Mathy Vanhoef, forfatteren af KRACK-angrebet på trådløse netværk med WPA2, og Eyal Ronen, medforfatter af nogle angreb på TLS, har afsløret oplysninger om seks sårbarheder (CVE-2019-9494 — CVE-2019-9499) i WPA3-sikkerhedsteknologier, der muliggør rekonstruktion af adgangskoden og adgang til det trådløse netværk uden at kende adgangskoden. Sårbarhederne er samlet under kodeordet Dragonblood og muliggør kompromittering af Dragonfly-forhandlingsmetoden, der tilbyder beskyttelse mod offline-parametrering af adgangskode. Udover WPA3 anvendes Dragonfly-metoden også til beskyttelse mod ordbogside angreb i EAP-pwd-protokollen, som anvendes i Android, RADIUS-servere og hostapd/wpa_supplicant.
Forskningen har afsløret to hovedtyper af arkitekturproblemer i WPA3. Begge typer problemer kan i sidste ende bruges til at rekonstruere adgangskoden. Den første type tillader et nedgraderingsangreb (downgrade attack) til usikre kryptografiske metoder: midler til at sikre kompatibilitet med WPA2 (transittilstand, der tillader brug af WPA2 og WPA3) gør det muligt for en angriber at tvinge klienten til at gennemføre den WPA2-firetrinsforhandlingsprotokol, hvilket gør det muligt at anvende klassiske angreb på adgangskoder, der kan benyttes mod WPA2. Desuden er der også identificeret muligheden for direkte nedgraderingsangreb på Dragonfly-forhandlingsmetoden, der muliggør tilbagevenden til mindre sikre typer af elliptiske kurver.
Den anden type problemer medfører lækage af oplysninger om adgangskodens karakteristika gennem sidekanaler og baseres på mangler i den password-kodningsmetode, der anvendes i Dragonfly, som gør det muligt at rekonstruere den oprindelige adgangskode baseret på indirekte data, såsom ændringer i forsinkelser under operationer. Den algoritme, der anvendes i Dragonfly til at transformere hash til en elliptisk kurve (hash-to-curve), er udsat for angreb gennem overvågning af data, der "sætter sig" i processorens cache (cache attack), og algoritmen til hash til gruppe (hash-to-group) er udsat for angreb ved at måle tidsforbruget for operationer (timing attack).
For an attacker to carry out cache analysis attacks, they must be able to execute unprivileged code on the user's system that connects to the wireless network. Both methods allow the attacker to obtain information necessary to refine the selection of password parts during the cracking process. The effectiveness of the attack is quite high, enabling the cracking of an 8-character password, including lowercase letters, by intercepting only 40 connection handshake sessions and spending resources equivalent to renting Amazon EC2 capacities at 125 dollars.
Based on identified vulnerabilities, several attack scenarios have been proposed:
- Rollback attack on WPA2 with the possibility of dictionary attacks. In cases where both the client and access point support both WPA3 and WPA2, the attacker can deploy their own rogue access point with the same network name that only supports WPA2. In this situation, the client will use the WPA2 connection negotiation method, during which it will determine the inadmissibility of such a rollback, but this will happen at a stage when channel negotiation messages have been sent and all the necessary information for the dictionary attack has already leaked. A similar method is applicable for rolling back to problematic versions of elliptic curves in SAE.
Moreover, it has been found that the iwd daemon, developed by Intel as an alternative to wpa_supplicant, and the wireless stack of the Samsung Galaxy S10 are susceptible to downgrade attacks even in networks that only use WPA3 — if these devices had previously connected to a WPA3 network, they would attempt to connect to a rogue WPA2 network with the same name.
- Side-channel attack extracting information from the processor cache. The password encoding algorithm in Dragonfly contains conditional branching, and an attacker, having the capability to execute code in the user's wireless network system, can determine which block from the if-then-else expression was selected based on cache behavior analysis. The information obtained can be used to carry out a targeted password guessing attack, employing methods similar to performing offline dictionary attacks for WPA2 password cracking. To protect against this, it is recommended to use operations with constant execution times, independent of the nature of the data being processed;
- Timing attack. In the Dragonfly code for password encoding, several multiplicative groups (MODP) and a variable number of iterations are used, with the count depending on the password and the MAC address of the access point or client. A remote attacker can determine how many iterations were performed during password encoding and use this as an indicator in the targeted password guessing process.
- Denial-of-service attack. An attacker can disable certain functions of the access point by exhausting available resources through sending a large number of channel negotiation requests. To bypass the flood protection provided in WPA3, it is sufficient to send requests from fake, non-repeating MAC addresses.
- Fallback to less secure cryptographic groups used during the connection negotiation process in WPA3. For example, if the client supports elliptic curves P-521 and P-256, and uses P-521 as the preferred option, the attacker, regardless of support for P-521 on the access point side, can force the client to use P-256. The attack is carried out by filtering some messages during the connection negotiation process and sending fake messages indicating the lack of support for certain types of elliptic curves.
To check devices for vulnerabilities, several scripts with examples of attack execution have been prepared:
Dragonslayer — implementation of attacks on EAP-pwd;
- Dragonslayer - implementering af angreb på EAP-pwd;
- Dragondrain — et værktøj til at verificere sårbarhedspunkterne ved implementeringen af SAE (Simultaneous Authentication of Equals), som kan anvendes til at initiere en denial-of-service-angreb;
- Dragontime — et script til at udføre angreb via tredjeparts kanaler mod SAE, der tager højde for forskelle i behandlingstiden for operationer ved brug af MODP grupperne 22, 23 og 24;
- Dragonforce — et værktøj til datarekonstruktion (adgangskodegennemsøgning) baseret på forskellene i behandlingstiden for operationer eller for at bestemme datatransfer i cachen.
Wi-Fi Alliance, som udvikler standarder for trådløse netværk, har erklæret, at problemet påvirker et begrænset antal tidlige implementeringer af WPA3-Personal og kan løses gennem firmware- og softwareopdateringer. Der er ikke registreret tilfælde af misbrug af sårbarhederne til ondsindede handlinger. For at styrke sikkerheden har Wi-Fi Alliance tilføjet yderligere tests til certificeringsprogrammet for trådløse enheder, for at kontrollere korrektheden af implementeringerne, samt kontaktet enhedsproducenterne for at koordinere afhjælpningen af de identificerede problemer. Patches til fejlretning er allerede blevet frigivet for hostap/wpa_supplicant. Opdateringer er tilgængelige for Ubuntu. I Debian, RHEL, SUSE/openSUSE, Arch, Fedora og FreeBSD er problemerne stadig uoprettede.
Kilde: opennet.ru
