{"id":36788,"date":"2019-10-31T22:13:49","date_gmt":"2019-10-31T19:13:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novye-uyazvimosti-v-tehnologii-zashhity-besprovodnyh-setej-wpa3-i-v-eap-pwd\/"},"modified":"2019-10-31T22:13:49","modified_gmt":"2019-10-31T19:13:49","slug":"novye-uyazvimosti-v-tehnologii-zashhity-besprovodnyh-setej-wpa3-i-v-eap-pwd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/novye-uyazvimosti-v-tehnologii-zashhity-besprovodnyh-setej-wpa3-i-v-eap-pwd","title":{"rendered":"Nov\u00e9 zranitelnosti v technologii ochrany bezdr\u00e1tov\u00fdch s\u00edt\u00ed WPA3 a v EAP-pwd","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Mathy Vanhoef a Eyal RonenEyal Ronen<\/a><\/noindex>) odhalili<\/a><\/noindex> p\u0159edstavili novou metodu \u00fatoku (CVE-2019-13377) na bezdr\u00e1tov\u00e9 s\u00edt\u011b vyu\u017e\u00edvaj\u00edc\u00ed bezpe\u010dnostn\u00ed technologii WPA3, kter\u00e1 umo\u017e\u0148uje z\u00edskat informace o charakteristik\u00e1ch hesla, kter\u00e9 lze pou\u017e\u00edt pro offline \u00fatok. Probl\u00e9m se projevuje v aktu\u00e1ln\u00ed verzi Hostapd<\/a><\/noindex>.<\/p>\n

P\u0159ipome\u0148me, \u017ee v dubnu t\u00fdmi\u017e autory bylo identifikov\u00e1no byly odhaleny<\/a><\/noindex> \u0161est zranitelnost\u00ed ve WPA3, proti kter\u00fdm se Wi-Fi Alliance, organizace vyv\u00edjej\u00edc\u00ed standardy pro bezdr\u00e1tov\u00e9 s\u00edt\u011b, rozhodla prov\u00e9st zm\u011bny v doporu\u010den\u00edch pro zaji\u0161t\u011bn\u00ed bezpe\u010dn\u00fdch implementac\u00ed WPA3, kde bylo p\u0159edeps\u00e1no pou\u017e\u00edt chr\u00e1n\u011bn\u00e9 eliptick\u00e9 k\u0159ivky Brainpool<\/a><\/noindex>, nam\u00edsto d\u0159\u00edve povolen\u00fdch eliptick\u00fdch k\u0159ivek P-521 a P-256. <\/p>\n

Nicm\u00e9n\u011b anal\u00fdza uk\u00e1zala, \u017ee pou\u017eit\u00ed Brainpool vede k vzniku nov\u00e9 t\u0159\u00eddy \u00fanik\u016f skrze alternativn\u00ed kan\u00e1ly v algoritmu pro dohodu o p\u0159ipojen\u00ed pou\u017e\u00edvan\u00e9m ve WPA3 Dragonfly<\/a><\/noindex>, poskytuj\u00edc\u00edm<\/a><\/noindex> ochranu proti offline \u00fatok\u016fm na hesla. Identifikovan\u00fd probl\u00e9m ukazuje, \u017ee vytvo\u0159en\u00ed implementac\u00ed Dragonfly a WPA3 bez \u00fanik\u016f dat skrze alternativn\u00ed kan\u00e1ly je extr\u00e9mn\u011b slo\u017eit\u00fd \u00fakol a rovn\u011b\u017e demonstruje neudr\u017eitelnost v\u00fdvoje standard\u016f za zav\u0159en\u00fdmi dve\u0159mi bez proveden\u00ed ve\u0159ejn\u00e9 diskuse o navrhovan\u00fdch metod\u00e1ch a auditu ve\u0159ejnost\u00ed.<\/p>\n

P\u0159i pou\u017eit\u00ed eliptick\u00e9 k\u0159ivky Brainpool p\u0159i k\u00f3dov\u00e1n\u00ed hesla algoritmem Dragonfly se prov\u00e1d\u00ed n\u011bkolik p\u0159edb\u011b\u017en\u00fdch iterac\u00ed s heslem, kter\u00e9 se t\u00fdkaj\u00ed rychl\u00e9ho v\u00fdpo\u010dtu kr\u00e1tk\u00e9ho hash p\u0159ed za\u010d\u00e1tkem aplikace eliptick\u00e9 k\u0159ivky. P\u0159ed nalezen\u00edm kr\u00e1tk\u00e9ho hashe z\u00e1vis\u00ed prov\u00e1d\u011bn\u00e9 operace p\u0159\u00edmo na hesle a MAC adrese klienta. \u010cas proveden\u00ed (koresponduje s po\u010dtem iterac\u00ed) a zpo\u017ed\u011bn\u00ed mezi operacemi b\u011bhem prov\u00e1d\u011bn\u00ed p\u0159edb\u011b\u017en\u00fdch iterac\u00ed mohou b\u00fdt m\u011b\u0159eny a pou\u017eity k ur\u010den\u00ed charakteristik hesla, kter\u00e9 lze offline vyu\u017e\u00edt pro ov\u011b\u0159en\u00ed spr\u00e1vnosti v\u00fdb\u011bru \u010d\u00e1st\u00ed hesla b\u011bhem jeho uhodnut\u00ed. Pro proveden\u00ed \u00fatoku je nutn\u00fd p\u0159\u00edstup k syst\u00e9mu u\u017eivatele p\u0159ipojuj\u00edc\u00edho se k bezdr\u00e1tov\u00e9 s\u00edti. <\/p>\n

