Network Security News

Cisco wireless LAN access points vulnerable to hacker attack

Tuesday, August 25, 2009

Security researchers at AirMagnet have uncovered a security flaw in Cisco's wireless LAN infrastructure that could allow a hacker to hijack a wireless access point to gain access to a customer's network.

The vulnerability involves Cisco's Over-the-Air-Provisioning (OTAP) feature found in its wireless access points (APs). The OTAP feature allows a Cisco AP that is not connected to a Cisco controller to listen to traffic from other nearby Cisco APs and use that information to quickly locate a nearby WLAN controller to associate to.

AirMagnet said there is an unintentional exposure or leakage of information in all lightweight Cisco APs and the potential for APs to be incorrectly assigned to an outside Cisco controller (what the researchers call "SkyJacked") either by accident or at the direction of a potential hacker.

The potential exists for the Cisco AP to "hear" multicast traffic from a neighboring network and incorrectly connect to a neighbor or otherwise unapproved Cisco controller. This ultimately could lead to an enterprise's access point connecting outside of the company to an outside controller and therefore being under outside control.

This same mechanism could be done intentionally by a hacker to purposely SkyJack APs and take control of an enterprise's access point.

AirMagnet said it has informed Cisco of this vulnerability and potential exploit. Cisco is "taking appropriate actions."