{"id":31273,"date":"2019-10-31T21:40:23","date_gmt":"2019-10-31T18:40:23","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vzlom-wpa3-dragonblood\/"},"modified":"2019-10-31T21:40:23","modified_gmt":"2019-10-31T18:40:23","slug":"vzlom-wpa3-dragonblood","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/vzlom-wpa3-dragonblood","title":{"rendered":"Hacking WPA3: DragonBlood","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Hacking
\n
\nIako je novi standard WPA3 jo\u0161 uvijek u fazi implementacije, sigurnosni nedostaci ovog protokola omogu\u0107uju napada\u010dima da provale Wi-Fi lozinku.
\n<\/a><\/noindex>
\nProtokol Wi-Fi Protected Access III (WPA3) pokrenut je kako bi se uklonili tehni\u010dki nedostaci protokola WPA2, koji je dugo vremena bio smatran nesigurnim i podlo\u017enim KRACK napadima (Key Reinstallation Attack). Iako WPA3 koristi sigurnije rukovanje poznato kao Dragonfly, usmjereno na za\u0161titu Wi-Fi mre\u017ea od autonomnih napada temeljnih na rje\u010dniku (offline bruteforce), istra\u017eiva\u010di sigurnosti Mathy Vanhoef i Eyal Ronen otkrili su slabosti u ranoj implementaciji WPA3-Personal koje bi mogle omogu\u0107iti napada\u010du da obnovi Wi-Fi lozinke koriste\u0107i tajming i sporedne ke\u0161iranje.<\/p>\n

\u00abNapada\u010di mogu pro\u010ditati informacije za koje se vjeruje da su WPA3 sigurno \u0161ifrirane. Ovo se mo\u017ee koristiti za kra\u0111u povjerljivih informacija, kao \u0161to su brojevi kreditnih kartica, lozinke, poruke chata, e-mailovi i sli\u010dno.\u00bb<\/p><\/blockquote>\n

U objavljenom danas istra\u017eiva\u010dkom dokumentu<\/a><\/noindex>, nazvanom DragonBlood, istra\u017eiva\u010di detaljno razmatraju dva tipa nedostataka dizajna u WPA3: prvi dovodi do napada s degradacijom sigurnosti, a drugi do curenja sporednih ke\u0161iranja.<\/p>\n

Napad na sporedni kanal temeljen na ke\u0161u<\/h3>\n

\nAlgoritam kodiranja lozinke u Dragonfly, poznat i kao algoritam \u00ablov i kucanje\u00bb (hunting and pecking), sadr\u017ei uvjetne grane. Ako napada\u010d mo\u017ee odrediti koja grana if-then-else je bila odabrana, mo\u017ee saznati je li odre\u0111eni dio lozinke prona\u0111en u konkretnoj iteraciji ovog algoritma. U praksi je otkriveno da ako napada\u010d mo\u017ee pokrenuti neprivilegirani kod na ra\u010dunalu \u017ertve, napadi temeljen na ke\u0161u mogu se koristiti za odre\u0111ivanje koja je grana bila poduzeta u prvoj iteraciji algoritma generiranja lozinke. Ove informacije mogu se koristiti za izvo\u0111enje napada na razdvajanje lozinke (sli\u010dno je autonomnom napadu temeljenom na rje\u010dniku).<\/p>\n

Ova ranjivost se prati pod identifikatorom CVE-2019-9494.<\/p>\n

Za\u0161tita se sastoji od zamjene uvjetnih grana koje ovise o tajnim vrijednostima alatima izbora s konstantnim vremenom. Implementacije tako\u0111er trebaju koristiti izra\u010dun Lejlandrovog simbola<\/a><\/noindex> s konstantnim vremenom.<\/p>\n

Napad temeljen na bo\u010dnom kanalu kroz sinkronizaciju<\/h3>\n

\nKada rukovanje Dragonfly koristi odre\u0111ene multiplicativne grupe, algoritam za kodiranje lozinke koristi varijabilan broj iteracija za kodiranje lozinke. Ta\u010dan broj iteracija zavisi od kori\u0161\u0107ene lozinke i MAC adrese pristupne ta\u010dke i klijenta. Napada\u010d mo\u017ee izvr\u0161iti daljinski vremenski napad na algoritam kodiranja lozinke kako bi odredio koliko je iteracija bilo potrebno za kodiranje lozinke. Oporavljena informacija mo\u017ee se koristiti za izvo\u0111enje napada na lozinku, koji podse\u0107a na autonomni napad re\u010dnikom.<\/p>\n

Da bi se spre\u010dio napad temeljen na sinkronizaciji, implementacije moraju onemogu\u0107iti ranjive multiplicativne grupe. Sa tehni\u010dkog stanovi\u0161ta, grupe MODP 22, 23 i 24 treba onemogu\u0107iti. Tako\u0111e se preporu\u010duje onemogu\u0107avanje grupa MODP 1, 2 i 5.<\/p>\n

Ova ranjivost se tako\u0111e prati pod identifikatorom CVE-2019-9494 zbog sli\u010dnosti u implementaciji napada.<\/p>\n

