Airport Network Compromised - Page 2

joe_e · 12-13-2004, 07:21 PM

I've also had this problem. The only solution I've found is to turn off wireless security altogether.

May not be a good thing for you but it works for me.

Whenever I've turned WPA security back on the messages come back.

BTW I'm using all the latest Airport software!

CAlvarez · 12-14-2004, 12:59 PM

Well, that's one way to make sure security isn't compromised...disable security.

I'm sure you know, but that's a really bad idea. At least use WEP.

joe_e · 12-14-2004, 03:33 PM

The thing is that I don't believe that this message is being shown becuase the security is being compromised. I think that it's more likely to be a bug in the software. I can easily recreate the problem by attempting to download a large file or having more than one application access the internet at the same time.

I turned the security off at home because there is a very slim chance of anyone trying to break into my network out here. Nevertheless I'll give WEP a go to see if that makes any difference

tlarkin · 04-10-2006, 01:14 PM

has anyone tried trashing their keychain prefs?

dustox · 11-03-2006, 06:26 AM

Hey guys,
I just got the same error message. I was able to grab a screenshot of it:

I'm pretty sure it was a false alarm. I googled for the term and there was another posting from somebody with the message who was using a TrendNET router, which is also what I am using. So it could be that.

It just happened once on my new MacBook Pro (which just got delivered this morning). I was copying some files between the macbook and a mac mini (plus downloading something inside of parallels on the macbook), so I could see how that could raise an alarm somehow.

Interesting that apple has code in there checking for comprises...

kkleiner · 11-22-2006, 01:06 PM

We have been seeing this for a few months - our lan uses WPA / peap / tkip.

My /var/log/system.log shows this when it occcurs:

kernel[0]: AirPort: Message Integrity Failure detected (G)
kernel[0]: AirPort: Message Integrity Failure detected (G)
kernel[0]: AirPort: MIC Failure -- activate countermeasures
kernel[0]: AirPort: Message Integrity Failure detected (G)
kernel[0]: AirPort: MIC Failure -- activate countermeasures
kernel[0]: AirPort: Link DOWN (out-of-range 0)
kernel[0]: AirPort: Link Active: "UML-IT-BG" - 0004960ccb80 - chan 6
mDNSResponder: Repeated transitions for interface en2 (FE80:0000:0000:0000:0214:51FF:FE85:FBAC); delaying packets by 5 seconds

I googled the MIC Failure and found this site :
http://www.faa.gov/about/office_org/...5_wireless.htm

and this info on it :

Privacy

A message integrity code (MIC) introduced though the 802.11i/WPA standard is a data authenticity mechanism that proves more effective than the integrity check value (ICV) within the original 802.11 standard. The MIC is used within both temporary key integrity protocol (TKIP) and counter-cipher-block chaining medium access control protocol (CCMP). The MIC is a tag computed using a keyed cryptographic function. This tag is transported over an unprotected channel with the data it is associated with. The receiver verifies its value using the same key and cryptographic function used to encode it. The MIC is susceptible to brute force attacks, so each MIC failure is assumed to be an attack. The host station and AP are required to re-key after the first attack. Any station, host station or AP will stop all communications for 60 seconds on a second attack.

Apparently a MIC failure does get viewed as an attack - not sure what this means, but I'm going to contact our Networking dept about it.

yellow · 11-22-2006, 01:21 PM

Quote:

Originally Posted by kkleiner


	mDNSResponder: Repeated transitions for interface en2 (FE80:0000:0000:0000:0214:51FF:FE85:FBAC); delaying packets by 5 seconds

en2? Which interface is that? I was under the impression that en1 was wireless typically. en2 seems to usually be Parallels' virtual switch.

trevor · 11-22-2006, 02:25 PM

Quote:

Originally Posted by yellow


	en2? Which interface is that? I was under the impression that en1 was wireless typically. en2 seems to usually be Parallels' virtual switch.

If you're using a PCI Express PowerMac G5 or a Mac Pro (and I believe some of the XServes as well), you've got two wired ethernet interfaces: en0 and en1. So on those computers a wireless Airport interface gets set as en2.

OR, your theory of a virtual switch is another possibility.

Trevor

kkleiner · 11-22-2006, 02:45 PM

Yup, it's a G5 PowerMac and en0 and en1 are wired - en2 is the airport

yellow · 11-22-2006, 02:54 PM

Ah.. right, multiple wired NICs.

dm3 · 01-26-2007, 11:19 PM

I sometimes get this error. Today I received it and the Mac did not recover. I had to reboot before it would reconnect to anything. Looking in /var/log/system.log I see the following errors:

Jan 26 22:21:15 macbook /System/Library/PrivateFrameworks/Apple80211.framework/Resources/airport: Error: WirelessAssociate2() = 88001003 for network hpinvent. errWirelessKernelError.

