{"id":31273,"date":"2019-10-31T21:40:23","date_gmt":"2019-10-31T18:40:23","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vzlom-wpa3-dragonblood\/"},"modified":"2019-10-31T21:40:23","modified_gmt":"2019-10-31T18:40:23","slug":"vzlom-wpa3-dragonblood","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/vzlom-wpa3-dragonblood","title":{"rendered":"WPA3 h\u00e4kkimine: DragonBlood","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"WPA3
\n
\nKuigi uus WPA3 standard pole veel t\u00e4ielikult kasutusele v\u00f5etud, lubavad selle protokolli turvavead r\u00fcndajatel Wi-Fi parooli murda.
\n<\/a><\/noindex>
\nWi-Fi Protected Access III (WPA3) protokoll k\u00e4ivitati, et k\u00f5rvaldada WPA2 protokolli tehnilised puudused, mis on pikka aega peetud ebaturvaliseks ja haavatavaks KRACK-r\u00fcnnaku (Key Reinstallation Attack) suhtes. Kuigi WPA3 toetub turvalisema k\u00e4epigistuse, tuntud nimega Dragonfly, kasutamisele, mis on suunatud Wi-Fi v\u00f5rkude kaitsmisele s\u00f5naraamatu r\u00fcnnakute (offline brute-force) eest, on turvaeksperdid Mathy Vanhoef ja Eyal Ronen leidnud varasema WPA3-Personal rakenduse n\u00f5rkusi, mis v\u00f5ivad v\u00f5imaldada r\u00fcndajal taastada Wi-Fi paroole, kuritarvitades ajastust v\u00f5i k\u00f5rvalp\u00e4rimist.<\/p>\n

R\u00fcndajad saavad lugeda teavet, mida WPA3 pidi turvaliselt kr\u00fcpteerima. Seda saab kasutada konfidentsiaalsete andmete, nagu krediitkaartide numbrid, paroolid, vestlus s\u00f5numid, e-kirjad jne, varastamiseks.<\/p><\/blockquote>\n

T\u00e4na avaldatud uurimisdokumendis<\/a><\/noindex>, nimetatud DragonBlood, uurijad on \u00fcksikasjalikult arutanud kahte t\u00fc\u00fcpi WPA3 projekteerimise puudusi: esimene viib reitingu alandamise r\u00fcnnakuteni ja teine \u200b\u200b\u2014 k\u00f5rvaliste uuenduste lekkimiseni.<\/p>\n

K\u00fcljekanali r\u00fcnnak, mis p\u00f5hineb vahem\u00e4lul<\/h3>\n

\nDragonfly parooli koodimise algoritm, tuntud ka kui \"jahtimine ja nokitsemine\" (hunting and pecking), sisaldab tingimuslikke haru. Kui r\u00fcndaja suudab m\u00e4\u00e4rata, milline if-then-else haru on valitud, v\u00f5ib ta teada saada, kas parooli element on konkreetses iteratsioonis leitud. Praktikas on leitud, et kui r\u00fcndaja suudab k\u00e4ivitada privileege mitteomava koodi ohvrikomputeris, on v\u00f5imalik kasutada vahem\u00e4lu r\u00fcnnakuid, et m\u00e4\u00e4rata, milline haru viidi esimeses parooli genereerimise algoritmi iteratsioonis ellu. Seda teavet saab kasutada parooli jagamise r\u00fcnnaku teostamiseks (see on sarnane s\u00f5ltumatu s\u00f5naraamatu r\u00fcnnakuga).<\/p>\n

Seda haavatavust j\u00e4lgitakse CVE-2019-9494 identifikaatori kaudu.<\/p>\n

Kaitse seisneb tingimuslike harude asendamises, mis s\u00f5ltuvad salajastest v\u00e4\u00e4rtustest, fikseeritud ajaga valikute abil. Teostused peaksid samuti kasutama arvutust. Legendre'i s\u00fcmbol.<\/a><\/noindex> fikseeritud ajaga.<\/p>\n

