Microsoft is warning users that their Windows Phone 8 and Windows Phone 7.8 devices could be easily tricked into revealing login credentials for corporate Wi-Fi access points secured with WPA2 protection. The vulnerability appears to build on a known security weakness in a Microsoft authentication protocol as well as the way Windows Phones connect to WPA2 networks.

Let’s say Bob works for Acme Inc. and you use a Nokia Lumia 920 as his work phone. Every day Bob’s phone automatically connects to the company’s Wi-Fi network, called ACME1, using WPA2 security.

Whenever Bob’s phone sees a Wi-Fi network called ACME1, the handset assumes that this is his work network and attempts to make a connection.

Now, let’s say that two blocks down the street there’s a café where a lot of ACME employees grab a latte on their lunch breaks. All a hacker would have to do is set-up a wireless router called ACME1 secured with WPA2 and wait for a Windows Phone to connect to the rogue access point.

Once Bob walks in with his Nokia 920 with the Wi-Fi turned on, his phone will try to connect to the bogus ACME1 Wi-Fi network. During the phony authentication process, the hacker will be able to intercept the encrypted domain credentials stored in Bob’s phone.

Now, that wouldn’t be a problem if Microsoft was using a cryptographic standard known to be resistant to attack, but Windows Phone uses an authentication protocol called PEAP-MS-CHAPv2 (Protected Extensible Authentication Protocol with Microsoft Challenge Handshake Authentication Protocol version 2) that packs some key cryptological weaknesses, which are exploited by this vulnerability.

So after the hacker nabs Bob’s login credentials, the baddie can simply capitalize on the weak encryption to obtain Bob’s credentials and then login to the real ACME1 with the same user privileges as Bob.

Microsoft says it has no plans for a patch to fix this issue as the problem is the fundamentally weak cryptography used in PEAP-MS-CHAPv2. (On the plus side, Microsoft says it doesn’t know of any examples of the weakness being actively used in the wild.)

As a workaround, Microsoft is advising corporate IT departments to require Windows Phone devices to validate a Wi-Fi access point by checking its root certificate before attempting to connect. The other option, Microsoft says, is to turn off your phone’s Wi-Fi capabilities. Anyone who needs to learn how to secure their Windows Phone device can find detailed instructions on Microsoft’s Website.

