Mathy Vanhoef, autor napada KRACK na be\u017ei\u010dne mre\u017ee s WPA2, i Eyal Ronen, koautor nekih napada na TLS, otkrili su informacije o \u0161est ranjivosti (CVE-2019-9494 \u2013 CVE-2019-9499) u za\u0161titnoj tehnologiji be\u017ei\u010dnih mre\u017ea WPA3, koje omogu\u0107uju rekonstrukciju lozinke za spajanje i pristup be\u017ei\u010dnoj mre\u017ei bez poznavanja lozinke. Ranjivosti su grupirane pod kodnim imenom Dragonblood i omogu\u0107uju kompromitiranje metode uskla\u0111ivanja veza Dragonfly, koja pru\u017ea za\u0161titu od napada na lozinke u offline re\u017eimu. Osim WPA3, metoda Dragonfly se tako\u0111er koristi za za\u0161titu od napada putem re\u010dnika u protokolu EAP-pwd, koji se koristi u Androidu, RADIUS serverima i u hostapd\/wpa_supplicant.<\/p>\n
Istra\u017eivanje je otkrilo dva osnovna tipa arhitektonskih problema u WPA3. Oba tipa problema, u kona\u010dnici, mogu se koristiti za rekonstrukciju lozinke za pristup. Prvi tip omogu\u0107ava povratak na nesigurne kriptografske metode (napad s povratkom): sredstva za osiguranje kompatibilnosti s WPA2 (prolazni na\u010din rada, koji omogu\u0107ava kori\u0161tenje WPA2 i WPA3) omogu\u0107uju napada\u010du da prisili klijenta da izvr\u0161i WPA2 \u010detverostepeni postupak uskla\u0111ivanja veza, \u0161to dalje omogu\u0107ava kori\u0161tenje klasi\u010dnih napada na lozinke primenjivih na WPA2. Osim toga, otkrivena je i mogu\u0107nost provo\u0111enja napada s povratkom direktno na metodu uskla\u0111ivanja veza Dragonfly, koja omogu\u0107ava povratak na manje za\u0161ti\u0107ene tipove elipti\u010dnih krivulja.<\/p>\n
Drugi tip problema dovodi do curenja informacija o karakteristikama lozinke putem sporednih kanala i temelji se na nedostatcima metode kodiranja lozinke u Dragonfly, koje omogu\u0107avaju rekonstrukciju izvorne lozinke na temelju posrednih podataka, poput promjena ka\u0161njenja pri izvr\u0161avanju operacija. Kori\u0161teni u Dragonfly algoritam transformacije he\u0161a u elipti\u010dnu krivulju (hash-to-curve) pokazao se osjetljivim na napade pra\u0107enjem zaga\u0111enja informacija u procesorskoj ke\u0161 memoriji (cache attack), dok je algoritam transformacije he\u0161a u grupu (hash-to-group) podlo\u017ean napadima mjerenjem vremena izvr\u0161enja operacija (timing attack).<\/p>\n
Da bi izvr\u0161io napade putem analize predmemorije, napada\u010d mora imati mogu\u0107nost izvo\u0111enja neprivilegiranog koda na sistemu korisnika koji se povezuje na be\u017ei\u010dnu mre\u017eu. Obje metode omogu\u0107uju prikupljanje informacija potrebnih za preciziranje ta\u010dnih delova lozinke tokom njenog poku\u0161aja. Efikasnost napada je prili\u010dno visoka i omogu\u0107ava razbijanje 8-znamenkaste lozinke koja uklju\u010duje mala slova, hvatanjem samo 40 sesija dogovora o povezivanju (handshake) i tro\u0161e\u0107i resurse ekvivalentne iznajmljivanju kapaciteta Amazon EC2 u vrednosti od 125 dolara. <\/p>\n
Na osnovu otkrivenih ranjivosti predlo\u017eeno je nekoliko scenarija napada:<\/p>\n
Osim toga, otkriveno je da je demon iwd, kojeg razvija Intel kao alternativu wpa_supplicantu, i be\u017ei\u010dni stek Samsung Galaxy S10 podlo\u017eni napadu smanjenja verzije \u010dak i u mre\u017eama koje koriste samo WPA3 - ako su se ta ure\u0111aji prethodno povezivali s WPA3 mre\u017eom, poku\u0161a\u0107e se povezati s la\u017enom WPA2 mre\u017eom istog imena.<\/p>\n
Za provjeru ure\u0111aja na prisutnost ranjivosti pripremljeno je nekoliko skripti s primjerima izvo\u0111enja napada:<\/p>\n
