Microsoft: Windows Phone passwords can be accessed via rogue WiFi hotspot

Microsoft has issued a security advisory concerning a Windows Phone vulnerability when connecting to rogue Wi-Fi networks.

The issue at hand rests in a Wi-Fi authentication scheme (PEAP-MS-CHAPv2) which Windows Phones use to access protected wireless networks (for WPA2 wireless authentication). Cryptographic weaknesses in the technology can allow an attacker to recover a Windows Phone encrypted domain credentials (passwords) when it connects to a rogue access point.

Microsoft Security Advisory (2876146)