Dragonblood Vulnerabilities Seep Into WPA3 Secure Wifi Handshake

A new set of vulnerabilities may put some early adopters of strong Wifi security at greater security risk.

In 2018, the Wi-Fi Alliance
released the first major update
to Wi-Fi Protected Access (WPA) in more than a decade: WPA3. WPA3 offers more robust encryption and privacy, as well as a simplified process for devices to log onto a secure network. According to a pair of researchers, the login process also includes vulnerabilities that could render WPA3 far less secure than is promised.
The vulnerabilities were unearthed by Mathy Vanhoef of New York University Abu Dhabi—one of the researchers behind the October 2017 discovery of the
KRACK vulns in WPA2—
and Eyal Ronen of Tel Aviv University and KU Leuven.
Vanhoef and Ronen write in
their recent paper
that there are flaws in the handshake process that can allow efficient and low-cost attacks on the passwords used as part of network credentials.
In particular, they write that the existing standards that the WiFi alliance chose for WPA3 brought both timing and cache-based side-channel vulnerability issues to the Simultaneous Authentication of Equals (SAE) handshake that is a key piece of WPA3s improvement over WPA2.
The SAE handshake is commonly known as Dragonfly; the researchers have thus dubbed this new set of vulnerabilities Dragonblood.
Kevin Robinson, vice president of marketing for the Wi-Fi Alliance, is eager for people not to panic about the vulnerability. Not all WPA3 personal devices are affected, he says, adding, The small number of devices that are affected with these issues can all be patched through software updates without any impact on the devices ability to work well together.
The devices vulnerable to the attacks presented by Vanhoef and Ronen are those that allow side-channel collection of data by attacking software that has been installed on the device, and those that use specific, unsuitable cryptographic elements as part of their hashing process.
The attack comes as part of the process that allows a legacy WPA2 device to attach to a WPA3-enabled access point; the resulting downgrade operation opens up the process to a brute-force dictionary attack on the passwords used for authentication.
A WPA3 network that is not in transition mode [connecting a WPA2 device to the WPA3 access point] is not susceptible to the problems that the researcher highlighted, says Robinson. So, …the best way is to get people over to the new security protocol. He points out that, The Wi-Fi Alliance always intended for [transition mode] to be a temporary measure that would then ultimately be disabled once the network devices have moved over to WPA3.
Mitigating the vulnerability discovered by Vanhoef and Ronen boils down to two things: transitioning to a fully WPA3 network as rapidly as possible, and installing all patches and updates to WPA3-enabled equipment already installed.
What about transparency?
But the researchers also took aim at what they see as a root cause of the vulnerability: a flawed process for developing the WPA3 standard. …we believe that our attacks could have been avoided if the Wi-Fi Alliance created the WPA3 certification in a more open manner.
The Wi-Fi Alliance does follow the recommended practice of using existing security standards, says Robinson in response.
Explaining that the Wi-Fi Alliance does not itself develop basic authentication protocols, he says, The IEEE has a robust standardization process and the IEEE introduced simultaneous authentication of equals for 802.11 in 2011, allowing significant time for broad, multi-stakeholder input. As for why the Wi-Fi Alliance chose to use the protocol, Robinson says, No other protocol with similar benefits existed within 802.11 at the time the Wi-Fi Alliance was evaluating technologies.
Now, researchers like Vanhoef and Ronen are probing the implementations of WPA3 and that, says, Robinson, is how the process should work. [Researchers are] finding issues and industry is responding in a very rapid and proactive manner, Robinson says, adding and this is all a healthy dynamic.
Related content:
Lessons Learned from a Hard-Hitting Security Review
RF Hacking Research Exposes Danger to Construction Sites
The Security Perimeter Is Dead; Long Live the New Endpoint Perimeter
The Coolest Hacks of 2018
New Bluetooth Vulnerabilities Exposed in Aruba, Cisco, Meraki Access Points

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industrys most knowledgeable IT security experts. Check out the
Interop agenda
here.

Last News
▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security	▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security	▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Dragonblood Vulnerabilities Seep Into WPA3 Secure Wifi Handshake