I'm using a DLink DI-524 router. Is it a router issue? I'm running latest firmware on the router and just applied a security update to Mac OS X 10.4.8 that I think included Airport changes.

DataRecoveryGuru · 01-29-2007, 05:48 PM

My girlfriend gets the wireless network compromised message when she connected to my Motorola wireless router with WPA on if my TiBook is already connected to the wireless. I wish I could get the issue resolved. It's a real pain to have to go use a wired computer when she needs to get online.

tlarkin · 01-30-2007, 10:25 AM

just curious is this with a new intel based mac and apple networking hardware? Something that may be unrelated but our enterprise wifi solution sees the new mac intel wifi cards as rogue APs and refuses them connections. PPC based macs work great. It is something that is baffling us and the vendor is well aware of it.

nashccast · 01-02-2008, 11:10 AM

Here's my setup - Motorola SBG900 (Comcast firmware, WPA PSK, MAC address access control), one iBook G4, one SR MacBook Pro, (both running latest Tiger).

I started getting the 'network compromised' error on my SR MBP (but not on the iBook). It got progressively worse - Initially I would get the error when the iBook woke up while the MBP was already connected. Later, the network started getting compromised randomly, even when both the machined were already active, and even the iBook network became unreliable - although it never got the compromised error message.

A LONG phone call to Apple tech support proved fruitless. (They had me verify the network connection order on the SysPref pane, but then blamed it on the router when that didn't work)

Finally, as a last try before buying a different router, I switched the security protocol from WPA PSK to WEP. Since then, no problems!

I know, of course, that WEP essentially unsecured against attacks, but since this is a home network, I chance of having to face anything like that is probably pretty low. So, if you have a similar setup, switching from WPA to WEP might work.

Sheps · 02-14-2008, 08:13 PM

Comcast firmware will not work on a SBG900. Just as a point of reference

diz · 02-26-2008, 04:37 PM

I had the same error with a Thomson TCW710 router. The strange thing is that these messages suddenly appeared without any reason (I did no installation or update; I didn't event reboot).

Since this error seems to come from a compromised message integrity code (which is susceptible to brute force attacks, as kkleiner told us), it is possible that a neighbor just stared some kind of network attack.

This is what I found in my /var/log/system.log:
Feb 26 21:42:05 Gabriel configd[36]: AppleTalk startup
Feb 26 21:42:09 Gabriel kernel[0]: en1: Group TKIP MIC failure reported!
Feb 26 21:42:09 Gabriel Apple80211Agent[24335]: *** _NSAutoreleaseNoPool(): Object 0x135c90 of class __NSCFDate autoreleased with no pool in place - just leaking\nStack: (0x961e612f 0x960f2ec2 0x38dc 0x960f95ad 0x960f9154 0x94806c55 0x94806b12)
Feb 26 21:42:10 Gabriel kernel[0]: en1: Group TKIP MIC failure reported!
Feb 26 21:42:10 Gabriel kernel[0]: en1: TKIP countermeasures enabled.
Feb 26 21:42:10 Gabriel configd[36]: AppleTalk startup complete
Feb 26 21:42:10 Gabriel configd[36]: AppleTalk shutdown
Feb 26 21:42:10 Gabriel configd[36]: AppleTalk shutdown complete

What I finally did, was to switch from WPA-PSK to WPA2-PSK... And now everything works smooth again!

tlarkin · 02-26-2008, 06:11 PM

Why are you running apple talk?

RZA · 06-28-2009, 12:20 AM

Hi, I just found this page after Googling the same problem. I just installed a NETGEAR Wireless-N router, and am on a MacBook 13". I also have a 24" iMac. Both give me the same message about every 10 minutes to anywhere as long as an hour or so. I play Xbox 360 too, and it cuts the internet connection off from Xbox LIVE as well. The exact message is, "The wireless network appears to have been compromised and will be disabled for about a minute.". Any help would be greatly appreciated, as this is greatly annoying me.

12-13-2004, 07:21 PM	#21
joe_e Prospect Join Date: Dec 2004 Location: Derby, UK Posts: 13	Turn off security I've also had this problem. The only solution I've found is to turn off wireless security altogether. May not be a good thing for you but it works for me. Whenever I've turned WPA security back on the messages come back. BTW I'm using all the latest Airport software!

