common misconfiguration is
not to define the common name in the server
certificate to be checked
● Third is not to use any provisioning tools to
ensure proper configuration in the end user
devices

14. End user and manual configuration issues
● Configuring WPA2 settings manually properly in
○ Windows 7 requires admin privileges and ~11 dialogs (+maybe installing CA
certificate)
○ Android requires recent enough and clean enough version (+maybe installing
CA certificate)
○ Apple devices requires firing up Apple Configurator and creating a Wi-Fi
profile
○ Linux requires extensive experience in Network Manager, wpa_supplicant and
the Linux networking subsystem
● Active Directory Group Policies, provisioning tools
(eduroam-cat) and making configuration profiles
downloadable (Apple) all are better idea than manual
configuration.

15. Manually configured
Windows 10 Pro.
Original RADIUS
server certificate
was accepted based
on server
thumbprint. Then
RADIUS server
certificate was
updated.

16. WPA2 Enterprise security issue solutions
● Keep your devices up-to-date
(get only devices that can be kept up-to-date)
● Don’t trust the Wi-Fi network
(trust no one)
● The best security design is like an onion
( it has layers and makes sometimes end users cry )
● Ensure proper device configuration
● Educate end users

17. Thank you. Any questions?
for more information visit
https://slideshare.net/khuhtanen
https://twitter.com/khuhtanen
https://twitter.com/OSCRadiator
https://radiatorsoftware.com