V otev\u0159en\u00fdch bal\u00ed\u010dc\u00edch IWD (Intel inet Wireless Daemon) a wpa_supplicant, pou\u017e\u00edvan\u00fdch k p\u0159ipojen\u00ed klientsk\u00fdch Linux syst\u00e9m\u016f k bezdr\u00e1tov\u00e9 s\u00edti, byly zji\u0161t\u011bny zranitelnosti, kter\u00e9 umo\u017e\u0148uj\u00ed obch\u00e1zen\u00ed autentiza\u010dn\u00edch mechanism\u016f: <\/p>\n
Zranitelnost je zp\u016fsobena nedostate\u010dnou kontrolou posloupnosti v\u0161ech krok\u016f b\u011bhem 4-f\u00e1zov\u00e9ho vyjedn\u00e1v\u00e1n\u00ed kan\u00e1lu, kter\u00e9 se pou\u017e\u00edv\u00e1 p\u0159i prvn\u00edm p\u0159ipojen\u00ed k zabezpe\u010den\u00e9 bezdr\u00e1tov\u00e9 s\u00edti. Proto\u017ee IWD p\u0159ij\u00edm\u00e1 zpr\u00e1vy pro jakoukoli f\u00e1zi vyjedn\u00e1v\u00e1n\u00ed p\u0159ipojen\u00ed, ani\u017e by kontroloval, zda byla dokon\u010dena p\u0159edchoz\u00ed f\u00e1ze, m\u016f\u017ee \u00fato\u010dn\u00edk p\u0159esko\u010dit odesl\u00e1n\u00ed zpr\u00e1vy druh\u00e9 f\u00e1ze a hned poslat zpr\u00e1vu \u010dtvrt\u00e9 f\u00e1ze, \u010d\u00edm\u017e z\u00edsk\u00e1 p\u0159\u00edstup do s\u00edt\u011b, ani\u017e by pro\u0161el f\u00e1z\u00ed, ve kter\u00e9 se prov\u00e1d\u00ed kontrola autentizace. <\/p>\n
P\u0159itom IWD se pokou\u0161\u00ed ov\u011b\u0159it k\u00f3d MIC (Message Integrity Code) pro p\u0159ijatou zpr\u00e1vu \u010dtvrt\u00e9 f\u00e1ze. Proto\u017ee zpr\u00e1va druh\u00e9 f\u00e1ze s autentiza\u010dn\u00edmi parametry nebyla p\u0159ijata, p\u0159i zpracov\u00e1n\u00ed zpr\u00e1vy \u010dtvrt\u00e9 f\u00e1ze je kl\u00ed\u010d PTK (Pairwise Transient Key) nastaven na nulu. \u00dato\u010dn\u00edk tedy m\u016f\u017ee vypo\u010d\u00edtat MIC pomoc\u00ed nulov\u00e9ho PTK, a tento kontroln\u00ed k\u00f3d bude IWD p\u0159ijat jako spr\u00e1vn\u00fd. Po ukon\u010den\u00ed takov\u00e9ho nedokon\u010den\u00e9ho vyjedn\u00e1v\u00e1n\u00ed p\u0159ipojen\u00ed z\u00edsk\u00e1 \u00fato\u010dn\u00edk pln\u00fd p\u0159\u00edstup k bezdr\u00e1tov\u00e9 s\u00edti, proto\u017ee p\u0159\u00edstupov\u00fd bod bude p\u0159ij\u00edmat odes\u00edlan\u00e9 pakety, za\u0161ifrovan\u00e9 nulov\u00fdm kl\u00ed\u010dem PTK. <\/p>\n
V d\u016fsledku nedostatku v implementaci protokolu PEAP (Protected Extensible Authentication Protocol) m\u016f\u017ee \u00fato\u010dn\u00edk dos\u00e1hnout p\u0159ehl\u00e9dnut\u00ed druh\u00e9 f\u00e1ze autentifikace p\u0159i p\u0159ipojen\u00ed nespr\u00e1vn\u011b nastaven\u00e9ho u\u017eivatelsk\u00e9ho za\u0159\u00edzen\u00ed. P\u0159ehl\u00e9dnut\u00ed druh\u00e9 f\u00e1ze autentifikace umo\u017e\u0148uje \u00fato\u010dn\u00edkovi vytvo\u0159it podvodnou klonovanou d\u016fv\u011bryhodnou Wi-Fi s\u00ed\u0165 a zajistit, aby se u\u017eivatel p\u0159ipojil k fiktivn\u00ed s\u00edti bez kontroly hesla. <\/p>\n
