Scrutinizing WPA2 Password Generating Algorithms in Wireless Routers - - PowerPoint PPT Presentation

▶
scrutinizing wpa2 password generating algorithms in
SMART_READER_LITE
LIVE PREVIEW

Scrutinizing WPA2 Password Generating Algorithms in Wireless Routers - - PowerPoint PPT Presentation

Oct 16, 2022 468 likes •1.06k views

Scrutinizing WPA2 Password Generating Algorithms in Wireless Routers Radboud University Nijmegen (The Netherlands) MSc Eduardo Novella MSc Carlo Meijer Dr. ir. Roel Verdult { ednolo@alumni.upv.es , carlo@youcontent.nl , rverdult@cs.ru.nl }

slide-1
SLIDE 1

Scrutinizing WPA2 Password Generating Algorithms in Wireless Routers

Radboud University Nijmegen (The Netherlands) MSc Eduardo Novella MSc Carlo Meijer

  • Dr. ir. Roel Verdult

{ednolo@alumni.upv.es, carlo@youcontent.nl, rverdult@cs.ru.nl}

The Kerckhoffs Institute & The Digital Security Radboud University Nijmegen

Washington, D.C., August 11 2015

slide-2
SLIDE 2

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Outline

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 2 / 57

slide-3
SLIDE 3

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Eduardo Novella

  • MSc at The Kerckhoffs Institute (Radboud Nijmegen)
  • Security Analyst at Riscure (Delft)
  • Focused on embedded security (PayTV industry)
  • Blog: http://www.ednolo.alumnos.upv.es

Delft (NL) & San Francisco (USA) https://www.riscure.com

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 3 / 57

slide-4
SLIDE 4

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Carlo Meijer and Roel Verdult

Roel Verdult

  • RFID hacking
  • libNFC developer
  • Attacking wireless

crypto-protocols:

  • Mifare
  • iClass
  • Hitag2
  • Megamos Crypto
  • Atmel CryptoMemory
  • ...

Carlo Meijer

  • MSc student at the

Kerckhoffs Institute

  • Future PhD at

Radboud

  • New Mifare attack

http://www.cs.ru.nl/~rverdult/publications.html

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 4 / 57

slide-5
SLIDE 5

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Motivation

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 5 / 57

slide-6
SLIDE 6

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Motivation (2)

1 Seems to be a pattern 2 Has anyone looked into Dutch routers?

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 6 / 57

slide-7
SLIDE 7

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Motivation (3)

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 7 / 57

slide-8
SLIDE 8

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

What this talk is about

Main topics

1 Basic hardware hacking 2 Propose a methodology to reverse-engineer routers 3 Find out WPA2 password generating algorithms used by ISPs 4 Responsible disclosure procedure with Dutch ISPs and NCSC a

ahttps://www.ncsc.nl/english Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 8 / 57

slide-9
SLIDE 9

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Obtaining the firmware

Available options

1 Available for download 2 Exploiting a known vulnerability 3 Debug interfaces: UART and JTAG 4 Desoldering the flash chip

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 9 / 57

slide-10
SLIDE 10

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

OS Command injection

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 10 / 57

slide-11
SLIDE 11

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

UART’ing a device

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 11 / 57

slide-12
SLIDE 12

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

UART’ing a device (2)

1 Depends on bootloader capabilities 2 Typically does not allow backups 3 May allow unsigned code execution

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 12 / 57

slide-13
SLIDE 13

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

JTAG’ing a MIPS SoC

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 13 / 57

slide-14
SLIDE 14

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

JTAG’ing a MIPS SoC (2)

1 Read supported flash chips directly 2 Unsupported? 1 Identify block device I/O functions 2 Pull the image from RAM

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 14 / 57

slide-15
SLIDE 15

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Dumping the Flash

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 15 / 57

slide-16
SLIDE 16

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Decompressing / deobfuscating

Compression

1 Binwalk 2 Gzip / LZMA 3 SquashFS

Obfuscation

1 Similar finding 2 Reverse engineer the bootloader

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 16 / 57

slide-17
SLIDE 17

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Finding the algorithm

Figure: Character set reference

1 ESSID pattern: <ISP Name> + 7 digits → <ISP Name>%07 2 Character set 3 Factory reset code

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 17 / 57

slide-18
SLIDE 18

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Analyzing

Emulation

1 Try different inputs

  • Wifi Mac (upper/lower, w,w/o ’:’)
  • Ethernet Mac
  • S/N

2 QEMU: tiny .c mmaps image, jump

Issues:

1 Initialization skipped

E.g. sprintf

  • Hook and replace

E.g. Unmapped regions

  • mmap, fill with sensible data

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 18 / 57

slide-19
SLIDE 19

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Reverse engineering

... Slow , boring ...

