Security researchers discovered multiple configuration flaws concerning the free Wi-Fi networks of many universities. The deficiency affects students and faculty members who connect via Android and Windows devices, allowing unauthorized hacker access and the likelihood of having their usernames and passwords breached.
This Configuration flaw in Wi-Fi networks endangers global organizations, as reported by analysts.
Over 3,000 configurations of the eduroam Wi-Fi network roaming service being used in European universities were reviewed by a research team. They found out that over half of the 3,000 configurations have flaws that cyber-attackers can illegally utilize. The analysts also added that this misconfiguration flaw is likely to spread amongst other organizations worldwide.
Eduroam is an international Wi-Fi network roaming service for users in higher education and provides free connections for active organizations. Login credentials are assigned to its users, such as students and faculties, to acquire internet connection all across different locations of universities.
The discovered configuration flaws of the analysts include some authentication phases on eduroam’s Extensible Authentication Protocol (EAP) that were not configured correctly in particular institutions that have opened security holes. These configuration flaws put students or faculty members at risk since threat actors will access their plaintext username and password close to 20 meters from the user.
An eduroam network is duplicated by threat actors to harm users
Different configuration setup guides were inspected by analysts and as well as holding a test environment for different attack situations. The overall findings revealed that threat actors could duplicate the eduroam network in universities with configuration flaws. This tactic is particular to Android devices wherein it tricks users into connecting to a Wi-Fi network that will seem like the original one but instead a duplicate that can harm them.
As added by the analysts, eduroam’s services are not the one to be blamed but rather the universities who have flaws in their configuration instructions and has no centralized network management. Moreover, the researchers highlighted the poor implementation of the authentication’s last stage, called the “Inner Authentication,” to cause the issue.