Pro \u00fasp\u011b\u0161n\u00e9 proveden\u00ed \u00fatoku na wpa_supplicant na stran\u011b u\u017eivatele mus\u00ed b\u00fdt vypnuta kontrola TLS certifik\u00e1tu<\/a> serveru a \u00fato\u010dn\u00edk mus\u00ed zn\u00e1t identifik\u00e1tor bezdr\u00e1tov\u00e9 s\u00edt\u011b (SSID, Service Set Identifier). P\u0159i\u010dem\u017e \u00fato\u010dn\u00edk mus\u00ed b\u00fdt ve vzd\u00e1lenosti bezdr\u00e1tov\u00e9ho adapt\u00e9ru ob\u011bti, ale mimo dosah p\u0159\u00edstupov\u00e9ho bodu klonovan\u00e9 bezdr\u00e1tov\u00e9 s\u00edt\u011b. \u00datok je mo\u017en\u00fd na s\u00edt\u00edch s WPA2-Enterprise nebo WPA3-Enterprise, kde se pou\u017e\u00edv\u00e1 protokol PEAP. <\/p>\n V\u00fdvoj\u00e1\u0159i wpa_supplicant uvedli, \u017ee nepova\u017euj\u00ed probl\u00e9m za zranitelnost, proto\u017ee se projevuje pouze v nespr\u00e1vn\u011b nastaven\u00fdch bezdr\u00e1tov\u00fdch s\u00edt\u00edch, kde se autentifikace EAP pou\u017e\u00edv\u00e1 spolu s protokolem PEAP (EAP-TTLS) bez kontroly TLS certifik\u00e1tu. serveru<\/a>Konfigurace bez kontroly certifik\u00e1tu nemaj\u00ed ochranu p\u0159ed aktivn\u00edmi \u00fatoky. Ti, kdo zranitelnost odhalili, tvrd\u00ed, \u017ee takov\u00e9 nespr\u00e1vn\u00e9 konfigurace jsou typick\u00e9 a \u0161iroce roz\u0161\u00ed\u0159en\u00e9, co\u017e ohro\u017euje mnoho spot\u0159ebitelsk\u00fdch za\u0159\u00edzen\u00ed zalo\u017een\u00fdch na Linuxu, Androidu a Chrome OS, na kter\u00fdch se pou\u017e\u00edv\u00e1 wpa_supplicant. <\/p>\n K blokaci probl\u00e9mu v wpa_supplicant byl vyd\u00e1n patch, kter\u00fd p\u0159id\u00e1v\u00e1 re\u017eim povinn\u00e9ho projit\u00ed druh\u00e9 f\u00e1ze autentifikace, krom\u011b kontroly TLS certifik\u00e1tu. Podle v\u00fdvoj\u00e1\u0159\u016f je navr\u017een\u00e1 zm\u011bna pouze obezli\u010dkou, kter\u00e1 zt\u011b\u017euje prov\u00e1d\u011bn\u00ed \u00fatok\u016f p\u0159i pou\u017eit\u00ed ru\u010dn\u00ed autentifikace a je ne\u00fa\u010dinn\u00e1 p\u0159i pou\u017eit\u00ed takov\u00fdch voleb, jako je EAP-GTC. Pro skute\u010dn\u00e9 \u0159e\u0161en\u00ed probl\u00e9mu by administr\u00e1to\u0159i s\u00edt\u00ed m\u011bli uv\u00e9st sv\u00e9 konfigurace do po\u0159\u00e1dku, tj. nastavit \u0159et\u011bzec d\u016fv\u011bry pro kontrolu certifik\u00e1tu serveru pomoc\u00ed parametru ca_cert. <\/ul>\n