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 19 / 57

slide-20
SLIDE 20

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Wireless Authentication & Deauthentication

Figure: WPA2 4-way handshake authentication Figure: WPA2 deauthentication

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 20 / 57

slide-21
SLIDE 21

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Attacking

Suppose ∼ 100.000 candidates

1 Deauth → auth handshake 2 Crack offline 3 Less than 1 minute

Need 1 client connected

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 21 / 57

slide-22
SLIDE 22

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Comtrend: Findings

1 UART → Tiny OpenWRT 1 Dump FW 2 Enable telnetd 2 OS command injection in telnetd → root 3 Backdoors found in all routers 4 Stack buffer overflow in HTTP server → ROP 5 WPA2 password generating algorithms

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 22 / 57

slide-23
SLIDE 23

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Comtrend: Backdoors and super-admin

1 Firmware dumped via

serial console UART

2 Credentials are

hardcoded

  • Cannot be changed by

customer

  • Cannot be changed by

ISP without fw update

  • Plaintext, not hashed

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 23 / 57

slide-24
SLIDE 24

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Comtrend: Command Injection in telnet service

1 Telnet command sanitization

  • Checks for ’&’
  • Checks for ’;’
  • Does not check for ’|’

→ still vulnerable

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 24 / 57

slide-25
SLIDE 25

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Comtrend: How to obtain WPA keys?

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 25 / 57

slide-26
SLIDE 26

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Comtrend: How to obtain WPA keys?

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 26 / 57

slide-27
SLIDE 27

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Comtrend: How to obtain WPA keys?

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 27 / 57

slide-28
SLIDE 28

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Comtrend: How to obtain WPA keys?

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 28 / 57

slide-29
SLIDE 29

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Comtrend: How to obtain WPA keys?

MD5( constant seed, lowercase ethernet mac address, uppercase wifi mac address ) 802.11 headers hold mac addresses in plaintext

  • Capturing a single raw packet is sufficient
  • Allows instant computation of passphrase

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 29 / 57

slide-30
SLIDE 30

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Comtrend: Biggest ISP in Spain, 2010

Figure: Same algorithm, different secret seed Figure: They forgot to remove the plaintext!

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 30 / 57

slide-31
SLIDE 31

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Comtrend: Stack buffer overflow

Figure: Buffer overflow vulnerability

1 RCE over http 2 Attacker advantages 1 Telnet inaccessible from WAN 2 Browsers refuse to talk telnet 3 Trick browser exploit 4 Widespread abuse

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 31 / 57

slide-32
SLIDE 32

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Sitecom

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 32 / 57

slide-33
SLIDE 33

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Sitecom: Previous Findings

Italian researchers released the following problems:1

1 Sitecom WLM-3500 backdoor accounts 2 WLM-3500 and WLM-5500 → Wireless keys 3 Firmware obfuscation → XOR encryption 4 WLR-4000 and WLR-4004 → Wireless keys 5 Several web flaws

1http://blog.emaze.net Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 33 / 57

slide-34
SLIDE 34

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Sitecom: Our findings

1 WLR-2100 and WLR-2500 → New algorithm 2 WLR-XXXX and WLM-XXXX → Confirm all affected 3 WL-XXX → New algorithm 4 Around 90% are affected → Only MAC is needed :(

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 34 / 57

slide-35
SLIDE 35

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Sitecom: WLR-2X00

We emulated an stripped MIPS binary:

$ chroot . ./qemu-mips-static bin/AutoWPA 000cf6ec73a0 wpamac flash set WLAN-WPA-PSK NUWFBAYQJNXH flash set USER-PASSWORD NUWFBAYQJNXH flash set WEP128-KEY1-1 4e555746424159514a4e584800

MD5(MAC address) converting to charset (A-Z)

