Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Serious flaws leave WPA3 vulnerable to hacks that steal Wi-Fi passwords

arstechnica.com

Post reply on HN
Print view View original

21–30 of 40 posts

Re: Serious flaws leave WPA3 vulnerable to hacks that steal Wi-Fi passwords

#21

Post by gipsies »

zamadatix wrote: post #4

Downgrade attacks: WPA3 has a transitional mode which allows legacy WPA2 clients to connect. In this mode legacy WPA2 security issues are still present. Is this really a discovery or a given? How is WPA3 supposed to protect against it without requiring either WPA2 clients to be upgraded to support WPA3 security fixes (in which case you don't need WPA2 support anymore anyways) or without dropping support for transitio…

If we look at the paper then these remarks are all discussed:

- Defending against downgrade attack: "A client should remember if a network supports WPA3-SAE. That is, after successfully connecting using SAE [..] the client must never connect to this network using a weaker handshake". The Google Pixel 3 is thankfully already doing this, but others aren't. So perfectly preventable, and something the Wi-Fi Alliance could have included in their WPA3 specification.

- Side-channel leaks: "A backwards-compatible countermeasure is to replace the two vulnerable branches with a constant-time select utility, and use constant time Legendre symbol computation as defined in [73]". The WPA3 standard already contained certain side-channel defenses, but it was still vulnerable. They could've also included these new defenses in the WPA3 standard.

- Denial-of-Service attack: "... our attack is more efficient than a straightforward DoS where an attacker simply jams the channel." We only needed to inject 10 commit frames every second to overload a professional AP..

- Modern crypto standards should be written so the chance of implementation bugs is low. For example, the new hash-to-curve algorithms being standardized include side-channel defenses in the specification itself. See their usage of the CMOV instruction that provides a "Common software implementations of constant-time selects" https://tools.ietf.org/html/draft-irtf-cfrg-hash-to-curve-03

Re: Serious flaws leave WPA3 vulnerable to hacks that steal Wi-Fi passwords

#22

Post by robocat »

Aside: “A valid SSID is 0-32 octets with arbitrary contents”

An SSID is up to 16 bytes of arbitrary data e.g. 16 nulls is a valid SSID - I wonder how many UI flaws (or security flaws) result from that decision...

Why wouldn’t WPA3 introduce sane limitations on SSIDs?

Re: Serious flaws leave WPA3 vulnerable to hacks that steal Wi-Fi passwords

#23

Post by rdl »

My dream is to eliminate PSK from all the networks I care about/am responsible for, but it's really challenging to deploy 802.1X in anything but a fully managed enterprise (and also hard when you also have random other IOT/etc. type devices; usually the "important" ones you can just put onto wired network, and the unimportant ones go onto dedicated psk, but it's still a pain.

Still hate it all less than captive portals (which I hate so so much), but it's pretty annoying.

Re: Serious flaws leave WPA3 vulnerable to hacks that steal Wi-Fi passwords

#24

Post by Sargos »

uuddlrlrbas wrote: post #7
penagwin wrote: post #2

For some reason I'm surprised we've had so many issues with Wi-Fi security. I don't know if it was addressed in WPA3 (or if it would be addressed there), but my understanding is that a good chunk of the protocol isn't authenticated at all, such as the de-auth packets. In a world with growing HTTPS support, OpenVPN, WireGuard, etc. and we can't secure a wifi network with a shared key?

The reason we have had so many problems is because these "standards" are not vetted by third-parties and therefore not allowed to test the security of these standards. The Alliance is a closed members-only committee, so yeah I don't doubt we will keep seeing these issues crop up.

Why is everyone using some proprietary standards body for something as important to humanity as a whole like wifi? That seems absurd.

Why hasn't someone like Apple or Google created an open standard and push adoption?

Re: Serious flaws leave WPA3 vulnerable to hacks that steal Wi-Fi passwords

#25

Post by dwheeler »

uuddlrlrbas wrote: post #7
penagwin wrote: post #2

For some reason I'm surprised we've had so many issues with Wi-Fi security. I don't know if it was addressed in WPA3 (or if it would be addressed there), but my understanding is that a good chunk of the protocol isn't authenticated at all, such as the de-auth packets. In a world with growing HTTPS support, OpenVPN, WireGuard, etc. and we can't secure a wifi network with a shared key?

The reason we have had so many problems is because these "standards" are not vetted by third-parties and therefore not allowed to test the security of these standards. The Alliance is a closed members-only committee, so yeah I don't doubt we will keep seeing these issues crop up.

That's also my understanding. My understanding is that these specifications were not developed in the open, and thus there was no opportunity for external scrutiny before they were ratified. It's exactly the same reason previous similar specifications were so badly broken. Nothing has been learned.