AppId is over the quota
AppId is over the quota
The truth can be a bitter pill to swallow, but Microsoft's brass is reportedly owning up to its mistakes.
Both The Verge and Neowin say that in an internal Microsoft meeting this week, CEO Steve Ballmer and COO Kevin Turner were blunt in discussing some of the problems that have cropped up in the nine months since Windows 8 launched.
"We're not selling as many Windows devices as we want to," Ballmer admitted, according to The Verge, talking about the whole range of Windows-powered hardware, from phones to PCs to tablets.
Analyst numbers back up Ballmer's stark reality: PC sales are hemorrhaging, Windows tablets have yet to get off the ground, and while Windows Phones snatched the third-place crown away from BlackBerry earlier this year, Android and iOS still account for more than 92 percent of all smartphone sales, according to the IDC research group. And nothing Windows RT-related is selling whatsoever.
Microsoft's Surface RT tablet.
That includes Microsoft's own dive into the hardware side of things. At the meeting, Ballmer said "We built a few more [Surface RT] devices than we could sell," The Verge reports. You can say that again. Microsoft recently took a whopping $900 million accounting charge after slashing the price of its Surface RT tablet to $350.
Even so, Ballmer told Microsoft employees that the next-gen Surface RT sports "typical improvements" and is being tested right now, according to Neowin. That jibes with earlier reports that the second iteration of the Surface RT will include a Qualcomm Snapdragon 800 processor.
When asked for a response, a Microsoft spokesperson said the company doesn't comment on rumors or speculation.
Slowly and steadily, however, Microsoft is correcting the biggest stumbles surrounding the Windows 8 release.
Microsoft 'stores-within-a-store' are popping up in 500 Best Buys across the U.S.
When Windows 8 first launched, it was hard to find touchscreen devices at retail during the crucial holiday season, including Surface tablets, which were limited to Microsoft Stores at the time. In the months since, the early manufacturing hiccups have smoothed out. Touchscreen laptops and hybrids are now common, and Microsoft has taken steps to spread the Surface far and wide to multiple retailers across the nation.
Pricing of the first batch of Windows RT tablets has also plummeted, which should help to quell complaints that slates running the fledgling OS were overpriced at the same cost as an iPad.
But retail rejiggering alone won't right the Windows ship. The biggest complaints about the first wave of Windows 8 devices weren't so much about the hardware as much as the software
itself. It's hard to sell tablets with a lackluster app selection.
"One of the challenges [for Windows 8] is how to drive the prices down," Asus chairman Jonney Shih told PCWorld in an interview. "Another is Windows 8 apps. Android is already around 700,000 apps, and Windows is still trying very hard to increase its apps."
Realistically, Microsoft doesn't have a shot of catching up to the sheer number of apps available for iOS and Android, either on Windows 8 or Windows Phone. And the company seems to realize that; Neowin says that Ballmer told employees that landing Instagram on Windows Phone is more important than landing 900,000 more lower-tier apps.
That mirrors what we've been saying since before Windows 8 launched: Microsoft needs to focus on quality apps, not the sheer quantity of apps. And that's been a struggle thus far.
"One potential fly in the ointment for Windows 8 is the lack of many top apps like Facebook, LinkedIn, Google+, and even TV apps like Time Warner Cable," Patrick Moorhead, the founder and principal analyst and Moor Insights and Strategy, recently told PCWorld.
Rhapsody was one of the big-name apps released during Build, but the Windows Store's selection still lags overall.
That lack of big-name standard bearers has an effect on the entire Windows Store ecosystem.
"There was, and is, a bit of an 'app gap,' where there may not be killer apps on the platform to help pull consumers into it, which mirrors back into the willingness of developers to write for the platform," Directions on Microsoft analyst Wes Miller recently told PCWorld. "It's a catch-22."
However, Microsoft has made improvements in this space. While there are still numerous glaring Windows Store no-shows, several big-name apps were announced for Windows 8 at Microsoft's annual Build conference— Facebook, Foursquare, and Flipboard among them—and app submissions have spiked in recent months.
Windows 8.1 is a stellar update to the core Windows 8 experience, but one that tosses few bones to users who still prefer the core Windows 7 experience.
Speaking of Build, the impending Windows 8.1 update unveiled at the conference stands ready to really polish Windows 8's rough spots and make the Windows 8 experience much more palatable. Simply put, it's a terrific update. It won't
, however, win over desktop diehards who loathe the jarring transition to the modern interface—and that makes Asus' Shih less-than-optimistic.
"In general for the total Windows 8 [experience], I think it’s not that promising," he told PCWorld. "One of the reason is, maybe, it’s still not that easy for people to switch to the new experience. For example, for Windows 8, the hottest app, sarcastically, is the one that puts the Start [button] back."
It's great to hear that Steve Ballmer and the rest of the top brass at Microsoft are aware of their biggest problems, and even better that they're taking the necessary steps to correct those issues. (Shih is glad to see the Start button's return in Windows 8.1, for example, even in its altered form.) But revolutionary change isn't accomplished overnight, and until users become accustomed to the modern UI, expecting Windows device sales to surge—for the Surface RT or anything else—may be wishing for a bit much.
One thing is certain going forward, however: In this battle of wills, Microsoft won't back down from Live Tiles.
Updated at 12:50 P.M. ET 7/26 with Microsoft comment.

Brad Chacos spends the days jamming to Spotify, digging through desktop PCs and covering everything from BYOD tablets to DIY tesla coils.
More by Brad Chacos

View the original article here