{"id":31273,"date":"2019-10-31T21:40:23","date_gmt":"2019-10-31T18:40:23","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vzlom-wpa3-dragonblood\/"},"modified":"2019-10-31T21:40:23","modified_gmt":"2019-10-31T18:40:23","slug":"vzlom-wpa3-dragonblood","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/vzlom-wpa3-dragonblood","title":{"rendered":"WPA3 h\u00e4kkimine: DragonBlood","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"WPA3
\n
\nKuigi uus WPA3 standard pole veel t\u00e4ielikult kasutusele v\u00f5etud, v\u00f5imaldavad turvaprobleemid selles protokollis kurjategijatel Wi-Fi parooli murda.
\n<\/a><\/noindex>
\nWi-Fi Protected Access III (WPA3) protokoll k\u00e4ivitati, et lahendada tehnilised probleemid WPA2 protokollis, mida on pikka aega peetud ebaturvaliseks ja haavatavaks KRACK-r\u00fcnnaku (Key Reinstallation Attack) suhtes. Kuigi WPA3 tugineb turvalisema k\u00e4epigistuse kasutusele v\u00f5tmisele, tuntud kui Dragonfly, mille eesm\u00e4rk on kaitsta Wi-Fi v\u00f5rke s\u00f5naraamatup\u00f5histe r\u00fcnnakute (offline brute-force) eest, avastasid turva-uuringute eksperdid Mathy Vanhoef ja Eyal Ronen n\u00f5rkused varases WPA3-Personal rakenduses, mis v\u00f5ivad kurjategijale v\u00f5imaldada Wi-Fi paroole taastada ajastusi v\u00f5i k\u00fclgkootud andmete kuritarvitamise abil.<\/p>\n

\u201eKurjategijad saavad lugeda teavet, mille WPA3 pidi turvaliselt kr\u00fcpteerima. Seda saab kasutada konfidentsiaalse teabe, n\u00e4iteks krediitkaardinumbrite, paroolide, vestluste, e-kirjade jne varastamiseks.\u201d<\/p><\/blockquote>\n

T\u00e4na avaldatud uurimisdokumendis<\/a><\/noindex>, mille pealkirjaks on DragonBlood, uurijad k\u00e4sitlevad kahte t\u00fc\u00fcpi projekti puudusi WPA3-s: esimene viib reitingu langetamise r\u00fcnnakuteni ja teine k\u00fclgkootud andmete leketeni.<\/p>\n

K\u00fclgkanali r\u00fcnnak p\u00f5hinev vahem\u00e4lu<\/h3>\n

\nDragonfly parooli kodeerimise algoritm, tuntud ka kui \u201ejahti ja nokkimist\u201d (hunting and pecking), sisaldab tingimuslikke harusid. Kui kurjategija suudab kindlaks teha, milline harus if-then-else korral on valitud, v\u00f5ib ta teada saada, kas paroolielement leiti konkreetse iteratsiooni ajal. Praktikas on leitud, et kui kurjategija suudab k\u00e4itada privileegideta koodi ohvri arvutis, on v\u00f5imalik kasutada vahem\u00e4lu r\u00fcnnakuid, et kindlaks teha, milline harus tehti esimest korda parooli genereerimise algoritmi iteratsiooni ajal. Seda teavet saab kasutada parooli jagamise r\u00fcnnaku tegemiseks (see sarnaneb offline s\u00f5naraamatu r\u00fcnnakuga).<\/p>\n

Seda haavatavust j\u00e4lgitakse CVE-2019-9494 ID abil.<\/p>\n

Kaitse seisneb tingimuslike harusid asendavad utiliidid, mis s\u00f5ltuvad salajastest v\u00e4\u00e4rtustest, konstantse ajaga valimisega. Teostused peaksid samuti kasutama arvutamist Legendre'i s\u00fcmbol<\/a><\/noindex> konstantse ajaga.<\/p>\n

S\u00fcnkroniseerimise p\u00f5hjal p\u00f5hinev k\u00f5rvalkanali r\u00fcnne<\/h3>\n

\nKui Dragonfly'i k\u00e4epigistus kasutab teatud multiplikatiivseid gruppe, kasutab paroolikodeerimise algoritm parooli kodeerimiseks muutuva arvu iteratsioone. T\u00e4pne iteratsioonide arv s\u00f5ltub kasutatavast paroolist ning juurdep\u00e4\u00e4supunkti ja kliendi MAC-aadressist. R\u00fcndaja v\u00f5ib teostada kaug-rakenduslikku ajar\u00fcnnakut paroolikodeerimise algoritmi suhtes, et m\u00e4\u00e4rata, mitu iteratsiooni kulus parooli kodeerimiseks. Taastatud teavet v\u00f5ib kasutada parooli r\u00fcnnakuks, mis sarnaneb iseseisva s\u00f5nastiku r\u00fcnnakuga.<\/p>\n

S\u00fcnkroniseerimise p\u00f5hjal p\u00f5hineva r\u00fcnnaku v\u00e4ltimiseks peavad rakendused keelama haavatavad multiplikatiivsed grupid. Tehniliselt tuleb keelata grupid MODP 22, 23 ja 24. Samuti on soovitatav keelata grupid MODP 1, 2 ja 5.<\/p>\n

Seda haavatavust j\u00e4lgitakse ka identifikaatori CVE-2019-9494 kaudu seoses r\u00fcnnaku rakendamise sarnasustega.<\/p>\n

