Mathy Vanhoef, autor \u00fatoku KRACK na bezdr\u00f4tov\u00e9 siete s WPA2, a Eyal Ronen, spoluautor niektor\u00fdch \u00fatokov na TLS, odhalili inform\u00e1cie o \u0161iestich zranite\u013enostiach (CVE-2019-9494 \u2014 CVE-2019-9499) v technol\u00f3gii ochrany bezdr\u00f4tov\u00fdch siet\u00ed WPA3, ktor\u00e9 umo\u017e\u0148uj\u00fa obnovi\u0165 pr\u00edstupov\u00e9 heslo a z\u00edska\u0165 pr\u00edstup k bezdr\u00f4tovej sieti bez znalosti hesla. Zranite\u013enosti s\u00fa spojen\u00e9 pod k\u00f3dov\u00fdm menom Dragonblood a umo\u017e\u0148uj\u00fa skompromitova\u0165 met\u00f3du dohadovania spojen\u00ed Dragonfly, ktor\u00e1 chr\u00e1ni proti offline uh\u00e1dnutiu hesla. Okrem WPA3 sa met\u00f3da Dragonfly pou\u017e\u00edva aj na ochranu proti slovn\u00e9mu uh\u00e1dnutiu v protokole EAP-pwd, ktor\u00fd sa pou\u017e\u00edva v syst\u00e9me Android, na serveroch RADIUS a v hostapd\/wpa_supplicant.<\/p>\n
Po\u010das vy\u0161etrovania boli identifikovan\u00e9 dva hlavn\u00e9 typy architektonick\u00fdch probl\u00e9mov v WPA3. Obe kateg\u00f3rie probl\u00e9mov m\u00f4\u017eu v kone\u010dnom d\u00f4sledku sl\u00fa\u017ei\u0165 na obnovenie pr\u00edstupov\u00e9ho hesla. Prv\u00fd typ umo\u017e\u0148uje vykona\u0165 downgrade na ned\u00f4veryhodn\u00e9 kryptografick\u00e9 met\u00f3dy (downgrade attack): prostriedky na zabezpe\u010denie kompatibility s WPA2 (tranzitn\u00fd re\u017eim, ktor\u00fd umo\u017e\u0148uje pou\u017e\u00edvanie WPA2 a WPA3) umo\u017e\u0148uj\u00fa \u00fato\u010dn\u00edkovi prin\u00fati\u0165 klienta vykona\u0165 \u0161tvorkrokov\u00fd proces s\u00fahlasu pripojen\u00ed WPA2, \u010do n\u00e1sledne umo\u017e\u0148uje pou\u017e\u00edvanie klasick\u00fdch \u00fatokov na odhad hesla, ktor\u00e9 s\u00fa \u00fa\u010dinn\u00e9 proti WPA2. Navy\u0161e bola zisten\u00e1 aj mo\u017enos\u0165 vykonania downgrade \u00fatoku priamo na met\u00f3du s\u00fahlasu pripojen\u00ed Dragonfly, \u010do umo\u017e\u0148uje prejs\u0165 na menej zabezpe\u010den\u00e9 typy eliptick\u00fdch kriviek.<\/p>\n
Druh\u00fd typ probl\u00e9mov vedie k \u00fanikom inform\u00e1ci\u00ed o charakteristik\u00e1ch hesla prostredn\u00edctvom ved\u013eaj\u0161\u00edch kan\u00e1lov a zaklad\u00e1 sa na nedostatkoch v met\u00f3de k\u00f3dovania hesla v Dragonfly, ktor\u00e9 umo\u017e\u0148uj\u00fa na z\u00e1klade nepriamej sp\u00e4tnej v\u00e4zby, ako je zmena zdr\u017eania pri vykon\u00e1van\u00ed oper\u00e1ci\u00ed, obnovi\u0165 p\u00f4vodn\u00e9 heslo. Algoritmus prevodu hash na eliptick\u00fa krivku (hash-to-curve) pou\u017eit\u00fd v Dragonfly je zranite\u013en\u00fd vo\u010di \u00fatokom prostredn\u00edctvom sledovania inform\u00e1ci\u00ed v procesorovej cache (cache attack), zatia\u013e \u010do algoritmus prevodu hash do skupiny (hash-to-group) je zranite\u013en\u00fd vo\u010di \u00fatokom merania \u010dasu vykon\u00e1vania oper\u00e1ci\u00ed (timing attack).<\/p>\n
Na uskuto\u010dnenie \u00fatokov cez anal\u00fdzu cache mus\u00ed \u00fato\u010dn\u00edk ma\u0165 schopnos\u0165 vykon\u00e1va\u0165 neprivilegovan\u00fd k\u00f3d na syst\u00e9me pou\u017e\u00edvate\u013ea, ktor\u00fd sa prip\u00e1ja k bezdr\u00f4tovej sieti. Obe met\u00f3dy umo\u017e\u0148uj\u00fa z\u00edska\u0165 inform\u00e1cie potrebn\u00e9 na overenie spr\u00e1vnosti v\u00fdberu \u010dast\u00ed hesla po\u010das jeho pokusu. \u00da\u010dinnos\u0165 \u00fatoku je dostato\u010dne vysok\u00e1 a umo\u017e\u0148uje z\u00edska\u0165 8-znakov\u00e9 heslo, ktor\u00e9 obsahuje mal\u00e9 p\u00edsmen\u00e1, zachyten\u00edm iba 40 s\u00fahlasn\u00fdch se\u00e1ns (handshake) a min\u00fac prostriedky ekvivalentn\u00e9 pren\u00e1jmu v\u00fdkonu Amazon EC2 za 125 dol\u00e1rov. <\/p>\n
Na z\u00e1klade zisten\u00fdch zranite\u013enost\u00ed bolo navrhnut\u00fdch nieko\u013eko scen\u00e1rov \u00fatokov:<\/p>\n
Okrem toho sa zistilo, \u017ee demon iwd, vyv\u00edjan\u00fd spolo\u010dnos\u0165ou Intel ako alternat\u00edva k wpa_supplicant, a bezdr\u00f4tov\u00fd stack Samsung Galaxy S10 s\u00fa n\u00e1chyln\u00e9 na downgrade \u00fatoky aj v sie\u0165ach, ktor\u00e9 pou\u017e\u00edvaj\u00fa iba WPA3 \u2014 ak sa tieto zariadenia predt\u00fdm pripojili k WPA3 sieti, pok\u00fasia sa pripoji\u0165 k falo\u0161nej WPA2 sieti so rovnak\u00fdm n\u00e1zvom.<\/p>\n
Na overenie zariaden\u00ed na pr\u00edtomnos\u0165 zranite\u013enost\u00ed bolo pripraven\u00fdch nieko\u013eko skriptov s pr\u00edkladmi vykonania \u00fatokov:<\/p>\n
