Mathy Vanhoef, autorul atacului KRACK asupra re\u021belelor wireless cu WPA2, \u0219i Eyal Ronen, coautor al unor atacuri asupra TLS, au dezv\u0103luit informa\u021bii despre \u0219ase vulnerabilit\u0103\u021bi (CVE-2019-9494 — CVE-2019-9499) \u00een tehnologia de securitate a re\u021belelor wireless WPA3, care permit recrearea parolei de conectare \u0219i ob\u021binerea accesului la re\u021beaua wireless f\u0103r\u0103 cuno\u0219tin\u021ba parolei. Vulnerabilit\u0103\u021bile sunt grupate sub numele de cod Dragonblood \u0219i permit compromiterea metodei de negociere a conexiunilor Dragonfly, care ofer\u0103 protec\u021bie \u00eempotriva atacurilor de tip offline de ghicire a parolelor. Pe l\u00e2ng\u0103 WPA3, metoda Dragonfly este, de asemenea, utilizat\u0103 pentru protec\u021bia \u00eempotriva atacurilor de tip dictionary \u00een protocolul EAP-pwd, utilizat \u00een Android, servere RADIUS \u0219i \u00een hostapd\/wpa_supplicant.<\/p>\n
\u00cen cadrul cercet\u0103rii au fost identificate dou\u0103 tipuri principale de probleme arhitecturale \u00een WPA3. Ambele tipuri de probleme, \u00een cele din urm\u0103, pot fi exploatate pentru a recrea parola de acces. Primul tip permite un atac de downgrade asupra metodelor criptografice nesigure: mecanismele de compatibilitate cu WPA2 (modul de tranzit, care permite utilizarea WPA2 \u0219i WPA3) permit atacatorului s\u0103 for\u021beze clientul s\u0103 efectueze negocierea de conexiune WPA2 \u00een patru etape, ceea ce permite ulterior utilizarea atacurilor clasice de recuperare a parolelor aplicabile WPA2. De asemenea, a fost identificat\u0103 posibilitatea de a efectua un atac de downgrade direct asupra metodei de negociere a conexiunilor Dragonfly, care permite revenirea la tipuri de curbe eliptice mai pu\u021bin protejate.<\/p>\n
Al doilea tip de probleme duce la scurgeri indirecte de informa\u021bii despre caracteristicile parolei \u0219i se bazeaz\u0103 pe neajunsurile metodei de codare a parolei \u00een Dragonfly, care permit, prin date indirecte, cum ar fi modificarea \u00eent\u00e2rziatului \u00een execu\u021bia opera\u021biunilor, recrearea parolei originale. Algoritmul utilizat \u00een Dragonfly pentru conversia hash-ului \u00een curb\u0103 eliptic\u0103 (hash-to-curve) s-a dovedit a fi vulnerabil atacurilor prin urm\u0103rirea informa\u021biilor \u00een cache-ul procesorului (cache attack), iar algoritmul de conversie a hash-ului \u00een grup (hash-to-group) este vulnerabil la atacuri prin m\u0103surarea timpului de execu\u021bie al opera\u021biunilor (timing attack).<\/p>\n
Pentru a efectua atacuri prin analiza cache-ului, atacatorul trebuie s\u0103 aib\u0103 capacitatea de a executa cod neprivilegiat pe sistemul utilizatorului care se conecteaz\u0103 la re\u021beaua wireless. Ambele metode permit ob\u021binerea informa\u021biilor necesare pentru a clarifica corectitudinea alegerii p\u0103r\u021bilor parolei \u00een procesul de ghicire. Eficien\u021ba atacului este destul de ridicat\u0103 \u0219i permite ghicirea unei parole de 8 caractere, care include litere mici, intercept\u00e2nd doar 40 de sesiuni de negociere a conexiunii (handshake) \u0219i consum\u00e2nd resurse echivalente cu \u00eenchirierea capacit\u0103\u021bilor Amazon EC2 de 125 dolari. <\/p>\n
Pe baza vulnerabilit\u0103\u021bilor identificate, au fost propuse mai multe scenarii de atac:<\/p>\n
De asemenea, s-a constatat c\u0103 demonul iwd, dezvoltat de Intel ca alternativ\u0103 la wpa_supplicant, \u0219i stiva wireless Samsung Galaxy S10 sunt vulnerabile la attack-uri de tip downgrade chiar \u0219i \u00een re\u021bele care folosesc exclusiv WPA3 - dac\u0103 aceste dispozitive s-au conectat anterior la o re\u021bea WPA3, ele vor \u00eencerca s\u0103 se conecteze la o re\u021bea WPA2 fals\u0103 cu acela\u0219i nume.<\/p>\n
Au fost preg\u0103tite mai multe scripturi pentru a verifica dispozitivele pentru vulnerabilit\u0103\u021bi, cu exemple de atacuri:<\/p>\n
