<<< Date Index >>>     <<< Thread Index >>>

Local information disclosure in WeFi Client v3.3.3.0



==================================================
INFO
==================================================
The wireless client, WeFi v3.3.3.0 is susceptible to a local information 
disclosure due to irresponsible coding. Earlier versions may also be affected.

==================================================
DISCUSSION
==================================================
Due to the WeFi client storing the keys in memory, a dump is able to show valid 
WEP, WPA and WPA2 keys that can be used by a local attacker. This information 
can often be found around the 044296C0 offset. An attacker could easily dump 
the credentials from memory whilst walking past a laptop with an autorun U3 
USB. The file that keeps the keys in memory is as follows:

C:\Program Files\WeFi\WeFi.exe

==================================================
SAMPLE 1
==================================================
Here is a sample of the hexadecimal memory dump:

Offset    00 01 02 03 04 05 06 07 08 09    ASCII

044296C0  03 8B CB 00 30 39 46 38 32 39    .?Ë.09F829    <--WEP KEY
044296CA  38 30 43 58 00 00 00 00 00 00    80CX......    <--WEP KEY

As you can see, the WEP key, "09F82980CX" has been stored in plain text.

The WEP Key has been changed from its true values to protect the identity and 
anonymity of the victim.

==================================================
SAMPLE 2
==================================================
A few lines down and we find the SSID, "linksys":

Offset    00 01 02 03 04 05 06 07 08 09    ASCII

044296FC  00 00 00 00 00 00 00 00 6C 69    ........li    <--SSID
04429706  6E 6B 73 79 73 2E 2E 2E 2E 2E    nksys.....    <--SSID

The SSID has been changed from its true values to protect the identity and 
anonymity of the victim.

==================================================
NOTES
==================================================
The WeFi client continues to keep the WEP keys long after the client has 
authenticated with the wireless access point. The first network that the client 
authenticates with is around 044296C0 and further wireless keys can be found 
after that offset. All wireless keys are accompanied with their respectable 
SSID shortly after the key.

==================================================
SOLUTION
==================================================
Do not keep the wireless encryption keys in the program and disallow the client 
to "Remember Key". 
The wireless key should only be used during authentication and should not be 
kept in the system memory. 
Encryption is no longer a valid solution as this can be reversed if the 
algorithm is known or reversed.
The vendor has been notified.

==================================================
Thanks,
Xia Shing Zee