- Synacktiv testers collected hundreds of hashed staff credentials in minutes on an open Wi-Fi network whose users were meant to rely on a certificate-protected VPN.
- The leak happened on the local network, before the VPN started, and led to access to multiple Office 365 accounts in that one engagement.
- Leaders should ask whether open staff Wi-Fi exists, whether client isolation is tested, and whether legacy name-lookup protocols and WEP devices remain.
A company can lock its VPN with client certificates and still leak its staff's login credentials. Security firm Synacktiv describes exactly that in a write-up of Wi-Fi findings from its penetration tests, which are authorised break-in exercises. The testers collected scrambled forms of staff passwords, and some could be cracked. The lesson is that a strong door does not help if the hallway outside it is shouting.
What the testers found
Synacktiv met a corporate environment that ran an open Wi-Fi network for employees. The security plan was simple. Every employee would connect at once to a VPN that demanded a client certificate.
The testers could not get into the VPN without a certificate. That part held. But the weakness sat on the local Wi-Fi itself, before any VPN started.
Within a few minutes, the testers collected hundreds of hashed credentials from employee accounts. A hash is a scrambled form of a password. It is not the password, but Synacktiv says several of these could be cracked offline.
That gave the testers valid corporate credentials. With them, they reached multiple Office 365 accounts. Synacktiv notes this could lead to further compromise, such as looting SharePoint and Outlook. This was one engagement, so it shows what is possible, not how common it is.
How the trick works
Windows devices on a local network ask their neighbours for help finding other machines. They use older name-lookup protocols called LLMNR and mDNS. The questions go out as broadcasts, so anyone on the network hears them.
The testers ran a tool called Responder.py. It answers those broadcasts with false replies. The employee's device then tries to log in to the tester's machine and sends a hashed proof of the password.
The VPN never entered the picture. The leak happened on the local network, before the VPN could protect anything. Synacktiv adds that the number of people on the same open network made the attack very efficient.
What newer standards fix, and what they leave
Synacktiv describes real progress. Opportunistic Wireless Encryption (OWE) gives each person on an open network their own encryption key, with no password to type. That protects against simple eavesdropping.
OWE is built on WPA3 and includes Protected Management Frames (802.11w). These stop attackers from forging messages that knock devices off the network. Synacktiv says this protection is enforced on WPA3 without Transition Mode.
The report is clear about the limits. Anyone can still join an open network, even with OWE. Fake copies of a network name, known as evil twins, remain possible, though harder. Synacktiv says no sensitive assets should be exposed on such networks.
For the case above, Synacktiv points to client isolation and overall network filtering as essential for open Wi-Fi. Client isolation stops devices on the same network from talking to each other. Synacktiv calls it a baseline control for modern guest networks. It also says it never takes it for granted and always verifies that it is enforced.
The old protocols have not left
WEP was ratified in 1999 and deprecated by the Wi-Fi Alliance in 2004. Synacktiv still finds it, mostly in industrial settings and on old, forgotten routers. Legacy equipment such as old manufacturing machines and specialised printers sometimes cannot support newer protocols.
The flaw is built into the design. WEP uses a 24-bit value, called an Initialization Vector, that repeats quickly on a busy network. Synacktiv says later attacks cut the packets needed to crack the key from millions to tens of thousands. Tools to do it are freely documented.
Questions for your security team
The idea to take away is this. A VPN protects what travels through it. It does not protect what the laptop says before it connects. Treat the Wi-Fi as a place where trust must be earned, not assumed.
Ask your team these questions. Do we run an open network for staff, and if so, why? Is client isolation enforced and tested on guest networks? Are LLMNR and mDNS turned off on Windows devices where they are not needed? If a password hash leaks, what else stands between it and our Office 365 accounts? And do we know whether any WEP device still sits on our sites?
Synacktiv's article, as available to us, was cut off partway through its WEP section. This story covers only the parts we could read.
A locked VPN is a good decision. It only works if the network around it is not telling attackers where to knock.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Synacktiv.
