{"id":31424,"date":"2019-10-31T21:41:11","date_gmt":"2019-10-31T18:41:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimosti-v-tehnologii-zashhity-besprovodnyh-setej-wpa3-i-v-eap-pwd\/"},"modified":"2019-10-31T21:41:11","modified_gmt":"2019-10-31T18:41:11","slug":"uyazvimosti-v-tehnologii-zashhity-besprovodnyh-setej-wpa3-i-v-eap-pwd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-tehnologii-zashhity-besprovodnyh-setej-wpa3-i-v-eap-pwd","title":{"rendered":"Vulnerabilities in WPA3 wireless security technology and EAP-pwd","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Mathy Vanhoef, the author of the KRACK attack on wireless networks with WPA2, and Eyal Ronen, co-author of some attacks on TLS, have disclosed six vulnerabilities (CVE-2019-9494 \u2014 CVE-2019-9499) in the WPA3 wireless network protection technology. These vulnerabilities allow for the recreation of connection passwords and access to wireless networks without the knowledge of the password. The vulnerabilities are collectively named Dragonblood and can compromise the Dragonfly connection negotiation method, which provides protection against offline password guessing. In addition to WPA3, the Dragonfly method is also used to protect against dictionary attacks in the EAP-pwd protocol, implemented in Android, RADIUS servers, and hostapd\/wpa_supplicant.<\/p>\n
The research identified two main types of architectural issues in WPA3. Both types of problems can ultimately be exploited to recreate the access password. The first type allows a fallback to less secure cryptographic methods (downgrade attack): compatibility features with WPA2 (transition mode allowing the use of both WPA2 and WPA3) enable an attacker to force the client to perform the WPA2 four-way handshake, thereby allowing the use of classical password guessing attacks applicable to WPA2. Additionally, a downgrade attack directly on the Dragonfly handshake method has also been discovered, allowing a fallback to less secure types of elliptic curves.<\/p>\n
The second type of issues leads to information leakage through side channels about the characteristics of the password and is based on flaws in the password encoding method in Dragonfly. These flaws allow for the recreation of the original password from indirect data, such as changes in delays during operations. The hash-to-curve algorithm used in Dragonfly was found to be vulnerable to attacks via monitoring information leakage in the processor cache (cache attack), while the hash-to-group algorithm is vulnerable to attacks through timing measurements of operation execution (timing attack).<\/p>\n
To carry out attacks through cache analysis, an attacker must be able to execute non-privileged code on the user's system connecting to the wireless network. Both methods provide the means to obtain information necessary for refining the correct choice of password components during the cracking process. The effectiveness of the attack is quite high and allows for the cracking of an 8-character password that includes lowercase letters by intercepting just 40 connection handshake sessions and consuming resources equivalent to renting Amazon EC2 capacity for $125. <\/p>\n
Based on the identified vulnerabilities, several attack scenarios have been proposed:<\/p>\n
\n
Rollback attack on WPA2 with the possibility of conducting a dictionary attack. When both the client and the access point support both WPA3 and WPA2, the attacker can deploy their own rogue access point with the same network name that only supports WPA2. In this situation, the client will use the WPA2 connection negotiation method, during which it will be determined that such a rollback is not permissible, but this will occur at a stage when the channel negotiation messages have been sent, and all the necessary information for the dictionary attack has already leaked. A similar method is applicable for rolling back to problematic versions of elliptic curves in SAE.\n
Additionally, it has been revealed that the iwd daemon, developed by Intel as an alternative to wpa_supplicant, and the wireless stack of the Samsung Galaxy S10 are vulnerable to downgrade attacks even on networks that only use WPA3\u2014if these devices have previously connected to a WPA3 network, they will attempt to connect to a spoofed WPA2 network with the same name.<\/p>\n
Side-channel attack extracting information from the processor cache. The password encoding algorithm in Dragonfly contains conditional branching, and the attacker, having the ability to execute code in the user's wireless network system, can determine which block of the if-then-else expression was chosen based on cache behavior analysis. The obtained information can be used for performing a progressive password guess using methods similar to offline dictionary attacks on WPA2 passwords. To protect against this, it is recommended to switch to constant-time operations that are independent of the nature of the processed data.\n
Side-channel attack with time complexity assessment. The Dragonfly code for password encoding uses several multiplicative groups (MODP) and a variable number of iterations, which depends on the password and the MAC address of the access point or client. A remote attacker can determine how many iterations were performed during password encoding and use this as a clue in progressive password guessing.\n
Denial of Service attack. The attacker can block certain functions of the access point due to resource exhaustion by sending a large number of channel negotiation requests. To bypass the WPA3 flood protection, it is sufficient to send requests from fake, non-repeating MAC addresses.\n
Fallback to less secure cryptographic groups used during connection negotiations in WPA3. For example, if the client supports elliptic curves P-521 and P-256, using P-521 as the preferred option, the attacker, regardless of the support on the access point's side for P-521, can force the client to use P-256. The attack is carried out by filtering some messages during the connection negotiation process and sending forged messages indicating the lack of support for certain types of elliptic curves. \nTo check devices for vulnerabilities, several scripts with examples of attacks have been prepared:<\/p>\n<\/ul>\n
Dragonslayer \u2014 implementation of attacks on EAP-pwd;<\/p>\n
\n
Dragonslayer \u2014 an implementation of attacks on EAP-pwd;\n
Dragondrain \u2014 a utility for testing the vulnerability of access points in the implementation of the SAE (Simultaneous Authentication of Equals) connection negotiation method, which can be used to initiate denial of service;\n
Dragontime \u2014 a script for conducting side-channel attacks against SAE, taking into account the difference in operation processing times when using MODP groups 22, 23, and 24;\n
Dragonforce \u2014 a utility for information recovery (password cracking) based on timing differences in operation processing or identifying data residing in cache.\n<\/ul>\n
The Wi-Fi Alliance, which develops standards for wireless networks, has announced that the issue affects a limited number of early implementations of WPA3-Personal and can be resolved through firmware and software updates. There are currently no documented instances of vulnerabilities being exploited for malicious purposes. To enhance security, the Wi-Fi Alliance has added additional tests to its wireless device certification program to verify the correctness of implementations and has contacted device manufacturers for coordinated resolution of identified issues. Patches addressing these problems have already been released for hostap\/wpa_supplicant. Package updates are available for Ubuntu. Issues remain unresolved in Debian, RHEL, SUSE\/openSUSE, Arch, Fedora, and FreeBSD. \n Source: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"