Krom\u011b toho v\u00fdzkumn\u00edci zjistili druhou zranitelnost (CVE-2019-13456), kter\u00e1 se t\u00fdk\u00e1 \u00faniku informac\u00ed v implementaci protokolu EAP-pwd<\/a><\/noindex>, pou\u017e\u00edvaj\u00edc\u00ed algoritmus Dragonfly. Probl\u00e9m je specifick\u00fd pro RADIUS server FreeRADIUS a na z\u00e1klad\u011b \u00faniku informac\u00ed z extern\u00edch zdroj\u016f, stejn\u011b jako prvn\u00ed zranitelnost, v\u00fdrazn\u011b usnad\u0148uje z\u00edsk\u00e1n\u00ed hesla. <\/p>\n

V kombinaci se zlep\u0161enou metodou filtrov\u00e1n\u00ed \u0161umu p\u0159i m\u011b\u0159en\u00ed zpo\u017ed\u011bn\u00ed pro ur\u010den\u00ed po\u010dtu iterac\u00ed sta\u010d\u00ed prov\u00e9st 75 m\u011b\u0159en\u00ed pro jednu MAC adresu. P\u0159i vyu\u017eit\u00ed GPU se n\u00e1klady na zdroje pro z\u00edsk\u00e1n\u00ed jednoho hesla ze slovn\u00edku odhaduj\u00ed na 1 $. Metody zvy\u0161uj\u00edc\u00ed bezpe\u010dnost protokol\u016f, kter\u00e9 umo\u017e\u0148uj\u00ed blokovat odhalen\u00e9 probl\u00e9my, byly ji\u017e zahrnuty do n\u00e1vrh\u016f budouc\u00edch standard\u016f Wi-Fi (WPA 3.1<\/a><\/noindex>) a EAP-pwd<\/a><\/noindex>. Bohu\u017eel bez poru\u0161en\u00ed zp\u011btn\u00e9 kompatibility v aktu\u00e1ln\u00edch verz\u00edch protokol\u016f nebude mo\u017en\u00e9 odstranit \u00faniky informac\u00ed z extern\u00edch zdroj\u016f.<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041c\u044d\u0442\u0438 \u0412\u0430\u043d\u0445\u043e\u0444\u043e\u043c (Mathy Vanhoef) \u0438 \u042d\u044f\u043b\u044c \u0420\u043e\u043d\u0435\u043d (Eyal Ronen) \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 (CVE-2019-13377) \u043d\u0430 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0435 \u0441\u0435\u0442\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044e \u0437\u0430\u0449\u0438\u0442\u044b WPA3, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u0438\u0441\u0442\u0438\u043a\u0430\u0445 \u043f\u0430\u0440\u043e\u043b\u044f, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0435\u0433\u043e \u043f\u043e\u0434\u0431\u043e\u0440\u0430 \u0432 offline-\u0440\u0435\u0436\u0438\u043c\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 Hostapd. \u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c, \u0447\u0442\u043e \u0432 \u0430\u043f\u0440\u0435\u043b\u0435 \u0442\u0435\u043c\u0438 \u0436\u0435 \u0430\u0432\u0442\u043e\u0440\u0430\u043c\u0438 \u0431\u044b\u043b\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0448\u0435\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 WPA3, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-36788","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Nov\u00e9 zranitelnosti v technologii ochrany bezdr\u00e1tov\u00fdch s\u00edt\u00ed WPA3 a v EAP-pwd | ProHoster","description":"Mathy Vanhoef a Eyal Ronen identifikovali.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/novye-uyazvimosti-v-tehnologii-zashhity-besprovodnyh-setej-wpa3-i-v-eap-pwd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u043e\u0432\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0437\u0430\u0449\u0438\u0442\u044b \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 WPA3 \u0438 \u0432 EAP-pwd | ProHoster","og:description":"\u041c\u044d\u0442\u0438 \u0412\u0430\u043d\u0445\u043e\u0444\u043e\u043c (Mathy Vanhoef) \u0438 \u042d\u044f\u043b\u044c \u0420\u043e\u043d\u0435\u043d (Eyal Ronen) \u0432\u044b\u044f\u0432\u0438\u043b\u0438.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/novye-uyazvimosti-v-tehnologii-zashhity-besprovodnyh-setej-wpa3-i-v-eap-pwd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:13:49+00:00","article:modified_time":"2019-10-31T19:13:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36788","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 04:50:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:38:25","updated":"2026-01-22 04:50:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/36788","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=36788"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/36788\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=36788"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=36788"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=36788"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}