WPA3 unapre\u0111enje<\/h3>\n

\nBudu\u0107i da je 15-godi\u0161nji protokol WPA2 \u0161iroko kori\u0161\u0107en od strane milijardi ure\u0111aja, \u0161iroko usvajanje WPA3 ne\u0107e se desiti preko no\u0107i. Da bi podr\u017eali stare ure\u0111aje, sertifikovani WPA3 ure\u0111aji nude \"prelazni re\u017eim rada\", koji se mo\u017ee podesiti da prihvata povezivanja koriste\u0107i kako WPA3-SAE, tako i WPA2.<\/p>\n

Istra\u017eiva\u010di smatraju da je prelazni re\u017eim ranjiv na napade sa smanjenjem nivoa, koje napada\u010di mogu iskoristiti za kreiranje la\u017ene pristupne ta\u010dke koja podr\u017eava samo WPA2, \u0161to primorava ure\u0111aje podr\u017eane WPA3 da se pove\u017eu putem nesigurnog \u010detverostranog rukovanja WPA2.<\/p>\n

\"Tako\u0111e smo otkrili napad sa smanjenjem nivoa protiv samog rukovanja SAE (\"Simultana autentifikacija ravnih\", obi\u010dno poznata kao \"Zmajev let\"), gde mo\u017eemo natjerati ure\u0111aj da koristi slabiju elipti\u010dnu krivu nego obi\u010dno\", ka\u017eu istra\u017eiva\u010di.<\/p><\/blockquote>\n

\n\u0160tavi\u0161e, \"\u010dovek u sredini\" nije potreban za izvo\u0111enje napada sa smanjenjem nivoa. Umesto toga, napada\u010dima je potrebno samo znati SSID mre\u017ee WPA3-SAE.<\/p>\n

Istra\u017eiva\u010di su izvijestili o svojim rezultatima Wi-Fi Alliance, neprofitnoj organizaciji koja certificira Wi-Fi standarde i proizvode, koja je prepoznala probleme i sura\u0111uje s dobavlja\u010dima kako bi ispravila postoje\u0107e WPA3 certificirane ure\u0111aje.<\/p>\n

PoC (u trenutku objave \u2014 404)<\/h3>\n

\nKao potvrdu koncepta, istra\u017eiva\u010di \u0107e uskoro objaviti sljede\u0107a \u010detiri zasebna alata (u GitHub repozitorijima s hipervezom u nastavku) koji se mogu koristiti za testiranje ranjivosti.<\/p>\n

Dragondrain<\/noindex> \u2014 alat koji mo\u017ee provjeriti u kojoj mjeri je pristupna to\u010dka ranjiva na DoS napade na WPA3 Dragonfly rukovanje.
\nDragontime<\/noindex> \u2014 eksperimentalni alat za izvo\u0111enje vremenskih napada na Dragonfly rukovanje.
\nDragonforce<\/a><\/noindex> \u2014 eksperimentalni alat koji prikuplja informacije za oporavak nakon vremenskih napada i provodi napad na lozinke.
\nDragonslayer<\/a><\/noindex> \u2014 alat koji provodi napade na EAP-pwd.<\/p>\n

Dragonblood: Analiza sigurnosti WPA3’s SAE rukovanja<\/a><\/noindex>
\nWeb stranica projekta \u2014 wpa3.mathyvanhoef.com<\/a><\/noindex>
\n
Izvor: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043d\u043e\u0432\u044b\u0439 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442 WPA3 \u0435\u0449\u0435 \u0442\u043e\u043b\u043a\u043e\u043c \u043d\u0435 \u0432\u0432\u0435\u0434\u0435\u043d \u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e, \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \u044d\u0442\u043e\u043c \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u0437\u043b\u043e\u043c\u0430\u0442\u044c \u043f\u0430\u0440\u043e\u043b\u044c Wi-Fi. \u041f\u0440\u043e\u0442\u043e\u043a\u043e\u043b Wi-Fi Protected Access III (WPA3) \u0431\u044b\u043b \u0437\u0430\u043f\u0443\u0449\u0435\u043d \u0432 \u043f\u043e\u043f\u044b\u0442\u043a\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u0442\u044c \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 WPA2, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0434\u043e\u043b\u0433\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u0441\u0447\u0438\u0442\u0430\u043b\u0441\u044f \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u043c \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c \u0434\u043b\u044f KRACK-\u0430\u0442\u0430\u043a\u0438 (Key Reinstallation Attack). \u0425\u043e\u0442\u044f WPA3 \u043e\u043f\u0438\u0440\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23239,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31273","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Hakerski napad na WPA3: DragonBlood | ProHoster","description":"Unato\u010d tome \u0161to novi standard WPA3 jo\u0161 nije u potpunosti implementiran.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/vzlom-wpa3-dragonblood","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u0437\u043b\u043e\u043c WPA3: DragonBlood | ProHoster","og:description":"\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043d\u043e\u0432\u044b\u0439 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442 WPA3 \u0435\u0449\u0435 \u0442\u043e\u043b\u043a\u043e\u043c \u043d\u0435 \u0432\u0432\u0435\u0434\u0435\u043d \u0432.","og:url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/vzlom-wpa3-dragonblood","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:40:23+00:00","article:modified_time":"2019-10-31T18:40:23+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31273","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 05:21:38","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:12:48","updated":"2026-01-21 05:21:38","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/31273","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=31273"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/31273\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media\/23239"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=31273"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=31273"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=31273"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}