

Extreme Hacking | Sadik Shaikh | Cyber Suraksha Abhiyan

- robot handshake shutterstock - Bug-hunters punch huge holes in WPA3 standard for Wi-Fi security &#8211;

Credits: The Register


Mathy Vanhoef, of New York University Abu Dhabi, and Eyal Ronen, of Tel Aviv University, have disclosed five different methods for breaking into or disrupting routers using the newest version of the wireless network standard. The duo have already privately reporting the issue to the Wi-Fi Alliance and Cert/CC to make sure vendors had time to get fixes out prior to disclosure.


“Concretely, attackers can then read information that WPA3 was assumed to safely encrypt,” Vanhoef and Ronen explained. “This can for example be abused to steal sensitive information such as credit cards, passwords, chat messages, emails, and so on, if no extra protection such as HTTPS is used.”

Side-channel bugs: not just for CPUs any more

Two of the issues posed were side channel attacks and have been classified together as CVE-2019-9494. Both describe ways for an attacker to use a dictionary to work out a password (the researchers estimate this can be done with AWS instances for about $12).


“When the AP uses security groups based on elliptic curves, which all WPA3 devices are required to support, no timing information is leaked,” Vanhoef and Ronen said. “However, when the AP supports the optional multiplicative security groups modulo a prime (MODP groups), the response time depends on the password being used.”


“Observing these patterns is possible if the adversary controls any application on the ’s device, and may even be possible when the adversary controls JavaScript code in the ’s browser,” the bug-hunters explained.

Downgrade attacks use WPA3’s shiny new status as a weapon



The second downgrade attack likewise uses the spoofed network, and takes advantage of the “security group” component that allows the access point to tell the client device what security standard it wants to use. In this attack, the attacker-controlled access point would send the victim decline messages to not to use WPA3, requiring another attempt to send login credentials with WPA, once again allowing the attacker to brute-force the login.

And a DoS bug just for good measure


“Processing this frame and generating an answer is computationally expensive, especially if defenses against (already known) side-channel attacks are implemented,” the pair explain.

“Although WPA3 contains a cookie-exchange method to prevent attackers from forging commit frames using MAC addresses, it is trivial to bypass.”


One more bug in the pipeline


The rest of the bugs are explained in full detail in the duo’s academic paper, “Dragonblood: A Security Analysis of WPA3’s SAE Handshake”

- logo16 - Bug-hunters punch huge holes in WPA3 standard for Wi-Fi security &#8211;



Source link

No tags for this post.


Please enter your comment!
Please enter your name here