Improved KRACK Attacks Against WPA2 Implementations Mathy Vanhoef - - PowerPoint PPT Presentation

▶
improved krack attacks against
SMART_READER_LITE
LIVE PREVIEW

Improved KRACK Attacks Against WPA2 Implementations Mathy Vanhoef - - PowerPoint PPT Presentation

Feb 02, 2023 423 likes •994 views

Improved KRACK Attacks Against WPA2 Implementations Mathy Vanhoef @vanhoefm OPCDE, Dubai, 7 April 2018 Overview Key reinstalls in 4-way handshake New KRACKs Practical impact Lessons learned 2 Overview Key reinstalls in 4-way

slide-1
SLIDE 1

Improved KRACK Attacks Against WPA2 Implementations

Mathy Vanhoef — @vanhoefm OPCDE, Dubai, 7 April 2018

slide-2
SLIDE 2

Overview

2

Key reinstalls in 4-way handshake Lessons learned Practical impact New KRACKs

slide-3
SLIDE 3

Overview

3

Key reinstalls in 4-way handshake Lessons learned Practical impact New KRACKs

slide-4
SLIDE 4

The 4-way handshake

Used to connect to any protected Wi-Fi network › Provides mutual authentication › Negotiates fresh PTK: pairwise transient key Appeared to be secure: › No attacks in over a decade (apart from password guessing) › Proven that negotiated key (PTK) is secret1 › And encryption protocol proven secure5

4

slide-5
SLIDE 5

4-way handshake (simplified)

5

slide-6
SLIDE 6

4-way handshake (simplified)

6

PTK = Combine(shared secret, ANonce, SNonce)

slide-7
SLIDE 7

4-way handshake (simplified)

7

PTK = Combine(shared secret, ANonce, SNonce)

Attack isn’t about ANonce or SNonce reuse

slide-8
SLIDE 8

4-way handshake (simplified)

8

slide-9
SLIDE 9

4-way handshake (simplified)

9

slide-10
SLIDE 10

4-way handshake (simplified)

10

PTK is installed

slide-11
SLIDE 11

4-way handshake (simplified)

11

slide-12
SLIDE 12

Frame encryption (simplified)

12

Plaintext data

 Nonce reuse implies keystream reuse (in all WPA2 ciphers)

Nonce Mix PTK

(session key)

Nonce

(packet number) Packet key

slide-13
SLIDE 13

4-way handshake (simplified)

13

Installing PTK initializes nonce to zero

slide-14
SLIDE 14

Channel 1

14

Reinstallation Attack

Channel 6

slide-15
SLIDE 15

15

Reinstallation Attack

slide-16
SLIDE 16

16

Reinstallation Attack

Block Msg4

slide-17
SLIDE 17

17

Reinstallation Attack

slide-18
SLIDE 18

18

Reinstallation Attack

In practice Msg4 is sent encrypted

slide-19
SLIDE 19

19

Reinstallation Attack

Key reinstallation! Nonce is reset

slide-20
SLIDE 20

20

Reinstallation Attack

Same nonce is used!

slide-21
SLIDE 21

21

Reinstallation Attack Keystream

slide-22
SLIDE 22

22

Reinstallation Attack Keystream Decrypted!

slide-23
SLIDE 23

Overview

23

Key reinstalls in 4-way handshake Lessons learned Practical impact New KRACKs

slide-24
SLIDE 24

General impact

24

Receive replay counter reset Replay frames towards victim Transmit nonce reset Decrypt frames sent by victim

slide-25
SLIDE 25

Cipher suite specific

AES-CCMP: › No practical frame forging attacks WPA-TKIP: › Recover Message Integrity Check key from plaintext2,3 › Forge/inject frames sent by the device under attack

25

slide-26
SLIDE 26

Handshake specific

Group key handshake: › Client is attacked, but only AP sends real broadcast frames › Can only replay broadcast frames to client 4-way handshake: › Client is attacked  replay/decrypt/forge

26

slide-27
SLIDE 27

Implementation specific

iOS 10 and Windows: 4-way handshake not affected › Cannot decrypt unicast traffic (nor replay/decrypt) › But group key handshake is affected (replay broadcast) › Note: iOS 11 does have vulnerable 4-way handshake6 wpa_supplicant 2.4+ › Client used on Linux and Android 6.0+ › On retransmitted msg3 will install all-zero key

27

slide-28
SLIDE 28

Overview

28

Key reinstalls in 4-way handshake Lessons learned Practical impact New KRACKs

slide-29
SLIDE 29

Idea 1: replay other handshake messages?

29

slide-30
SLIDE 30

Idea 1: replay other handshake messages?

30

What if we replay Msg4?

slide-31
SLIDE 31

MediaTek drivers vulnerable!