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 35 / 57

slide-36
SLIDE 36

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Sitecom: WLR-2X00

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 36 / 57

slide-37
SLIDE 37

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Sitecom: WPA generation

Figure: Old-New algorithm. Around 40 models are affected

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 37 / 57

slide-38
SLIDE 38

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Sitecom: WPS generation

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 38 / 57

slide-39
SLIDE 39

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Thomsom

Figure: Generating ESSIDs from the SN

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 39 / 57

slide-40
SLIDE 40

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Thomsom

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 40 / 57

slide-41
SLIDE 41

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Thomsom

Figure: Generating PSKs from the SN

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 41 / 57

slide-42
SLIDE 42

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Thomsom in The Netherlands

Figure: We fully reverse-engineered the algorithm used in Holland

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 42 / 57

slide-43
SLIDE 43

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Thomsom in more countries

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 43 / 57

slide-44
SLIDE 44

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Thomsom in more countries

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 44 / 57

slide-45
SLIDE 45

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Thomsom in more countries

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 45 / 57

slide-46
SLIDE 46

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Thomsom in more countries

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 46 / 57

slide-47
SLIDE 47

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Thomsom in more countries

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 47 / 57

slide-48
SLIDE 48

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Arcadyan update log

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 48 / 57

slide-49
SLIDE 49

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

  • Arcadyan. WPA key generation

We broke this just bruteforcing similar Arcadyan algorithms 2 3.

Require: s6, s7, s8, s9, s10, m9, m10, m11, m12 ∈ [0, .., F] k1 ← (s7 + s8 + m11 + m12) & (0xF) k2 ← (m9 + m10 + s9 + s10) & (0xF) x1 ← k1 ⊕ s10 x2 ← k1 ⊕ s9 x3 ← k1 ⊕ s8 y1 ← k2 ⊕ m10 y2 ← k2 ⊕ m11 y3 ← k2 ⊕ m12 z1 ← m11 ⊕ s10 z2 ← m12 ⊕ s9 z3 ← k1 ⊕ k2 w1 ← s6 w2 ← k1 ⊕ z3 w3 ← k2 ⊕ z3 return [x1, y1, z1, w1, x2, y2, z2, w2, x3, y3, z3, w3]

2https://www.seguridadwireless.net 3https://sviehb.wordpress.com Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 49 / 57

slide-50
SLIDE 50

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

ADB / Pirelli

Figure: Call flow from generateKey

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 50 / 57

slide-51
SLIDE 51

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

ADB / Pirelli

Figure: Call flow for createWPAPassphraseFromKey

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 51 / 57

slide-52
SLIDE 52

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

ADB / Pirelli

Figure: Dissasembly of wlWriteMdmDefault

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 52 / 57

slide-53
SLIDE 53

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

ADB / Pirelli

Figure: Dissasembly of generateKey-from-mac

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 53 / 57

slide-54
SLIDE 54

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

ADB / Pirelli

Figure: Secret data found out in the library

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 54 / 57

slide-55
SLIDE 55

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Timeline

Responsible disclosure

1 2014-12-20 Communication with NCSC a 2 2015-01-?? Radboud Nijmegen & NCSC contact with ISPs 3 2015-02-01 Dutch ISPs are aware about the vulnerabilities 4 2015-04-02 1st meeting with ISPs. Presentation 5 2015-04-29 2nd meeting with ISPs. Presentation 6 2015-08-04 Talk at Bsides Las Vegas-PasswordsCON 7 2015-08-11 Full disclosure at USENIX WOOT’15

ahttps://www.ncsc.nl/english Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 55 / 57

slide-56
SLIDE 56

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Conclusion

  • Since SpeedTouch security issue in 2008,

security has not improved whatsoever

  • This is an industry-wide problem.
  • Security by Obscurity does not work!
  • Vendors reuse the same algorithms with slightly small changes
  • Neither stripped nor obfuscated binaries are a solution
  • Please do not include algorithms inside of FW images

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 56 / 57

slide-57
SLIDE 57

Who we are Introduction Methodology Findings & Vulnerabilities Conclusion Q&A

Questions and answers

Novella, Meijer, Verdult USENIX WOOT 2015 Scrutinizing WPA2 Algorithms in Wireless Routers 57 / 57