{"id":31273,"date":"2019-10-31T21:40:23","date_gmt":"2019-10-31T18:40:23","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vzlom-wpa3-dragonblood\/"},"modified":"2019-10-31T21:40:23","modified_gmt":"2019-10-31T18:40:23","slug":"vzlom-wpa3-dragonblood","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/vzlom-wpa3-dragonblood","title":{"rendered":"WPA3-hack: DragonBlood","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"WPA3-hack:
\n
\nSelvom den nye standard WPA3 endnu ikke er implementeret ordentligt, g\u00f8r sikkerhedsmangler i denne protokol det muligt for angribere at hacke Wi-Fi-adgangskoden.
\n<\/a><\/noindex>
\nWi-Fi Protected Access III (WPA3) protokollen blev lanceret i et fors\u00f8g p\u00e5 at afhj\u00e6lpe de tekniske mangler ved WPA2-protokollen, som i lang tid blev anset for usikker og s\u00e5rbar overfor KRACK-angrebet (Key Reinstallation Attack). Selvom WPA3 bygger p\u00e5 en sikrere h\u00e5ndtryk, kendt som Dragonfly, der er designet til at beskytte Wi-Fi-netv\u00e6rk mod offline ordbogsangreb, har sikkerhedsforskere Mathy Vanhoef og Eyal Ronen opdaget svagheder i den tidlige implementering af WPA3-Personal, der kan tillade en angriber at genoprette Wi-Fi-adgangskoder ved at udnytte timing eller side-cache.<\/p>\n

\"Angribere kan l\u00e6se oplysninger, som WPA3 menes at kryptere sikkert. Dette kan bruges til at stj\u00e6le fortrolige oplysninger, s\u00e5som kreditkortnumre, adgangskoder, chatbeskeder, e-mails osv.\"<\/p><\/blockquote>\n

I det offentliggjorte i dag forskningsdokument<\/a><\/noindex>, kaldet DragonBlood, unders\u00f8gte forskerne to typer designfejl i WPA3: den f\u00f8rste f\u00f8rer til nedgraderingsangreb, mens den anden f\u00f8rer til l\u00e6kager af side-cache.<\/p>\n

Cache-baseret sidekanalangreb<\/h3>\n

\nKrypteringsalgoritmen for adgangskoden i Dragonfly, ogs\u00e5 kendt som 'hunting and pecking' algoritmen, indeholder betingede grene. Hvis en angriber kan bestemme, hvilken gren af if-then-else grenen der blev valgt, kan han finde ud af, om et adgangskodeelement blev fundet i en bestemt iteration af denne algoritme. I praksis er det blevet konstateret, at hvis en angriber kan k\u00f8re umyndig kode p\u00e5 offercomputeren, er det muligt at anvende cache-baserede angreb for at bestemme, hvilken gren der blev taget i den f\u00f8rste iteration af adgangskodegenereringsalgoritmen. Denne information kan bruges til at udf\u00f8re et password-splitting-angreb (som ligner et offline ordbogsangreb).<\/p>\n

Denne s\u00e5rbarhed spores med identifikatoren CVE-2019-9494.<\/p>\n

Beskyttelse best\u00e5r i at erstatte betingede grene, der afh\u00e6nger af hemmelige v\u00e6rdier, med valg-operat\u00f8rer med konstant tid. Implementeringerne skal ogs\u00e5 bruge beregning af Legendre-symbol<\/a><\/noindex> med konstant tid.<\/p>\n

Side-channel attack based on synchronization<\/h3>\n

\nWhen the Dragonfly handshake uses specific multiplicative groups, the password encoding algorithm employs a variable number of iterations for encoding the password. The exact number of iterations depends on the password used and the MAC address of the access point and client. An attacker can perform a remote timing attack on the password encoding algorithm to determine how many iterations were used for the password encoding. The recovered information can be used to carry out a password attack similar to an offline dictionary attack.<\/p>\n

To prevent synchronization-based attacks, implementations must disable vulnerable multiplicative groups. From a technical standpoint, MODP groups 22, 23, and 24 should be disabled. It is also recommended to disable MODP groups 1, 2, and 5.<\/p>\n

This vulnerability is also tracked using the CVE-2019-9494 identifier due to the similarity of the attack implementation.<\/p>\n

WPA3 downgrade<\/h3>\n

\nAs the 15-year-old WPA2 protocol has been widely used by billions of devices, the broad adoption of WPA3 will not happen overnight. To support older devices, certified WPA3 devices offer a 'transition mode' that can be configured to accept connections using both WPA3-SAE and WPA2.<\/p>\n