Zv\u00e4z Wi-Fi Alliance, ktor\u00fd rozv\u00edja \u0161tandardy pre bezdr\u00f4tov\u00e9 siete, ozn\u00e1mil, \u017ee probl\u00e9m sa t\u00fdka obmedzen\u00e9ho po\u010dtu skor\u00fdch implement\u00e1ci\u00ed WPA3-Personal a m\u00f4\u017ee by\u0165 odstr\u00e1nen\u00fd prostredn\u00edctvom aktualiz\u00e1cie firmv\u00e9ru a softv\u00e9ru. Faktick\u00e9 pr\u00edpady zneu\u017eitia zranite\u013enost\u00ed na vykonanie \u0161kodliv\u00fdch \u010dinov zatia\u013e neboli zaznamenan\u00e9. Na posilnenie zabezpe\u010denia Wi-Fi Alliance pridala do programu certifik\u00e1cie bezdr\u00f4tov\u00fdch zariaden\u00ed dodato\u010dn\u00e9 testy na preverenie spr\u00e1vnosti implement\u00e1ci\u00ed, ako aj kontaktovala v\u00fdrobcov zariaden\u00ed na spolo\u010dn\u00fa koordin\u00e1ciu odstr\u00e1nenia zisten\u00fdch probl\u00e9mov. Opravy na odstr\u00e1nenie probl\u00e9mov u\u017e boli vydan\u00e9 pre hostap\/wpa_supplicant. Aktualiz\u00e1cie bal\u00edkov s\u00fa dostupn\u00e9 pre Ubuntu. V Debian, RHEL, SUSE\/openSUSE, Arch, Fedora a FreeBSD probl\u00e9my zatia\u013e zost\u00e1vaj\u00fa neopravene. \u041c\u044d\u0442\u0438 \u0412\u0430\u043d\u0445\u043e\u0444\u043e\u043c (Mathy Vanhoef), \u0430\u0432\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 KRACK \u043d\u0430 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0435 \u0441\u0435\u0442\u0438 \u0441 WPA2, \u0438 \u042d\u044f\u043b\u044c \u0420\u043e\u043d\u0435\u043d (Eyal Ronen), \u0441\u043e\u0430\u0432\u0442\u043e\u0440 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0430\u0442\u0430\u043a \u043d\u0430 TLS, \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0448\u0435\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 (CVE-2019-9494 — CVE-2019-9499) \u0432 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0437\u0430\u0449\u0438\u0442\u044b \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 WPA3, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0432\u043e\u0441\u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043f\u0430\u0440\u043e\u043b\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0431\u0435\u0437 \u0437\u043d\u0430\u043d\u0438\u044f \u043f\u0430\u0440\u043e\u043b\u044f. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u044b \u043f\u043e\u0434 \u043a\u043e\u0434\u043e\u0432\u044b\u043c \u0438\u043c\u0435\u043d\u0435\u043c Dragonblood […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-31424","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enosti v technol\u00f3gii ochrany bezdr\u00f4tov\u00fdch siet\u00ed WPA3 a v EAP-pwd | ProHoster","description":"Mathy Vanhoef, autor \u00fatoku KRACK na bezdr\u00f4tov\u00e9 siete s WPA2, a Eyal Ronen, spoluautor niektor\u00fdch \u00fatokov na TLS, odhalili inform\u00e1cie o \u0161iestich zranite\u013enostiach (CVE-2019-9494 - CVE-2019-9499) v.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimosti-v-tehnologii-zashhity-besprovodnyh-setej-wpa3-i-v-eap-pwd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0437\u0430\u0449\u0438\u0442\u044b \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 WPA3 \u0438 \u0432 EAP-pwd | ProHoster","og:description":"\u041c\u044d\u0442\u0438 \u0412\u0430\u043d\u0445\u043e\u0444\u043e\u043c (Mathy Vanhoef), \u0430\u0432\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 KRACK \u043d\u0430 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0435 \u0441\u0435\u0442\u0438 \u0441 WPA2, \u0438 \u042d\u044f\u043b\u044c \u0420\u043e\u043d\u0435\u043d (Eyal Ronen), \u0441\u043e\u0430\u0432\u0442\u043e\u0440 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0430\u0442\u0430\u043a \u043d\u0430 TLS, \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0448\u0435\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 (CVE-2019-9494 - CVE-2019-9499) \u0432.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimosti-v-tehnologii-zashhity-besprovodnyh-setej-wpa3-i-v-eap-pwd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:41:11+00:00","article:modified_time":"2019-10-31T18:41:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31424","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 06:08:14","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:17:25","updated":"2026-01-21 06:08:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/31424","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=31424"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/31424\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=31424"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=31424"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=31424"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"