Udruga Wi-Fi Alliance, koja razvija standarde za be\u017ei\u010dne mre\u017ee, objavila je da problem poga\u0111a ograni\u010den broj ranih implementacija WPA3-Personal i da se mo\u017ee rije\u0161iti a\u017euriranjem firmvera i softvera. Do sada nisu zabilje\u017eeni slu\u010dajevi iskori\u0161tavanja ranjivosti za zlo\u0107udne radnje. Kako bi pove\u0107ala sigurnost, Wi-Fi Alliance dodala je dodatne testove u svoj certifikacijski program za be\u017ei\u010dne ure\u0111aje kako bi provjerila ispravnost implementacija i obratila se proizvo\u0111a\u010dima ure\u0111aja za zajedni\u010dku koordinaciju u rje\u0161avanju otkrivenih problema. Zakrpe za rje\u0161avanje problema ve\u0107 su objavljene za hostap\/wpa_supplicant. A\u017euriranja paketa dostupna su za Ubuntu. U Debianu, RHEL-u, SUSE\/openSUSE, Archu, Fedori i FreeBSD problemi jo\u0161 uvijek nisu ispravljeni. \u041c\u044d\u0442\u0438 \u0412\u0430\u043d\u0445\u043e\u0444\u043e\u043c (Mathy Vanhoef), \u0430\u0432\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 KRACK \u043d\u0430 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0435 \u0441\u0435\u0442\u0438 \u0441 WPA2, \u0438 \u042d\u044f\u043b\u044c \u0420\u043e\u043d\u0435\u043d (Eyal Ronen), \u0441\u043e\u0430\u0432\u0442\u043e\u0440 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0430\u0442\u0430\u043a \u043d\u0430 TLS, \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0448\u0435\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 (CVE-2019-9494 — CVE-2019-9499) \u0432 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0437\u0430\u0449\u0438\u0442\u044b \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 WPA3, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0432\u043e\u0441\u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043f\u0430\u0440\u043e\u043b\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0431\u0435\u0437 \u0437\u043d\u0430\u043d\u0438\u044f \u043f\u0430\u0440\u043e\u043b\u044f. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u044b \u043f\u043e\u0434 \u043a\u043e\u0434\u043e\u0432\u044b\u043c \u0438\u043c\u0435\u043d\u0435\u043c Dragonblood […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-31424","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ranjivosti u tehnologiji za\u0161tite be\u017ei\u010dnih mre\u017ea WPA3 i u EAP-pwd | ProHoster","description":"Mathy Vanhoef, autor KRACK napada na be\u017ei\u010dne mre\u017ee s WPA2, i Eyal Ronen, jedan od autora nekih napada na TLS, otkrili su informacije o \u0161est ranjivosti (CVE-2019-9494 - CVE-2019-9499) u.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimosti-v-tehnologii-zashhity-besprovodnyh-setej-wpa3-i-v-eap-pwd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0437\u0430\u0449\u0438\u0442\u044b \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 WPA3 \u0438 \u0432 EAP-pwd | ProHoster","og:description":"\u041c\u044d\u0442\u0438 \u0412\u0430\u043d\u0445\u043e\u0444\u043e\u043c (Mathy Vanhoef), \u0430\u0432\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 KRACK \u043d\u0430 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0435 \u0441\u0435\u0442\u0438 \u0441 WPA2, \u0438 \u042d\u044f\u043b\u044c \u0420\u043e\u043d\u0435\u043d (Eyal Ronen), \u0441\u043e\u0430\u0432\u0442\u043e\u0440 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0430\u0442\u0430\u043a \u043d\u0430 TLS, \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0448\u0435\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 (CVE-2019-9494 - CVE-2019-9499) \u0432.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimosti-v-tehnologii-zashhity-besprovodnyh-setej-wpa3-i-v-eap-pwd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:41:11+00:00","article:modified_time":"2019-10-31T18:41:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31424","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 06:08:14","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:17:25","updated":"2026-01-21 06:08:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/31424","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=31424"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/31424\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=31424"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=31424"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=31424"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Izvor: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"