Is your wireless client software telling secrets about you.

If you use the windows XP built in client to manage your wireless connections listen up.
It appears that the client software has a bug feature that will broadcast networks you have trusted to anyone who is close enough to hear it. The kicker is that Microsoft hasn’t pushed this fix down through the normal “keep my computer up to date” channels. You have to actively seek this patch, download it and install it to fix your wireless client.

Steve Gibson from www.grc.com (link)

A completely patched, like right up to date, XP system that includes wireless will not have a client update to the Windows – it goes by various names, like Wireless Zero Configuration, WZC. But it will not have a really important update which all XP Service Pack 2 people will really want to incorporate. So it’s something that Microsoft – it turns out it was on October 17 of ’06, so only a few months ago, that Microsoft released this to fix a whole bunch of holes in this Wireless Zero Configuration. But they never put it on their list of stuff that you’d like to have automatically downloaded into your machine.

He goes on to say:
“If no infrastructure mode networks are present, wireless auto configuration sends probe requests out to try to connect to the first ad hoc wireless network in the preferred networks list. An observer could monitor these probe requests and establish an unsecured connection with a Windows wireless client.”

To fix the issue get this patch.

Technorati Tags: client, Windows, Wireless Zero Configuration, ad hoc, wireless client, patch

This entry was posted on Wednesday, March 14th, 2007 at 10:05 am and is filed under Security. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.