12-14-2004, 12:59 PM	#22
CAlvarez Hall of Famer Join Date: Sep 2004 Location: Phoenix, AZ Posts: 4,975	Well, that's one way to make sure security isn't compromised...disable security. I'm sure you know, but that's a really bad idea. At least use WEP. __________________ -- Carlos Alvarez, Phoenix, AZ "MacBook Nano" (Lenovo S10) Atom 1.6/2GB/160GB Mac OS X 10.5.6 Gigabyte Quad Core 2.83GHz Hackintosh 4GB/500GB Mac OS X 10.6 MacBook Air 1.8/2GB/64GB SSD http://www.televolve.com

11-03-2006, 06:26 AM	#25
dustox Prospect Join Date: May 2003 Location: Vancouver Posts: 19	Hey guys, I just got the same error message. I was able to grab a screenshot of it: I'm pretty sure it was a false alarm. I googled for the term and there was another posting from somebody with the message who was using a TrendNET router, which is also what I am using. So it could be that. It just happened once on my new MacBook Pro (which just got delivered this morning). I was copying some files between the macbook and a mac mini (plus downloading something inside of parallels on the macbook), so I could see how that could raise an alarm somehow. Interesting that apple has code in there checking for comprises... __________________ Lux Delux: a mac 'Risk' game that I wrote. Check it out. \| Here's some other fun mac os x games.

01-29-2007, 05:48 PM	#32
DataRecoveryGuru Prospect Join Date: Oct 2006 Posts: 8	My girlfriend gets the wireless network compromised message when she connected to my Motorola wireless router with WPA on if my TiBook is already connected to the wireless. I wish I could get the issue resolved. It's a real pain to have to go use a wired computer when she needs to get online. __________________ SubRosaSoft.com - Data Recovery, Drive Duplication, and Mac Forensic Software For Mac OS X

01-02-2008, 11:10 AM	#34
nashccast Registered User Join Date: Jan 2008 Posts: 1	How I solved this problem.. sort of... Here's my setup - Motorola SBG900 (Comcast firmware, WPA PSK, MAC address access control), one iBook G4, one SR MacBook Pro, (both running latest Tiger). I started getting the 'network compromised' error on my SR MBP (but not on the iBook). It got progressively worse - Initially I would get the error when the iBook woke up while the MBP was already connected. Later, the network started getting compromised randomly, even when both the machined were already active, and even the iBook network became unreliable - although it never got the compromised error message. A LONG phone call to Apple tech support proved fruitless. (They had me verify the network connection order on the SysPref pane, but then blamed it on the router when that didn't work) Finally, as a last try before buying a different router, I switched the security protocol from WPA PSK to WEP. Since then, no problems! I know, of course, that WEP essentially unsecured against attacks, but since this is a home network, I chance of having to face anything like that is probably pretty low. So, if you have a similar setup, switching from WPA to WEP might work.

12-14-2004, 03:33 PM	#23
joe_e Prospect Join Date: Dec 2004 Location: Derby, UK Posts: 13	The thing is that I don't believe that this message is being shown becuase the security is being compromised. I think that it's more likely to be a bug in the software. I can easily recreate the problem by attempting to download a large file or having more than one application access the internet at the same time. I turned the security off at home because there is a very slim chance of anyone trying to break into my network out here. Nevertheless I'll give WEP a go to see if that makes any difference

04-10-2006, 01:14 PM	#24
tlarkin League Commissioner Join Date: Mar 2003 Location: Bay Area, CA Posts: 11,352	has anyone tried trashing their keychain prefs?

11-22-2006, 01:06 PM	#26
kkleiner Prospect Join Date: Feb 2003 Posts: 15	We have been seeing this for a few months - our lan uses WPA / peap / tkip. My /var/log/system.log shows this when it occcurs: kernel[0]: AirPort: Message Integrity Failure detected (G) kernel[0]: AirPort: Message Integrity Failure detected (G) kernel[0]: AirPort: MIC Failure -- activate countermeasures kernel[0]: AirPort: Message Integrity Failure detected (G) kernel[0]: AirPort: MIC Failure -- activate countermeasures kernel[0]: AirPort: Link DOWN (out-of-range 0) kernel[0]: AirPort: Link Active: "UML-IT-BG" - 0004960ccb80 - chan 6 mDNSResponder: Repeated transitions for interface en2 (FE80:0000:0000:0000:0214:51FF:FE85:FBAC); delaying packets by 5 seconds I googled the MIC Failure and found this site : http://www.faa.gov/about/office_org/...5_wireless.htm and this info on it : Privacy A message integrity code (MIC) introduced though the 802.11i/WPA standard is a data authenticity mechanism that proves more effective than the integrity check value (ICV) within the original 802.11 standard. The MIC is used within both temporary key integrity protocol (TKIP) and counter-cipher-block chaining medium access control protocol (CCMP). The MIC is a tag computed using a keyed cryptographic function. This tag is transported over an unprotected channel with the data it is associated with. The receiver verifies its value using the same key and cryptographic function used to encode it. The MIC is susceptible to brute force attacks, so each MIC failure is assumed to be an attack. The host station and AP are required to re-key after the first attack. Any station, host station or AP will stop all communications for 60 seconds on a second attack. Apparently a MIC failure does get viewed as an attack - not sure what this means, but I'm going to contact our Networking dept about it.