S\u00fcnkroonsuse p\u00f5hine k\u00fclgkanalit\u00f5rje.<\/h3>\n

\nKuna Dragonfly k\u00e4tlemine kasutab teatud korrutuste gruppe, kasutab parooli kodeerimise algoritm parooli kodeerimiseks muutuvat iteratsioonide arvu. T\u00e4pne iteratsioonide arv s\u00f5ltub kasutatavast paroolist ning p\u00e4\u00e4supunkti ja kliendi MAC-aadressist. Kurjategija v\u00f5ib teostada kaugelt ajaga r\u00fcnnaku parooli kodeerimise algoritmile, et m\u00e4\u00e4rata, kui palju iteratsioone parooli kodeerimisel kulus. Taastatud teavet saab kasutada paroolir\u00fcnnaku l\u00e4biviimiseks, mis sarnaneb iseseisva s\u00f5nastiku r\u00fcnnakuga.<\/p>\n

S\u00fcnkroonsuse p\u00f5hise r\u00fcnnaku v\u00e4ltimiseks peavad teostused deaktiveerima haavatavad korrutuste grupid. Puhtalt tehnilisest seisukohast peaksid grupid MODP 22, 23 ja 24 olema deaktiveeritud. Samuti soovitatakse deaktiveerida grupid MODP 1, 2 ja 5.<\/p>\n

Seda haavatavus j\u00e4lgib samuti tunnustust CVE-2019-9494 alla, kuna r\u00fcnnaku rakendamisel on sarnased tunnused.<\/p>\n

WPA3 allapoole langetamine<\/h3>\n

\nKuna 15 aastat vana protokolli WPA2 on laialdaselt kasutanud miljardid seadmed, ei juhtu WPA3 laialdane kasutuselev\u00f5tt hetkega. Vanade seadmete toetamiseks pakuvad WPA3 sertifitseeritud seadmed \"\u00fclemineku re\u017eiimi\", mis saab olla seadistatud vastuv\u00f5tma \u00fchendusi nii WPA3-SAE kui ka WPA2 abil.<\/p>\n

Uurijad arvavad, et \u00fclemineku re\u017eiim on vastuv\u00f5tlik allapoole langetamise r\u00fcnnakutele, mida pahatahtlikud osalised v\u00f5ivad \u00e4ra kasutada, et luua vale ligip\u00e4\u00e4supunkt, mis toetab ainult WPA2, sundides WPA3 toetavaid seadmeid \u00fchenduma ebaturvalise neljakordse k\u00e4epigistusega WPA2 kaudu.<\/p>\n

\"Oleme leidnud ka SAE k\u00e4epigistuse vastu allapoole langetamise r\u00fcnnaku ('Semaphore Authentication', tuntud ka kui 'Dragonfly'), kus me saame sundida seadet kasutama tavap\u00e4rasest n\u00f5rgemat elliptilist k\u00f5verat,\" \u00fctlevad uurijad.<\/p><\/blockquote>\n

\nLisaks sellele ei ole \u201einimese keskel\u201c positsioon vajalik reitingu langetamise r\u00fcnnaku l\u00e4biviimiseks. R\u00fcndajatele piisab, kui nad teavad ainult WPA3-SAE v\u00f5rgu SSID-d.<\/p>\n

Uurijad teatasid oma tulemustest Wi-Fi Alliance'ile, mittetulunduslikule organisatsioonile, mis sertifitseerib WiFi standardeid ja tooteid vastavuse suhtes, kes on probleeme tunnustanud ja t\u00f6\u00f6tab tarnijatega, et parandada olemasolevaid WPA3 sertifitseeritud seadmeid.<\/p>\n

PoC (hetkel \u2014 404)<\/h3>\n

\nKontseptsiooni t\u00f5endamiseks avaldavad uurijad peagi neli eraldi t\u00f6\u00f6riista (GitHubi hoidlatest, h\u00fcperlink allpool), mida saab kasutada haavatavuste kontrollimiseks.<\/p>\n

Dragondrain<\/noindex> \u2014 t\u00f6\u00f6riist, mis v\u00f5ib kontrollida, kui kaitsetu on juurdep\u00e4\u00e4supunkt Dos-r\u00fcnnakute suhtes WPA3 Dragonfly k\u00e4epigistuse osas.
\nDragontime<\/noindex> \u2014 eksperimentaalne t\u00f6\u00f6riist Dragonfly k\u00e4epigistuse r\u00fcnnakute ajastamiseks.
\nDragonforce<\/a><\/noindex> \u2014 eksperimentaalne t\u00f6\u00f6riist, mis kogub teavet taastumise kohta ajastamise r\u00fcnnakute korral ja viib l\u00e4bi paroolir\u00fcnnaku.
\nDragonslayer<\/a><\/noindex> \u2014 t\u00f6\u00f6riist, mis viib l\u00e4bi r\u00fcnnakuid EAP-pwd vastu.<\/p>\n

