Az IWD (Intel inet Wireless Daemon) \u00e9s a wpa_supplicant ny\u00edlt csomagjaiban, amelyek a Linux rendszerek vezet\u00e9k n\u00e9lk\u00fcli h\u00e1l\u00f3zatra val\u00f3 csatlakoztat\u00e1s\u00e1ra szolg\u00e1lnak, sebezhet\u0151s\u00e9geket fedeztek fel, amelyek lehet\u0151v\u00e9 teszik az autentik\u00e1l\u00e1si mechanizmusok megker\u00fcl\u00e9s\u00e9t: <\/p>\n
A sebezhet\u0151s\u00e9get az okozza, hogy nem ellen\u0151rzik megfelel\u0151en a kapcsol\u00f3d\u00e1shoz sz\u00fcks\u00e9ges l\u00e9p\u00e9sek sorrendj\u00e9t a v\u00e9dett vezet\u00e9k n\u00e9lk\u00fcli h\u00e1l\u00f3zathoz val\u00f3 els\u0151 csatlakoz\u00e1s sor\u00e1n alkalmazott 4 l\u00e9p\u00e9ses protokollban. Mivel az IWD b\u00e1rmely csatlakoz\u00e1si l\u00e9p\u00e9sb\u0151l sz\u00e1rmaz\u00f3 \u00fczeneteket fogad, an\u00e9lk\u00fcl, hogy ellen\u0151rizn\u00e9 a kor\u00e1bbi l\u00e9p\u00e9s teljes\u00edt\u00e9s\u00e9t, a t\u00e1mad\u00f3 a m\u00e1sodik l\u00e9p\u00e9s \u00fczenet\u00e9nek elk\u00fcld\u00e9se n\u00e9lk\u00fcl k\u00f6zvetlen\u00fcl a negyedik l\u00e9p\u00e9s \u00fczenetet k\u00fcldhet, \u00e9s hozz\u00e1f\u00e9rhet a h\u00e1l\u00f3zathoz, megker\u00fclve a hiteles\u00edt\u00e9si ellen\u0151rz\u00e9st v\u00e9gz\u0151 l\u00e9p\u00e9st. <\/p>\n
K\u00f6zben az IWD megpr\u00f3b\u00e1lja ellen\u0151rizni a MIC (Message Integrity Code) k\u00f3dot a kapott negyedik l\u00e9p\u00e9s \u00fczenete alapj\u00e1n. Mivel a m\u00e1sodik l\u00e9p\u00e9s \u00fczenete az autentik\u00e1ci\u00f3s param\u00e9terekkel nem \u00e9rkezett meg, a negyedik l\u00e9p\u00e9s \u00fczenet\u00e9nek feldolgoz\u00e1sa sor\u00e1n a PTK (Pairwise Transient Key) kulcs null\u00e1z\u00f3dik. K\u00f6vetkez\u00e9sk\u00e9ppen a t\u00e1mad\u00f3 ki tudja sz\u00e1m\u00edtani a MIC-t, a null\u00e1s PTK-ra alapozva, \u00e9s ez a hiteles\u00edt\u00e9si k\u00f3d az IWD \u00e1ltal helyesnek fogadhat\u00f3 el. Az ilyen hi\u00e1nyos csatlakoz\u00e1si meg\u00e1llapod\u00e1s befejez\u00e9se ut\u00e1n a t\u00e1mad\u00f3 teljes hozz\u00e1f\u00e9r\u00e9st nyer a vezet\u00e9k n\u00e9lk\u00fcli h\u00e1l\u00f3zathoz, mivel a hozz\u00e1f\u00e9r\u00e9si pont fogadja az \u00e1ltala k\u00fcld\u00f6tt kereteket, amelyeket a null\u00e1s PTK kulccsal titkos\u00edt. <\/p>\n
A PEAP (Protected Extensible Authentication Protocol) protocol implementation flaw allows an attacker to bypass the second stage of authentication when connecting an incorrectly configured user device. Bypassing the second stage of authentication allows the attacker to create a spoofed clone of a legitimate Wi-Fi network and connect the user to a fake network without password verification. <\/p>\n
To successfully conduct an attack, the server verification in wpa_supplicant on the user side must be disabled. TLS tan\u00fas\u00edtv\u00e1ny<\/a> The attacker must know the wireless network identifier (SSID, Service Set Identifier). At the same time, the attacker must be within the range of the victim's wireless adapter but outside the range of the access point of the cloned wireless network. The attack is possible on networks with WPA2-Enterprise or WPA3-Enterprise that use the PEAP protocol. <\/p>\n Developers of wpa_supplicant stated that they do not consider the issue a vulnerability because it manifests only in incorrectly configured wireless networks where EAP authentication is used together with the PEAP protocol (EAP-TTLS) without checking the TLS certificate. a szerver<\/a>Configurations that do not verify certificates are not protected against active attacks. Those who discovered the vulnerability claim that such incorrect configurations are common and widespread, posing a threat to many consumer devices based on Linux, Android, and Chrome OS that use wpa_supplicant. <\/p>\n To address the issue in wpa_supplicant, a patch has been released that adds a mandatory second authentication phase, in addition to checking the TLS certificate. According to the developers, the proposed change is merely a workaround that makes it more difficult to conduct attacks using manual authentication and is useless when using options like EAP-GTC. For a real solution, network administrators should properly configure their setups, i.e., set up a trust chain to verify the server certificate using the ca_cert parameter. <\/ul>\n