› Certain MediaTek Drivers accept replayed Msg4’s › Used in 100+ devices  many vulnerable products9

31

ASUS RT-AC51U TP-Link RE370K

slide-32
SLIDE 32

Idea 2: A/SNonce renewed during rekey?

AP can start new handshake to refresh the PTK › Same messages exchanged as initial handshake › New ANonce and SNonce must be used macOS: › Patched default KRACK attack › But reuses the SNonce during a rekey › SNonce reuse patched in macOS 10.13.3

32

slide-33
SLIDE 33

Exploiting SNonce reuse

No problem if ANonce does change › But Linux’s hostapd reused ANonce … › Previous key was renegotiated and reinstalled › Can decrypt old captured traffic! Adversary can replay old handshake › Tricky because messages must now be encrypted › But feasible under specific circumstances

33

slide-34
SLIDE 34

Idea 3: further audit patches

› Either our patches are flawed … › … or device always accepts replayed broadcast frames?!

34

Several users reported: “Patched client still vulnerable to group key reinstallations”

slide-35
SLIDE 35

No broadcast replay checks!

› 8 of out 16 tested devices vulnerable › Likely caused by faulty hardware/firmware decryption

35

Netis WF-2120 AWUS036NH Nexus 5X

slide-36
SLIDE 36

Related issue: group key improperly installed

36

slide-37
SLIDE 37

Related issue: group key improperly installed

37

Contains key & current replay counter

slide-38
SLIDE 38

Related issue: group key improperly installed

38

Contains key & current replay counter Some install key using zero replay counter

slide-39
SLIDE 39

Related issue: group key improperly installed

Affected devices: › Samsung S3 LTE › $POPULAR_CLIENT How to abuse this?

39

slide-40
SLIDE 40

GTK Install Attack

40

slide-41
SLIDE 41

GTK Install Attack

41

slide-42
SLIDE 42

GTK Install Attack

42

Replay counter is reset to zero

slide-43
SLIDE 43

GTK Install Attack

43

slide-44
SLIDE 44

Idea 4: Impact of replaying broadcast frames?

Kankun smart power plug › Android app to control it Commands are broadcast UDP › Destination MAC in payload (?!) › Challenge/response protocol

44

slide-45
SLIDE 45

Command Replay

45

slide-46
SLIDE 46

Command Replay

46

slide-47
SLIDE 47

Command Replay

47

slide-48
SLIDE 48

Command Replay

48

slide-49
SLIDE 49

Command Replay

49

Command again executed: E.g. switch on/off

slide-50
SLIDE 50

Is your device affected?

github.com/vanhoefm/krackattacks-scripts

50

› Tests clients and APs › Works on Kali Linux Remember to: › Disable hardware encryption › Use a proper Wi-Fi dongle!

slide-51
SLIDE 51

Overview

51

Key reinstalls in 4-way handshake Lessons learned Practical impact New KRACKs

slide-52
SLIDE 52

Limitations of formal proofs

› 4-way handshake proven secure › Encryption protocol proven secure

52

The combination was not proven secure!

slide-53
SLIDE 53

Multi-party vulnerability coordination

Widespread issue! How to disclose? Guidelines and Practices for Multi-Party Vulnerability Coordination (Draft)7 Remember: › Goal is to protect users › There are various opinions

53

slide-54
SLIDE 54

Conclusion

› Flaw is in WPA2 standard › Proven correct but is insecure! › Attack has practical impact › Update all clients & check APs

54

slide-55
SLIDE 55

Questions?

krackattacks.com

Thank you!

slide-56
SLIDE 56

References

1.

  • C. He, M. Sundararajan, A. Datta, A. Derek, and J. Mitchell. A Modular Correctness Proof of IEEE 802.11i and
  • TLS. In CCS, 2005.

2.

  • E. and M. Beck. Practical attacks against WEP and WPA. In WiSec, 2009.

3.

  • M. Vanhoef and F. Piessens. Practical verification of WPA-TKIP vulnerabilities. In ASIA CCS, 2013.

4.

  • A. Joux. Authentication failures in NIST version of GCM. 2016.

5.

  • J. Jonsson. On the security of CTR+ CBC-MAC. In SAC, 2002.

6.

  • Apple. About the security content of iOS 11.1. November 3, 2017. Retrieved 26 November from

https://support.apple.com/en-us/HT208222 7. Multi-party vuln coordination 8.

  • M. Vanhoef and F. Piessens. Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2. In CCS, 2017.

9.

  • WikiDevi. MediaTek MT7620. Retrieved 2 April from https://wikidevi.com/wiki/MediaTek_MT7620A
  • 10. US Central Intelligence Agency. Network Operations Division Cryptographic Requirements. Retrieved 5

December 2017 from https://wikileaks.org/ciav7p1/cms/files/NOD%20Cryptographic%20Requirements%20v1.1%20TOP%20SECRET.p df

56