a few days ago researchers discovered a
number of flaws
in wpa3 these flaws can be exploited
to recover the password of the network
downgrade its security
and even launch denial of service
attacks
this is zade from zed security and in
this video i'm gonna walk you through
everything
that you need to know about these new
[Applause]
discoveries
so as we know wpa2 has been considered
the greatest
in terms of wi-fi security for a very
long time now
you probably already heard of wpa3
and how it's said to replace wpa2
because it's supposed to be more secure
now a few days ago researchers matthew
fanoff
and el ronan published a research in
which they
analyzed wpa3 and the handshake used in
it
the dragonfly handshake which replaces
the
vulnerable 4-way handshake used in wpa2
in their research they discovered a
number of flaws
that can allow hackers to launch a
number of very powerful attacks
against this latest and greatest wi-fi
security protocol
wpa3 first of all they discover
two flaws that can be exploited to
downgrade
wpa3 to wpa2
now this is very dangerous because it
means that hackers can use
the existing tools and techniques for
wpa cracking
to crack the wpa key and this key will
be identical to the wpa3 key
this means that they'll be able to
connect to the network
decrypt all of the data that gets sent
which means that they'll be able to see
the usernames the passwords
and launch all of the post connection
attacks that we already know
and that i cover in my courses the first
downgrade method
exploits the backward compatibility in
wpa3
see pretty much all devices that we have
right now
don't support wpa3 therefore
to make the transition from wpa2 to wpa3
smoother
wpa3 networks allow devices that don't
support wpa3
to connect using wpa2 now this is a
great feature that we all
need but the problem is it's not
implemented in a very secure manner
therefore hackers can use a rogue access
point
to force devices that support wpa3
to connect over wpa2
and like i said when this happens they
can use all of the methods and
techniques that we already know
to crack the wpa2 key connect and do
all of the attacks that they already
know
not only that but they also discovered a
number of device specific
flaws that can be exploited to force
devices that support wpa3 to connect
over wpa2
even if they're connecting to a wpa3
only network an example of these devices
is the new samsung galaxy s10 but more
devices can be vulnerable to this
the second downgrade method exploits the
dragonfly handshake
itself the handshake used in wpa3
see when a device wants to connect to a
wpa3 network
it sends a commit frame to the network
indicating the security group
it wants to use now guess what hackers
can
impersonate an access point and tell the
client that is trying to connect
that i don't support this security group
use a different one and the client will
use a different one
and once they use a lower security group
like i said hackers will be able to use
the
methods and the tools that they already
know to get the key
other than these two downgrade methods
the researchers have also discovered
two flaws that can be used to recover
the password
using a brute force or a dictionary
attack
these methods are in the dragonfly
handshake like i said the handshake used
in wpa3
and according to the researchers hackers
can guess
all possible passwords of 8 small
letters
with 125 dollars worth of resources
the first recovery method is timing
based and determines whether a password
is correct or not based on the time
taken
by the access point to respond to commit
frames
the second method relies on comparing
the memory access pattern
generated by a password to the pattern
generated
when creating the commit frame by a
computer that
already has the password therefore for
this to work
hackers need to get information from a
computer
that already has the password so they
need to already have
access to that computer but the
researchers have also said that the
hackers
might be able to get all of the
information they need
using javascript code now we all know
that javascript
is a client-side language that pretty
much all browsers these days support
therefore if this is true then hackers
will be able to get this information
easily using social engineering or by
exploiting an
xss vulnerability
last but not least the researchers have
also discovered
that processing and responding to commit
frames
is computationally heavy and takes a lot
of resources
therefore they were able to overload
access points that use wpa3 with as
little as
16 commit frames this will cause the
access point to restart
shut down or just stop responding
now you might think that this is not
useful but
it can be very useful in a social
engineering attack
or in an evil twin attack where hackers
would prevent clients from connecting to
their network
and create a fake network get the
clients to connect to this evil twin
fake network
and then steal the password using that
network or
steal other information by luring the
targets to do
other things once they connect
now the handshake that was analyzed the
dragonfly handshake
is not only used in wpa3 it's also
used in pe ap pwd networks
therefore because these networks use
this same handshake
they'll be vulnerable to all of the
vulnerabilities the dragonfly handshake
is vulnerable too not only that but
in pe ap pwd clients have to enter a
username
and a password to connect
the researchers have discovered a number
of implementation flaws
that would allow hackers to connect to
these networks
using a valid username only without the
need for a password
this will mean that hackers will be able
to impersonate any user
in these networks and gain access to the
network and see the traffic
unencrypted like i said
now i know all of this sounds very scary
but the researchers have already
informed the wi-fi alliance about all of
these vulnerabilities
and vendors are already working on
patches
for more information about these
vulnerabilities i highly recommend
reading the full research paper
i'm gonna link it in the description of
this video and i'm also gonna link a
number of tools
that the researchers have published
which you can use to test
whether your network is vulnerable or
not
finally don't forget to like this video
and subscribe to our channel
to stay updated with the latest in the
cyber security world
you