Researchers believe that the transition mode is vulnerable to downgrade attacks, which attackers can exploit to create a fraudulent access point supporting only WPA2, causing devices supporting WPA3 to connect using the insecure four-way handshake of WPA2.<\/p>\n

\"We also discovered a downgrade attack against the SAE handshake itself ('Simultaneous Authentication of Equals', commonly known as 'Dragonfly'), where we can force a device to use a weaker elliptic curve than usual,\" the researchers said.<\/p><\/blockquote>\n

\nMoreover, the 'man-in-the-middle' position is not necessary to carry out a downgrade attack. Instead, attackers only need to know the SSID of the WPA3-SAE network.<\/p>\n

Forskere har rapporteret deres resultater til Wi-Fi Alliance, en non-profit organisation, der certificerer WiFi-standarder og -produkter for overensstemmelse, som har anerkendt problemer og arbejder sammen med leverand\u00f8rer for at rette eksisterende enheder certificeret med WPA3.<\/p>\n

PoC (p\u00e5 tidspunktet for offentligg\u00f8relsen - 404)<\/h3>\n

\nSom en proof of concept vil forskerne snart frigive f\u00f8lgende fire separate v\u00e6rkt\u00f8jer (i GitHub-repositorier med hyperlink nedenfor), som kan bruges til at teste s\u00e5rbarheder.<\/p>\n

Dragondrain<\/noindex> \u2014 et v\u00e6rkt\u00f8j, der kan teste, i hvilken grad et adgangspunkt er s\u00e5rbart over for DoS-angreb p\u00e5 WPA3 Dragonfly-handshake.
\nDragontime<\/noindex> \u2014 et eksperimentelt v\u00e6rkt\u00f8j til at udf\u00f8re tidsangreb p\u00e5 Dragonfly-handshake.
\nDragonforce<\/a><\/noindex> \u2014 et eksperimentelt v\u00e6rkt\u00f8j, der indhenter oplysninger til genopretning efter tidsangreb og udf\u00f8rer et password-angreb.
\nDragonslayer<\/a><\/noindex> \u2014 et v\u00e6rkt\u00f8j, der udf\u00f8rer angreb p\u00e5 EAP-pwd.<\/p>\n

Dragonblood: En sikkerhedsanalyse af WPA3’s SAE-h\u00e5ndtryk<\/a><\/noindex>
\nProjektets hjemmeside \u2014 wpa3.mathyvanhoef.com<\/a><\/noindex>
\n
Kilde: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043d\u043e\u0432\u044b\u0439 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442 WPA3 \u0435\u0449\u0435 \u0442\u043e\u043b\u043a\u043e\u043c \u043d\u0435 \u0432\u0432\u0435\u0434\u0435\u043d \u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e, \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \u044d\u0442\u043e\u043c \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u0437\u043b\u043e\u043c\u0430\u0442\u044c \u043f\u0430\u0440\u043e\u043b\u044c Wi-Fi. \u041f\u0440\u043e\u0442\u043e\u043a\u043e\u043b Wi-Fi Protected Access III (WPA3) \u0431\u044b\u043b \u0437\u0430\u043f\u0443\u0449\u0435\u043d \u0432 \u043f\u043e\u043f\u044b\u0442\u043a\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u0442\u044c \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 WPA2, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0434\u043e\u043b\u0433\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u0441\u0447\u0438\u0442\u0430\u043b\u0441\u044f \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u043c \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c \u0434\u043b\u044f KRACK-\u0430\u0442\u0430\u043a\u0438 (Key Reinstallation Attack). \u0425\u043e\u0442\u044f WPA3 \u043e\u043f\u0438\u0440\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23239,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31273","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Hacking WPA3: DragonBlood | ProHoster","description":"P\u00e5 trods af at den nye standard WPA3 stadig ikke er ordentligt implementeret.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/vzlom-wpa3-dragonblood","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u0437\u043b\u043e\u043c WPA3: DragonBlood | ProHoster","og:description":"\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043d\u043e\u0432\u044b\u0439 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442 WPA3 \u0435\u0449\u0435 \u0442\u043e\u043b\u043a\u043e\u043c \u043d\u0435 \u0432\u0432\u0435\u0434\u0435\u043d \u0432.","og:url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/vzlom-wpa3-dragonblood","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:40:23+00:00","article:modified_time":"2019-10-31T18:40:23+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31273","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 05:21:38","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:12:48","updated":"2026-01-21 05:21:38","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/31273","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=31273"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/31273\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/23239"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=31273"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=31273"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=31273"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}