{"id":31273,"date":"2019-10-31T21:40:23","date_gmt":"2019-10-31T18:40:23","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vzlom-wpa3-dragonblood\/"},"modified":"2019-10-31T21:40:23","modified_gmt":"2019-10-31T18:40:23","slug":"vzlom-wpa3-dragonblood","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/vzlom-wpa3-dragonblood","title":{"rendered":"Securizarea WPA3: DragonBlood","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Securizarea
\n
\nDe\u0219i noul standard WPA3 nu a fost \u00eenc\u0103 complet implementat, defectele de securitate din acest protocol permit atacatorilor s\u0103 descifreze parola Wi-Fi.
\n<\/a><\/noindex>
\nProtocolul Wi-Fi Protected Access III (WPA3) a fost lansat \u00een \u00eencercarea de a remedia defectele tehnice ale protocolului WPA2, care a fost mult timp considerat nesigur \u0219i vulnerabil la atacul KRACK (Key Reinstallation Attack). De\u0219i WPA3 se bazeaz\u0103 pe o manevr\u0103 mai sigur\u0103, cunoscut\u0103 sub numele de Dragonfly, care vizeaz\u0103 protejarea re\u021belelor Wi-Fi \u00eempotriva atacurilor din dic\u021bionar (brute force offline), cercet\u0103torii \u00een securitate Mathy Vanhoef \u0219i Eyal Ronen au descoperit sl\u0103biciuni \u00een implementarea timpurie a WPA3-Personal, care ar putea permite unui atacator s\u0103 recupereze parolele Wi-Fi abuz\u00e2nd de timpii de reac\u021bie sau de cache-ul lateral.<\/p>\n

\u201eAtacatorii pot citi informa\u021bii pe care WPA3 f\u0103r\u0103 \u00eendoial\u0103 \u00eei \u0219ifreaz\u0103 \u00een siguran\u021b\u0103. Acest lucru poate fi folosit pentru a fura informa\u021bii sensibile, cum ar fi numerele de carduri de credit, parole, mesaje de chat, e-mailuri etc.\u201d<\/p><\/blockquote>\n

\u00cen documentul de cercetare publicat ast\u0103zi cercet\u0103torii<\/a><\/noindex>, intitulat DragonBlood, au analize detaliate despre dou\u0103 tipuri de defecte de proiectare \u00een WPA3: primul duce la atacuri de degradare, iar al doilea - la scurgeri de cache lateral.<\/p>\n

Atacul de canal lateral bazat pe cache<\/h3>\n

\nAlgoritmul de codare a parolelor din Dragonfly, cunoscut \u0219i sub numele de algoritmul \u201ev\u00e2n\u0103toare \u0219i ciupire\u201d (hunting and pecking), con\u021bine ramuri condi\u021bionale. Dac\u0103 un atacator poate determina ce ramur\u0103 if-then-else a fost luat\u0103, el poate afla dac\u0103 un element al parolei a fost g\u0103sit \u00eentr-o anumit\u0103 itera\u021bie a acestui algoritm. \u00cen practic\u0103, s-a descoperit c\u0103, dac\u0103 un atacator poate rula cod neprivilegiat pe computerul victimei, este posibil s\u0103 utilizeze atacuri bazate pe cache pentru a determina ce ramur\u0103 a fost aleas\u0103 \u00een prima itera\u021bie a algoritmului gener\u0103rii parolei. Aceste informa\u021bii pot fi folosite pentru a executa un atac de separare a parolei (similar cu un atac din dic\u021bionar offline).<\/p>\n

Aceast\u0103 vulnerabilitate este urm\u0103rit\u0103 folosind identificatorul CVE-2019-9494.<\/p>\n

Protec\u021bia const\u0103 \u00een \u00eenlocuirea ramurilor condi\u021bionale care depind de valori secrete cu utilitare de selec\u021bie cu timp constant. Implement\u0103rile trebuie de asemenea s\u0103 utilizeze calculul simbolului Legendre<\/a><\/noindex> cu timp constant.<\/p>\n

Atacul prin canal lateral bazat pe sincronizare<\/h3>\n

\nC\u00e2nd handshake-ul Dragonfly utilizeaz\u0103 anumite grupuri multiplicative, algoritmul de criptare a parolei folose\u0219te un num\u0103r variabil de itera\u021bii pentru criptarea parolei. Num\u0103rul exact de itera\u021bii depinde de parola utilizat\u0103 \u0219i de adresa MAC a punctului de acces \u0219i a clientului. Un atacator poate efectua un atac temporal la distan\u021b\u0103 asupra algoritmului de criptare a parolei pentru a determina c\u00e2te itera\u021bii au fost necesare pentru criptarea parolei. Informa\u021biile recuperate pot fi folosite pentru a efectua un atac pe parol\u0103, similar unui atac de tip dic\u021bionar offline.<\/p>\n

Pentru a preveni atacurile bazate pe sincronizare, implement\u0103rile trebuie s\u0103 dezactiveze grupurile multiplicative vulnerabile. Din punct de vedere tehnic, grupurile MODP 22, 23 \u0219i 24 trebuie dezactivate. De asemenea, se recomand\u0103 dezactivarea grupurilor MODP 1, 2 \u0219i 5.<\/p>\n

Aceast\u0103 vulnerabilitate este, de asemenea, urm\u0103rit\u0103 folosind identificatorul CVE-2019-9494 datorit\u0103 asem\u0103n\u0103rii \u00een implementarea atacului.<\/p>\n

