Researchers Discover New Ways to Hack WPA3 Protected WiFi Passwords

WPA, or WiFi Protected Access, is a WiFi security standard that
has been designed to authenticate wireless devices using the
Advanced Encryption Standard (AES) protocol and intended to prevent
hackers from eavesdropping on your wireless data.

The WiFi Protected
Access III^[3] (WPA3) protocol was
launched a year ago in an attempt to address technical shortcomings
of the WPA2 protocol from the ground, which has long been
considered to be insecure and found vulnerable to more severe
KRACK
attacks^[4].

WPA3 relies on a more secure handshake, called SAE (Simultaneous
Authentication of Equals), which is also known as Dragonfly, that
aims to protect WiFi networks against offline dictionary
attacks.

However, in less than a year, security researchers Mathy Vanhoef
and Eyal Ronen found several weaknesses (Dragonblood) in the early
implementation of WPA3, allowing an attacker to recover WiFi
passwords by abusing timing or cache-based side-channel leaks.

Shortly after that disclosure, the WiFi Alliance, the non-profit
organization which oversees the adoption of the WiFi standard,
released patches to address the issues and created security
recommendations to mitigate the initial Dragonblood attacks.

But it turns out that those security recommendations, which were
created privately without collaborating with the researchers, are
not enough to protect users against the Dragonblood attacks.
Instead, it opens up two new side-channel attacks, which once again
allows attackers to steal your WiFi password even if you are using
the latest version of WiFi protocol.

New Side-Channel Attack Against WPA3 When Using Brainpool
Curves

The first vulnerability, identified as CVE-2019-13377, is a
timing-based side-channel attack against WPA3’s Dragonfly handshake
when using Brainpool curves, which the WiFi Alliance recommended
vendors to use as one of the security recommendations to add
another layer of security.

“However, we found that using Brainpool curves introduces the
second class of side-channel leaks in the Dragonfly handshake of
WPA3,” the duo says in an updated advisory^[6]. “In other words, even
if the advice of the WiFi Alliance is followed, implementations
remain at risk of attacks.”

“The new side-channel leak is located in the password encoding
algorithm of Dragonfly,” the researchers said, “We confirmed the
new Brainpool leak in practice against the lastest Hostapd version,
and were able to brute-force the password using the leaked
information.”

Side-Channel Attack Against FreeRADIUS’ EAP-PWD
Implementation

The second vulnerability, identified as CVE-2019-13456, is an
information leak bug which resides the implementation of EAP-pwd
(Extensible Authentication Protocol-Password) in FreeRADIUS—one of
the most widely used open-source RADIUS server that companies
utilizes as a central database to authenticate remote users.
Mathy Vanhoef, one of the two researchers who discovered the
Dragonblood flaws, told The Hacker News that an attacker could
initiate several EAP-pwd handshakes to leak information, which can
then be used to recover the user’s WiFi password by performing
dictionary and brute-force attacks.

The researchers shared their new findings with the WiFi Alliance
and tweeted^[7] that “WiFi standard is
now being updated with proper defenses, which might lead to WPA
3.1,” but unfortunately, the new defenses wouldn’t be
compatible with the initial version of WPA3.

Mathy Vanhoef also told The Hacker News that it’s unfortunate
that WiFi Alliance created their security guidelines in private.
“If they would have done this publicly, these new issues could have
been avoided. Even the original WPA3 certification was partly made
in private, which also wasn’t ideal.”

^[1][2][5]