Asocierea Wi-Fi Alliance, care dezvolt\u0103 standarde pentru re\u021belele wireless, a anun\u021bat c\u0103 problema afecteaz\u0103 un num\u0103r limitat de implement\u0103ri timpurii ale WPA3-Personal \u0219i poate fi rezolvat\u0103 prin actualizarea firmware-ului \u0219i software-ului. P\u00e2n\u0103 \u00een prezent, nu au fost raportate fapte de exploatare a vulnerabilit\u0103\u021bilor \u00een scopuri mali\u021bioase. Pentru a \u00eent\u0103ri securitatea, Wi-Fi Alliance a ad\u0103ugat teste suplimentare \u00een programul de certificare a dispozitivelor wireless pentru a verifica corectitudinea implement\u0103rilor \u0219i a contactat produc\u0103torii de dispozitive pentru a coordona \u00een comun solu\u021bionarea problemelor identificate. Patch-uri de remedii sunt deja lansate pentru hostap\/wpa_supplicant. Actualiz\u0103ri de pachete sunt disponibile pentru Ubuntu. \u00cen Debian, RHEL, SUSE\/openSUSE, Arch, Fedora \u0219i FreeBSD, problemele r\u0103m\u00e2n nerezolvate. \u041c\u044d\u0442\u0438 \u0412\u0430\u043d\u0445\u043e\u0444\u043e\u043c (Mathy Vanhoef), \u0430\u0432\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 KRACK \u043d\u0430 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0435 \u0441\u0435\u0442\u0438 \u0441 WPA2, \u0438 \u042d\u044f\u043b\u044c \u0420\u043e\u043d\u0435\u043d (Eyal Ronen), \u0441\u043e\u0430\u0432\u0442\u043e\u0440 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0430\u0442\u0430\u043a \u043d\u0430 TLS, \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0448\u0435\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 (CVE-2019-9494 — CVE-2019-9499) \u0432 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0437\u0430\u0449\u0438\u0442\u044b \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 WPA3, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0432\u043e\u0441\u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043f\u0430\u0440\u043e\u043b\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0431\u0435\u0437 \u0437\u043d\u0430\u043d\u0438\u044f \u043f\u0430\u0440\u043e\u043b\u044f. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u044b \u043f\u043e\u0434 \u043a\u043e\u0434\u043e\u0432\u044b\u043c \u0438\u043c\u0435\u043d\u0435\u043c Dragonblood […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-31424","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u0103\u021bi \u00een tehnologia de protec\u021bie a re\u021belelor wireless WPA3 \u0219i \u00een EAP-pwd | ProHoster","description":"Mathy Vanhoef, autorul atacului KRACK asupra re\u021belelor cu WPA2, \u0219i Eyal Ronen, coautor al unor atacuri asupra TLS, au dezv\u0103luit informa\u021bii despre \u0219ase vulnerabilit\u0103\u021bi (CVE-2019-9494 - CVE-2019-9499) \u00een.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-tehnologii-zashhity-besprovodnyh-setej-wpa3-i-v-eap-pwd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0437\u0430\u0449\u0438\u0442\u044b \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 WPA3 \u0438 \u0432 EAP-pwd | ProHoster","og:description":"\u041c\u044d\u0442\u0438 \u0412\u0430\u043d\u0445\u043e\u0444\u043e\u043c (Mathy Vanhoef), \u0430\u0432\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 KRACK \u043d\u0430 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0435 \u0441\u0435\u0442\u0438 \u0441 WPA2, \u0438 \u042d\u044f\u043b\u044c \u0420\u043e\u043d\u0435\u043d (Eyal Ronen), \u0441\u043e\u0430\u0432\u0442\u043e\u0440 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0430\u0442\u0430\u043a \u043d\u0430 TLS, \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0448\u0435\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 (CVE-2019-9494 - CVE-2019-9499) \u0432.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-tehnologii-zashhity-besprovodnyh-setej-wpa3-i-v-eap-pwd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:41:11+00:00","article:modified_time":"2019-10-31T18:41:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31424","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 06:08:14","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:17:25","updated":"2026-01-21 06:08:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/31424","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=31424"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/31424\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=31424"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=31424"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=31424"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"