Dragonblood: WPA3 SAE k\u00e4epideme turvaanal\u00fc\u00fcs<\/a><\/noindex>
\nProjekti sait \u2014 wpa3.mathyvanhoef.com<\/a><\/noindex>
\n
Allikas: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043d\u043e\u0432\u044b\u0439 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442 WPA3 \u0435\u0449\u0435 \u0442\u043e\u043b\u043a\u043e\u043c \u043d\u0435 \u0432\u0432\u0435\u0434\u0435\u043d \u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e, \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \u044d\u0442\u043e\u043c \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u0437\u043b\u043e\u043c\u0430\u0442\u044c \u043f\u0430\u0440\u043e\u043b\u044c Wi-Fi. \u041f\u0440\u043e\u0442\u043e\u043a\u043e\u043b Wi-Fi Protected Access III (WPA3) \u0431\u044b\u043b \u0437\u0430\u043f\u0443\u0449\u0435\u043d \u0432 \u043f\u043e\u043f\u044b\u0442\u043a\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u0442\u044c \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 WPA2, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0434\u043e\u043b\u0433\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u0441\u0447\u0438\u0442\u0430\u043b\u0441\u044f \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u043c \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c \u0434\u043b\u044f KRACK-\u0430\u0442\u0430\u043a\u0438 (Key Reinstallation Attack). \u0425\u043e\u0442\u044f WPA3 \u043e\u043f\u0438\u0440\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23239,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31273","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47WPA3 h\u00e4kkimine: DragonBlood | ProHoster","description":"Kuigi uus WPA3 standard ei ole veel korralikult kasutusele v\u00f5etud, v\u00f5imaldavad selle protokolli turvavead k\u00fcberkurjategijatel Wi-Fi parooli murda. Wi-Fi Protected Access III (WPA3) protokoll k\u00e4ivitas katse k\u00f5rvaldada WPA2 protokolli tehnilised puudused, mis on pikka aega peetud ebaohutuks ning haavatavaks KRACK-r\u00fcnnaku (Key Reinstallation Attack) suhtes. Kuigi WPA3 p\u00f5hineb tugevamatel","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/vzlom-wpa3-dragonblood","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u0437\u043b\u043e\u043c WPA3: DragonBlood | ProHoster","og:description":"\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043d\u043e\u0432\u044b\u0439 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442 WPA3 \u0435\u0449\u0435 \u0442\u043e\u043b\u043a\u043e\u043c \u043d\u0435 \u0432\u0432\u0435\u0434\u0435\u043d \u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e, \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \u044d\u0442\u043e\u043c \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u0437\u043b\u043e\u043c\u0430\u0442\u044c \u043f\u0430\u0440\u043e\u043b\u044c Wi-Fi. \u041f\u0440\u043e\u0442\u043e\u043a\u043e\u043b Wi-Fi Protected Access III (WPA3) \u0431\u044b\u043b \u0437\u0430\u043f\u0443\u0449\u0435\u043d \u0432 \u043f\u043e\u043f\u044b\u0442\u043a\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u0442\u044c \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 WPA2, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0434\u043e\u043b\u0433\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u0441\u0447\u0438\u0442\u0430\u043b\u0441\u044f \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u043c \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c \u0434\u043b\u044f KRACK-\u0430\u0442\u0430\u043a\u0438 (Key Reinstallation Attack). \u0425\u043e\u0442\u044f WPA3 \u043e\u043f\u0438\u0440\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0431\u043e\u043b\u0435\u0435","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/vzlom-wpa3-dragonblood","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:40:23+00:00","article:modified_time":"2019-10-31T18:40:23+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31273","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 05:21:38","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:12:48","updated":"2026-01-21 05:21:38","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/31273","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=31273"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/31273\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/23239"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=31273"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=31273"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=31273"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}