Dragonblood Vulnerabilities Disclosed in Wi-Fi WPA3 Standard

'Two security researchers disclosed details this week about a group of
vulnerabilities collectively referred to as Dragonblood that impact
the Wi-Fi Alliance's recently launched WPA3 Wi-Fi security and
authentication standard. From a report:

If ever exploited, the vulnerabilities would allow an attacker within
the range of a victim's network to recover the Wi-Fi password and
infiltrate the target's network. In total, five vulnerabilities are
part of the Dragonblood ensemble -- a denial of service attack, two
downgrade attacks, and two side-channel information leaks.

While the denial of service attack is somewhat unimportant as it only
leads to crashing WPA3-compatible access points, the other four are
the ones that can be used to recover user passwords. Both the two
downgrade attacks and two side-channel leaks exploit design flaws in
the WPA3 standard's Dragonfly key exchange -- the mechanism through
which clients authenticate on a WPA3 router or access point. In a
downgrade attack, Wi-Fi WPA3-capable networks can be coerced in using
an older and more insecure password exchange systems, which can allow
attackers to retrieve the network passwords using older flaws.'

-- source: https://mobile.slashdot.org/story/19/04/11/1431219

Cheers, Peter
-- 
Peter Reutemann
Dept. of Computer Science
University of Waikato, NZ
+64 (7) 858-5174
http://www.cms.waikato.ac.nz/~fracpete/
http://www.data-mining.co.nz/
_______________________________________________
wlug mailing list | [email protected]
Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug