OpenSSL heartbeat bug on WiFi networks (Heartbleed)

On April 7, 2014, an OpenSSL severe vulnerability in TLS heartbeat extension (CVE-2014-0160) was published that affects many services, such as Web servers, email systems, etc., and that may also affect WiFi heartbeat.

The heartbeat security breach allows remote reading of memory fragments from the TLS OpenSSL remote service. Due to the severity of this vulnerability, all OpenSSL-based software should be updated and services should be restarted to prevent an attack. While writing this article, this vulnerability has been leveraged to steal cryptographic keys, cookies, and user names and passwords from sites like Yahoo.

Heartbeat Length field has two bytes. OpenSSL does not check heartbeat byte size and relies on structure length provided by the user. As a result, 64k of data can be read from the remote service. Check if you are vulnerable to this bug here:

OpenSSL heartbeat on WiFi network

OpenSSL and WiFi Heartbeat Represent a Security Flaw on 802.1x Networks

Since Radius services such as freeradius also use TLS connections with WPA Enterprise encryption authentication (802.1x), WiFi heartbeat represents an actual security flaw that can allow unauthorized access to a corporate WiFi network.

An attacker could encapsulate messages like the ones sent by the Heartbleed script and could obtain Radius server information that would allow him access to a private WiFi network.

While viability of an attack on an EAP-TLS network and other authentication mechanisms using TLS tunnels is confirmed, it is recommended to download and install all manufacturer security updates whenever possible. Remember to update the Radius server and update the service to protect your WLAN.

Dr. Stephen Henson OpenSSL patch, the same who introduced the bug two years ago, is available here.

By | 2017-06-16T09:39:26+00:00 9 May. 2014|1 Comment

One Comment

  1. Tarlogic Security 14 June, 2015 at 21:58 - Reply

    Heartbleed attack is already implemented with a patched wpa_supplicant version and works when connecting against a PEAP , EAP-TLS or EAP-TTLS WLAN network with vulnerable openssl libraries.

    Heartbleed exploit (named Cupid) can be found at
    hostapd-wpe for openWRT also include that attack

Leave a comment

¿ Quieres conocer todo sobre Acrylic WiFi ?

We use cookies to provide social media features and to analyse our traffic. We also share information about your use of our site with advertising, analytics partners and with online chat services.

Privacy policy · Cookies info

Used by the content network, Cloudflare, to identify trusted web traffic


It's used to serve the user's preferred language on the website


These cookies help us to understand how visitors interact with our website, collecting and reporting data about your interaction within our website


Marketing cookies are used to track visitor across websites. The intention is to display ads that are relevant and engaging for the individual user an thereby more valuable for publishers and third party advertisers.