11-22-2006, 02:45 PM	#29
kkleiner Prospect Join Date: Feb 2003 Posts: 15	Yup, it's a G5 PowerMac and en0 and en1 are wired - en2 is the airport

11-22-2006, 02:54 PM	#30
yellow Moderator Join Date: Jan 2002 Posts: 10,677	Ah.. right, multiple wired NICs.

01-26-2007, 11:19 PM	#31
dm3 Prospect Join Date: Aug 2006 Posts: 27	I sometimes get this error. Today I received it and the Mac did not recover. I had to reboot before it would reconnect to anything. Looking in /var/log/system.log I see the following errors: Jan 26 22:21:15 macbook /System/Library/PrivateFrameworks/Apple80211.framework/Resources/airport: Error: WirelessAssociate2() = 88001003 for network hpinvent. errWirelessKernelError. I'm using a DLink DI-524 router. Is it a router issue? I'm running latest firmware on the router and just applied a security update to Mac OS X 10.4.8 that I think included Airport changes.

01-30-2007, 10:25 AM	#33
tlarkin League Commissioner Join Date: Mar 2003 Location: Bay Area, CA Posts: 11,352	just curious is this with a new intel based mac and apple networking hardware? Something that may be unrelated but our enterprise wifi solution sees the new mac intel wifi cards as rogue APs and refuses them connections. PPC based macs work great. It is something that is baffling us and the vendor is well aware of it.

02-14-2008, 08:13 PM	#35
Sheps Registered User Join Date: Feb 2008 Posts: 1	Comcast firmware will not work on a SBG900. Just as a point of reference

02-26-2008, 04:37 PM	#36
diz Registered User Join Date: Oct 2006 Posts: 1	How I solved this problem.. sort of too... I had the same error with a Thomson TCW710 router. The strange thing is that these messages suddenly appeared without any reason (I did no installation or update; I didn't event reboot). Since this error seems to come from a compromised message integrity code (which is susceptible to brute force attacks, as kkleiner told us), it is possible that a neighbor just stared some kind of network attack. This is what I found in my /var/log/system.log: Feb 26 21:42:05 Gabriel configd[36]: AppleTalk startup Feb 26 21:42:09 Gabriel kernel[0]: en1: Group TKIP MIC failure reported! Feb 26 21:42:09 Gabriel Apple80211Agent[24335]: * _NSAutoreleaseNoPool(): Object 0x135c90 of class __NSCFDate autoreleased with no pool in place - just leaking\nStack: (0x961e612f 0x960f2ec2 0x38dc 0x960f95ad 0x960f9154 0x94806c55 0x94806b12) Feb 26 21:42:10 Gabriel kernel[0]: en1: Group TKIP MIC failure reported! Feb 26 21:42:10 Gabriel kernel[0]: en1: TKIP countermeasures enabled. Feb 26 21:42:10 Gabriel configd[36]: AppleTalk startup complete Feb 26 21:42:10 Gabriel configd[36]: AppleTalk shutdown Feb 26 21:42:10 Gabriel configd[36]: AppleTalk shutdown complete What I finally did, was to switch from WPA-PSK to WPA2-PSK**... And now everything works smooth again!

02-26-2008, 06:11 PM	#37
tlarkin League Commissioner Join Date: Mar 2003 Location: Bay Area, CA Posts: 11,352	Why are you running apple talk?

06-28-2009, 12:20 AM	#38
RZA Prospect Join Date: Jun 2009 Posts: 1	Hi, I just found this page after Googling the same problem. I just installed a NETGEAR Wireless-N router, and am on a MacBook 13". I also have a 24" iMac. Both give me the same message about every 10 minutes to anywhere as long as an hour or so. I play Xbox 360 too, and it cuts the internet connection off from Xbox LIVE as well. The exact message is, "The wireless network appears to have been compromised and will be disabled for about a minute.". Any help would be greatly appreciated, as this is greatly annoying me.