The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Stefan Winter <stefan.winter AT restena.lu>]

Hello,

> On my phone I did not install anything, I just looked for the eduroam
> network in the fields of the university and I connected only by entering
> the user and password.

That in itself is a big mistake: with that method, you send your
username and password to any network, genuine or not, meaning that an
attacker can set up a network with the name "eduroam" to steal your
password.

The entire point of tools like eduroam CAT is to make your device check
the server's identity - is it the genuine authentication server? - and
only then send your password to it.

It's not surprising that it "worked" without any security checks. That
doesn't mean that this is the way to do it.

> On my pc, the error message appears before and
> after using the installer for windows 10, when I want to connect to the
> network I can not and I get the message that can not connect to the network.

If your connection fails *when* server checks are being done then there
is a good chance that you are indeed connecting to an unauthorised
server instead of the genuine one (i.e. an attacker of sorts, often
called "rogue AP").

The installer on your Windows PC then prevents your username and
password to leak to that attacker; while your phone merrily gives it away.

You should urgently follow this up with your IT department. Either they
made a mistake in their setup of the server-side security checks (but as
I wrote earlier, their configuration as uploaded to the CAT website
looks very good indeed), or there is an attacker around. In the latter
case, you may want to change your password.

Greetings,

Stefan Winter

> 
> 2018-05-09 0:59 GMT-05:00 Stefan Winter 
> <stefan.winter AT restena.lu
> <mailto:stefan.winter AT restena.lu>>:
> 
>     Hello,
> 
>     > I can not access the eduroam network, enter my username and correct
>     > password and a message saying "can not access the network"
>     appears. this
>     > happens with my pc, in my cell phone I can enter. I am a student
>     at the
>     > Universidad Tecnica del Norte in Ibarra-Ecuador. I have already
>     > installed the installer with the name "eduroam-W10-UTdN-U", but it
>     does
>     > not work, please help me. Thank you
> 
>     I have just checked some of the security settings for the realm
>     @utn.edu.ec <http://utn.edu.ec>. Everything seems to be correct
>     there, and the realm is also
>     reachable in eduroam.
> 
>     When you write "it does not work" - do you get some kind of error
>     message from the W10 installer, or is it only the subsequent connection
>     that doesn't succeed?
> 
>     On your phone, did you install eduroam with the eduroamCAT app or did
>     you simply fill in username and password, without avtivating server-side
>     security checks?
> 
>     Greetings,
> 
>     Stefan Winter
> 
>     -- 
>     Stefan WINTER
>     Ingenieur de Recherche
>     Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
>     de la Recherche
>     2, avenue de l'Université
>     L-4365 Esch-sur-Alzette
> 
>     Tel: +352 424409 1
>     Fax: +352 422473
> 
>     PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
>     recipient's key is known to me
> 
>     http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66
>     <http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66>
> 
> 


-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
de la Recherche
2, avenue de l'Université
L-4365 Esch-sur-Alzette

Tel: +352 424409 1
Fax: +352 422473

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
recipient's key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

Attachment: 0xC0DE6A358A39DC66.asc
Description: application/pgp-keys

Attachment: signature.asc
Description: OpenPGP digital signature