RU EN
Добро пожаловать на SKY-FRAUD.RU, после регистрации , вам будут доступны все разделы форума.
Вернуться   SKY-FRAUD.RU > Основное общение > Mass media about us > Researchers Find Flaws in WPA2's 4-way Handshake Implementations
 
Adv. info:
Важная информация
Основные домены форума: SKY-FRAUD.RU | S-FRAUD.RU

TOR: bcbm4y7yusdxthg3.onion

XMPP.NAME - Официальный Jabber сервер для участников SKY-FRAUD.RU
Mass media about us News from the world about us.

UAS section 1
FE051217
Advert 3
Ответ
 
Опции темы Опции просмотра
Старый 10.08.2018, 00:43   #1
radikal
Модератор
 
Аватар для radikal
 
radikal на форуме
Регистрация: 08.02.2014
Сообщений: 4,422
По умолчанию Researchers Find Flaws in WPA2's 4-way Handshake Implementations

Researchers have discovered several security vulnerabilities in implementations of Wi-Fi Protected Access two (WPA2)’s 4-way handshake, which is used by nearly all protected Wi-Fi networks.

The discovery was the result of simulating cryptographic primitives during symbolic execution for the analysis of security protocol implementations, KU Leuven researchers Mathy Vanhoef and Frank Piessens explain in a recently published whitepaper (PDF).

By applying the technique on three client-side implementations of WPA2’s 4-way handshake, the researchers discovered timing side-channels when verifying authentication tags, a denial-of-service attack, a stack-based buffer overflow, and a non-trivial decryption oracle.

Through symbolic execution, the researchers claim, one aims to exhaustively explore all code paths of a program by running on symbolic inputs instead of concrete ones. For their experiments, the researchers implemented the techniques on top of the KLEE symbolic execution engine (they modified the engine to handle cryptographic primitives).

Of the three tested implementations, two were found susceptible to trivial timing side-channels, because they verify authentication tags using timing-unsafe memory compares.

The researchers found a denial of service in Intel’s iwd daemon (iNet wireless daemon) and a stack-based buffer overflow (in code that processes decrypted data) in MediaTek’s implementation, both of which can be triggered by malicious Access Point (AP). The AES unwrap algorithm was found to be incorrectly implemented in MediaTek’s code.

Furthermore, the wpa supplicant (a cross-platform supplicant with support for WEP, WPA and WPA2 (IEEE 802.11i)) was found vulnerable to a non-trivial decryption oracle caused by processing decrypted but unauthenticated data. Tracked as CVE-2018-14526, the bug can be exploited to recover sensitive information.

“This decryption oracle can be exploited when the victim connects to a WPA2 network using the old TKIP encryption algorithm. It can be abused to decrypt the group key transported in message 3 of the 4-way handshake,” the researchers note.

The attack, however, is only possible if WPA2 is used and if the client selects TKIP as the pairwise cipher, so that the RC4 stream cipher is used to encrypt the key data field (if CCMP is selected, AES is used to protect the key data field). Both conditions are met when the Wi-Fi network uses WPA2 and only supports TKIP (in 2016, 20% of protected Wi-Fi networks used this configuration).

The flaw allows an attacker to decrypt the group key transported in message 3 of WPA2’s 4-way handshake and use it to inject both broadcast and unicast traffic. Furthermore, the key could be used to decrypt unicast and broadcast traffic, the research paper claims.

“We successfully applied symbolic execution to client-side implementations of the 4-way handshake of WPA2, by simulating cryptographic primitives, and constraining parts of the symbolic input to prevent excessive state explosions. This revealed memory corruptions in code that processes decrypted data, uncovered insecure implementations of cryptographic primitives, and even revealed a decryption oracle,” the researchers note.

Earlier this week developers of the popular password cracking tool Hashcat identified a new method that can in some cases be used to obtain a network’s Wi-Fi Protected Access (WPA) or Wi-Fi Protected Access II (WPA2) password.
__________________
[Для просмотра данной ссылки нужно зарегистрироваться]
[Для просмотра данной ссылки нужно зарегистрироваться]
[Для просмотра данной ссылки нужно зарегистрироваться]
 
Ответить с цитированием

Advertising \ Реклама
2FORCE.SU - THE BIGGEST CVV SHOP ON THE UNDERGROUND MARKET

HQ DUMPS by Donald Trump
Ссылки для доступа к сервису: TRUMP-DMPS.RU


Sell RDP/Продажа дедиков/RDP SHOP #1
Ссылки для доступа к сервису: UAS-SERVICE.RU \ UAS-SERVICE.SU


HQ DUMPS by Donal Trump
Ссылки для доступа к сервису: TRUMP-DMPS.RU


Sell RDP/Продажа дедиков/RDP SHOP #1
Ссылки для доступа к сервису: UAS-SERVICE.RU \ UAS-SERVICE.SU


HQ DUMPS by Donal Trump
Ссылки для доступа к сервису: TRUMP-DMPS.RU



Ответ
Здесь присутствуют: 1 (пользователей: 0 , гостей: 1)
 
Опции темы
Опции просмотра
Ваши права в разделе
Вы не можете создавать новые темы
Вы не можете отвечать в темах
Вы не можете прикреплять вложения
Вы не можете редактировать свои сообщения

BB коды Вкл.
Смайлы Вкл.
[IMG] код Вкл.
HTML код Выкл.

Быстрый переход

Похожие темы
Тема Автор Раздел Ответов Последнее сообщение
Chinese Researchers Find Vulnerabilities in BMW Cars radikal Mass media about us 0 23.05.2018 00:34
AMD Chip Flaws Confirmed by More Researchers radikal Mass media about us 0 20.03.2018 12:35
Google Researchers Find "Worst" Windows RCE Flaw radikal Mass media about us 0 08.05.2017 21:21
Gmail Delivers Spoofed Messages Without Warning, Researchers Find radikal Mass media about us 0 12.02.2017 21:44
Researchers Find Flaw in Apple Encryption radikal Mass media about us 0 21.03.2016 21:15