Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

'Dragonblood' Vulnerabilities Seep Into WPA3 Secure Wifi Handshake

A new set of vulnerabilities may put some early adopters of strong Wifi security at greater security risk.

In 2018, the Wi-Fi Alliance released the first major update to Wi-Fi Protected Access (WPA) in more than a decade: WPA3. WPA3 offers more robust encryption and privacy, as well as a simplified process for devices to log onto a secure network. According to a pair of researchers,  the login process also includes vulnerabilities that could render WPA3 far less secure than is promised.

The vulnerabilities were unearthed by Mathy Vanhoef of New York University Abu Dhabi—one of the researchers behind the October 2017 discovery of the KRACK vulns in WPA2—and Eyal Ronen of Tel Aviv University and KU Leuven.

Vanhoef and Ronen write in their recent paper that there are flaws in the handshake process that can allow efficient and low-cost attacks on the passwords used as part of network credentials.

In particular, they write that the existing standards that the WiFi alliance chose for WPA3 brought both timing and cache-based side-channel vulnerability issues to the Simultaneous Authentication of Equals (SAE) handshake that is a key piece of WPA3's improvement over WPA2.

The SAE handshake is commonly known as Dragonfly; the researchers have thus dubbed this new set of vulnerabilities Dragonblood.

Kevin Robinson, vice president of marketing for the Wi-Fi Alliance, is eager for people not to panic about the vulnerability. "Not all WPA3 personal devices are affected," he says, adding, "The small number of devices that are affected with these issues can all be patched through software updates without any impact on the devices' ability to work well together."

The devices vulnerable to the attacks presented by Vanhoef and Ronen are those that allow side-channel collection of data by attacking software that has been installed on the device, and those that use specific, unsuitable cryptographic elements as part of their hashing process.

The attack comes as part of the process that allows a legacy WPA2 device to attach to a WPA3-enabled access point; the resulting "downgrade" operation opens up the process to a brute-force dictionary attack on the passwords used for authentication.

"A WPA3 network that is not in transition mode [connecting a WPA2 device to the WPA3 access point] is not susceptible to the problems that the researcher highlighted," says Robinson. So, "…the best way is to get people over to the new security protocol." He points out that, "The Wi-Fi Alliance always intended for [transition mode] to be a temporary measure that would then ultimately be disabled once the network devices have moved over to WPA3."

Mitigating the vulnerability discovered by Vanhoef and Ronen boils down to two things: transitioning to a fully WPA3 network as rapidly as possible, and installing all patches and updates to WPA3-enabled equipment already installed.

What about transparency?

But the researchers also took aim at what they see as a root cause of the vulnerability: a flawed process for developing the WPA3 standard. "…we believe that our attacks could have been avoided if the Wi-Fi Alliance created the WPA3 certification in a more open manner."

"The Wi-Fi Alliance does follow the recommended practice of using existing security standards," says Robinson in response.

Explaining that the Wi-Fi Alliance does not itself develop basic authentication protocols, he says, "The IEEE has a robust standardization process and the IEEE introduced simultaneous authentication of equals for 802.11 in 2011, allowing significant time for broad, multi-stakeholder input." As for why the Wi-Fi Alliance chose to use the protocol, Robinson says, "No other protocol with similar benefits existed within 802.11 at the time the Wi-Fi Alliance was evaluating technologies."

Now, researchers like Vanhoef and Ronen are probing the implementations of WPA3 and that, says, Robinson, is how the process should work. "[Researchers are] finding issues and industry is responding in a very rapid and proactive manner," Robinson says, adding "and this is all a healthy dynamic."

Related content:

 

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Edge-DRsplash-10-edge-articles
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
News
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21273
PUBLISHED: 2021-02-26
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, requests to user provided domains were not restricted to external IP addresses when calculating the key va...
CVE-2021-21274
PUBLISHED: 2021-02-26
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a malicious homeserver could redirect requests to their .well-known file to a large file. This can lead to...
CVE-2021-23345
PUBLISHED: 2021-02-26
All versions of package github.com/thecodingmachine/gotenberg are vulnerable to Server-side Request Forgery (SSRF) via the /convert/html endpoint when the src attribute of an HTML element refers to an internal system file, such as <iframe src='file:///etc/passwd'>.
CVE-2021-21297
PUBLISHED: 2021-02-26
Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object with the potential to affect the default beh...
CVE-2021-21298
PUBLISHED: 2021-02-26
Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier has a vulnerability which allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with `projects.read` permission is able to access any file via th...