Re: Serious flaws leave WPA3 vulnerable to hacks that steal Wi-Fi passwords

#26

Post by sandworm101 »

blitmap wrote: post #11
zamadatix wrote: post #4

Downgrade attacks: WPA3 has a transitional mode which allows legacy WPA2 clients to connect. In this mode legacy WPA2 security issues are still present. Is this really a discovery or a given? How is WPA3 supposed to protect against it without requiring either WPA2 clients to be upgraded to support WPA3 security fixes (in which case you don't need WPA2 support anymore anyways) or without dropping support for transitio…

Preface: I am not at all an expert on WiFi In WPA2 you can send deauthentication "frames" to clients to get them to disconnect from the access point. Later I was told these "control frames" can now be encrypted, with an extension/modification to WPA2 supported in the better consumer wireless routers like Linksys? In response to your Denial of Service point: Does WPA3 make it harder to disconnect clients? (or are you…

There is only so much effort one can put into denial of service attacks in wireless. The fact that this involves radio frequencies means there is always a nuclear option: massive broadcasts of white noise. There is no way for wifi devices to adapt to such an attack. So the fact that some denial attacks can happen using exploits is moot. If the attacker really wants to hold your network down he isn't going to bother with tricky packets. He is going to jam the entire spectrum. Whether you are running WEP or some bleeding edge WPA5.7 implementation won't matter if all anyone can hear is white noise.

Re: Serious flaws leave WPA3 vulnerable to hacks that steal Wi-Fi passwords

#27

Post by gruez »

robocat wrote: post #22

Aside: “A valid SSID is 0-32 octets with arbitrary contents” An SSID is up to 16 bytes of arbitrary data e.g. 16 nulls is a valid SSID - I wonder how many UI flaws (or security flaws) result from that decision... Why wouldn’t WPA3 introduce sane limitations on SSIDs?

>e.g. 16 nulls is a valid SSID - I wonder how many UI flaws (or security flaws) result from that decision...

How can you exploit this? If you put in null bytes, then in all likelyhood it will get truncated early. It's not going to cause an overflow or anything.

Re: Serious flaws leave WPA3 vulnerable to hacks that steal Wi-Fi passwords

#28

Post by Hikikomori »

simongr3dal wrote: post #5
Hikikomori wrote: post #3

Earlier quoted context omitted.

You get protected management frames with 802.11w, WPA3 has it by default. Vendor support for it, in my experience, has been pretty bad however.

I know that the 802.11 means it's a standard for a wireless communication protocol, but I'm only familiar with 802.11b/a/g/n/ac (because they are on the admin page of my router). How do I now whether my WiFi supports 802.11w or any of the other countless 802.x family of standards that would be nice to have? Are there any good overviews to these things?

You read the specs or manual for your access point/router. You could also look at beacons and your association request in wireshark, the AP will advertise what it supports. I don't think you'll find these features in consumer equipment, so your best bet is wpa3.

Re: Serious flaws leave WPA3 vulnerable to hacks that steal Wi-Fi passwords

#29

Post by penagwin »

gruez wrote: post #27
robocat wrote: post #22

Aside: “A valid SSID is 0-32 octets with arbitrary contents” An SSID is up to 16 bytes of arbitrary data e.g. 16 nulls is a valid SSID - I wonder how many UI flaws (or security flaws) result from that decision... Why wouldn’t WPA3 introduce sane limitations on SSIDs?

>e.g. 16 nulls is a valid SSID - I wonder how many UI flaws (or security flaws) result from that decision... How can you exploit this? If you put in null bytes, then in all likelyhood it will get truncated early. It's not going to cause an overflow or anything.

This is just a "maybe" idea. If there's any clients that crash when not expecting the nulls then you may be able to crash all effected devices within the area.

Depending on how hard they crash, this might be generally affective maybe.

Re: Serious flaws leave WPA3 vulnerable to hacks that steal Wi-Fi passwords

#30

Post by zamadatix »

benchaney wrote: post #16
zamadatix wrote: post #9

Earlier quoted context omitted.

I'm not going to get into the ideological debate of if the standards process is open enough or not but let me pose this: Is it not more likely the fact WPA2 was ratified in 2004 that it continues to be of questionable security to utilize in 2019?

No, because: 1. WPA3, which has only recently been created, is riddled with issues. 2. Many things much older than WPA2 are still used today without major issues e.g. AES and RSA. The idea that standards processes aught to be open is not a ideological debate anymore. At this point it is a simple truth backed by overwhelming empirical evidence.

The process not being open != The process should have happened sooner

In regards to 2 I disagree, see tls 1.0 as an example. Also aes isn't a protocol, apples to oranges.

Post reply on HN