Retrogradare WPA3<\/h3>\n

\nDeoarece protocolul WPA2, folosit pe scar\u0103 larg\u0103 timp de 15 ani, a fost adoptat de miliarde de dispozitive, r\u0103sp\u00e2ndirea pe scar\u0103 larg\u0103 a WPA3 nu va avea loc peste noapte. Pentru a sus\u021bine dispozitivele mai vechi, dispozitivele certificate WPA3 ofer\u0103 un \"mod de tranzi\u021bie\", care poate fi configurat pentru a accepta conexiuni folosind at\u00e2t WPA3-SAE, c\u00e2t \u0219i WPA2.<\/p>\n

Cercet\u0103torii consider\u0103 c\u0103 modul de tranzi\u021bie este vulnerabil la atacurile de retrogradare, pe care atacatorii le pot utiliza pentru a crea un punct de acces fals care accept\u0103 doar WPA2, for\u021b\u00e2nd dispozitivele WPA3 s\u0103 se conecteze folosind un handshake WPA2 nesigur \u00een patru pa\u0219i.<\/p>\n

\"De asemenea, am descoperit un atac de retrogradare \u00eempotriva handshake-ului SAE (\"Autentificare simultan\u0103 a egalilor\", cunoscut de obicei sub numele de \"Dragonfly\"), unde putem for\u021ba un dispozitiv s\u0103 foloseasc\u0103 o curb\u0103 eliptic\u0103 mai slab\u0103 dec\u00e2t de obicei\", spun cercet\u0103torii.<\/p><\/blockquote>\n

\n\u00cen plus, pozi\u021bia de \"om \u00een mijloc\" nu este necesar\u0103 pentru a desf\u0103\u0219ura un atac de retrogradare. \u00cen schimb, atacatorii trebuie doar s\u0103 cunoasc\u0103 SSID-ul re\u021belei WPA3-SAE.<\/p>\n

Cercet\u0103torii au raportat rezultatele lor Wi-Fi Alliance, o organiza\u021bie non-profit care certific\u0103 standardele WiFi \u0219i produsele Wi-Fi pentru conformitate, care au recunoscut problemele \u0219i colaboreaz\u0103 cu furnizorii pentru a corecta dispozitivele existente certificate WPA3.<\/p>\n

PoC (la momentul public\u0103rii - 404)<\/h3>\n

\nCa dovad\u0103 a conceptului, cercet\u0103torii vor lansa \u00een cur\u00e2nd urm\u0103toarele patru instrumente separate (\u00een repositoare GitHub cu hyperlinkul de mai jos), care pot fi utilizate pentru a verifica vulnerabilit\u0103\u021bile.<\/p>\n

Dragondrain<\/noindex> \u2014 un instrument care poate verifica \u00een ce m\u0103sur\u0103 un punct de acces este vulnerabil la atacurile Dos asupra handshaker-ului WPA3 Dragonfly.
\nDragontime<\/noindex> \u2014 un instrument experimental pentru a desf\u0103\u0219ura atacuri temporale asupra handshaker-ului Dragonfly.
\nDragonforce<\/a><\/noindex> \u2014 un instrument experimental care ob\u021bine informa\u021bii pentru recuperare dup\u0103 atacuri temporale \u0219i efectueaz\u0103 un atac pe baz\u0103 de parol\u0103.
\nDragonslayer<\/a><\/noindex> \u2014 un instrument care desf\u0103\u0219oar\u0103 atacuri asupra EAP-pwd.<\/p>\n

Dragonblood: O Analiz\u0103 a Securit\u0103\u021bii Mecanismului SAE din WPA3<\/a><\/noindex>
\nSite-ul proiectului \u2014 wpa3.mathyvanhoef.com<\/a><\/noindex>
\n
Sursa: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043d\u043e\u0432\u044b\u0439 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442 WPA3 \u0435\u0449\u0435 \u0442\u043e\u043b\u043a\u043e\u043c \u043d\u0435 \u0432\u0432\u0435\u0434\u0435\u043d \u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e, \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \u044d\u0442\u043e\u043c \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u0437\u043b\u043e\u043c\u0430\u0442\u044c \u043f\u0430\u0440\u043e\u043b\u044c Wi-Fi. \u041f\u0440\u043e\u0442\u043e\u043a\u043e\u043b Wi-Fi Protected Access III (WPA3) \u0431\u044b\u043b \u0437\u0430\u043f\u0443\u0449\u0435\u043d \u0432 \u043f\u043e\u043f\u044b\u0442\u043a\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u0442\u044c \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 WPA2, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0434\u043e\u043b\u0433\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u0441\u0447\u0438\u0442\u0430\u043b\u0441\u044f \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u043c \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c \u0434\u043b\u044f KRACK-\u0430\u0442\u0430\u043a\u0438 (Key Reinstallation Attack). \u0425\u043e\u0442\u044f WPA3 \u043e\u043f\u0438\u0440\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23239,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31273","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Spargerea WPA3: DragonBlood | ProHoster","description":"Cu toate c\u0103 noul standard WPA3 nu a fost \u00eenc\u0103 implementat pe deplin.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/vzlom-wpa3-dragonblood","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u0437\u043b\u043e\u043c WPA3: DragonBlood | ProHoster","og:description":"\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043d\u043e\u0432\u044b\u0439 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442 WPA3 \u0435\u0449\u0435 \u0442\u043e\u043b\u043a\u043e\u043c \u043d\u0435 \u0432\u0432\u0435\u0434\u0435\u043d \u0432.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/vzlom-wpa3-dragonblood","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:40:23+00:00","article:modified_time":"2019-10-31T18:40:23+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31273","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 05:21:38","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:12:48","updated":"2026-01-21 05:21:38","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/31273","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=31273"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/31273\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/23239"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=31273"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=31273"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=31273"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}