WPA3 madalama taseme r\u00fcnded<\/h3>\n

\nKuna 15-aastast WPA2 protokolli on laialdaselt kasutanud miljardid seadmed, ei toimu WPA3 laialdane kasutuselev\u00f5tt \u00fcle\u00f6\u00f6. Vanade seadmete toetamiseks pakuvad sertifitseeritud WPA3 seadmed \"\u00fclemineku re\u017eiimi\", mille saab seadistada \u00fchenduste vastuv\u00f5tmiseks nii WPA3-SAE kui ka WPA2 kasutades.<\/p>\n

Uurijad usuvad, et \u00fclemineku re\u017eiim on haavatav allapoole t\u00f5stmisr\u00fcnnakute suhtes, mida r\u00fcndajad saavad kasutada vale juurdep\u00e4\u00e4supunkti loomiseks, mis toetab ainult WPA2, sundides WPA3 toetavaid seadmeid \u00fchenduma ebaturvalise WPA2 neljaosalisese k\u00e4epigistusega.<\/p>\n

\"Oleme avastanud ka allapoole t\u00f5stmisr\u00fcnnaku SAE k\u00e4epigistuse suhtes ('Simultaanne autentimine v\u00f5rdsuste vahel', tuntud ka kui 'Dragonfly'), kus suudame sundida seadet kasutama n\u00f5rgemat elliptilist k\u00f5verat kui tavaliselt,\" \u00fctlevad uurijad.<\/p><\/blockquote>\n

\nVeelgi enam, allapoole t\u00f5stmisr\u00fcnnaku l\u00e4biviimiseks ei ole vaja positsiooni 'inimene keskel'. R\u00fcndajatel on vajalik vaid teada WPA3-SAE v\u00f5rgu SSID-d.<\/p>\n

Uurijad teatasid oma tulemustest Wi-Fi Alliance'ile, mittetulundus\u00fchingule, mis sertifitseerib WiFi standardid ja tooted vastavuse osas. Nad on tunnustanud probleeme ja teevad koost\u00f6\u00f6d tarnijatega, et parandada olemasolevaid WPA3 sertifitseeritud seadmeid.<\/p>\n

PoC (artikli avaldamise hetkel \u2013 404)<\/h3>\n

\nKuna t\u00f5enduseks kavandavad uurijad varsti v\u00e4lja neli eraldi t\u00f6\u00f6riista (GitHubi hoidlates vastava h\u00fcperlingiga allpool), mida saab kasutada haavatavuste testimiseks.<\/p>\n

Dragondrain<\/noindex> \u2014 t\u00f6\u00f6riist, mis suudab kontrollida, kuiv\u00f5rd on ligip\u00e4\u00e4supunkt haavatav WPA3 Dragonfly j\u00f5uvarade valimise r\u00fcnnakutele.
\nDragontime<\/noindex> \u2014 eksperimentaalne t\u00f6\u00f6riist, mis viib l\u00e4bi ajar\u00fcnnakuid Dragonfly k\u00e4epigistuse vastu.
\nDragonforce<\/a><\/noindex> \u2014 eksperimentaalne t\u00f6\u00f6riist, mis kogub teavet ajar\u00fcnnakute j\u00e4rgsete taastumiste jaoks ja viib l\u00e4bi paroolir\u00fcnnaku.
\nDragonslayer<\/a><\/noindex> \u2014 t\u00f6\u00f6riist, mis viib l\u00e4bi EAP-pwd r\u00fcnnakuid.<\/p>\n

Dragonblood: WPA3’s SAE k\u00e4epidemete turvaanal\u00fc\u00fcs<\/a><\/noindex>
\nProjekti sait \u2014 wpa3.mathyvanhoef.com<\/a><\/noindex>
\n
Allikas: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043d\u043e\u0432\u044b\u0439 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442 WPA3 \u0435\u0449\u0435 \u0442\u043e\u043b\u043a\u043e\u043c \u043d\u0435 \u0432\u0432\u0435\u0434\u0435\u043d \u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e, \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \u044d\u0442\u043e\u043c \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u0437\u043b\u043e\u043c\u0430\u0442\u044c \u043f\u0430\u0440\u043e\u043b\u044c Wi-Fi. \u041f\u0440\u043e\u0442\u043e\u043a\u043e\u043b Wi-Fi Protected Access III (WPA3) \u0431\u044b\u043b \u0437\u0430\u043f\u0443\u0449\u0435\u043d \u0432 \u043f\u043e\u043f\u044b\u0442\u043a\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u0442\u044c \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 WPA2, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0434\u043e\u043b\u0433\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u0441\u0447\u0438\u0442\u0430\u043b\u0441\u044f \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u043c \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c \u0434\u043b\u044f KRACK-\u0430\u0442\u0430\u043a\u0438 (Key Reinstallation Attack). \u0425\u043e\u0442\u044f WPA3 \u043e\u043f\u0438\u0440\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23239,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31273","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47WPA3 h\u00e4kkimine: DragonBlood | ProHoster","description":"K\u00fcpsisegin standard WPA3 pole veel korralikult k\u00e4iku lastud.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/vzlom-wpa3-dragonblood","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u0437\u043b\u043e\u043c WPA3: DragonBlood | ProHoster","og:description":"\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043d\u043e\u0432\u044b\u0439 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442 WPA3 \u0435\u0449\u0435 \u0442\u043e\u043b\u043a\u043e\u043c \u043d\u0435 \u0432\u0432\u0435\u0434\u0435\u043d \u0432.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/vzlom-wpa3-dragonblood","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:40:23+00:00","article:modified_time":"2019-10-31T18:40:23+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31273","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 05:21:38","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:12:48","updated":"2026-01-21 05:21:38","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/31273","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=31273"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/31273\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/23239"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=31273"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=31273"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=31273"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}