Researchers found two new vulnerabilities in WiFi WPA3 standard

Network security experts, Mathy Vanhoef and Eyal Ronen have once again found two serious vulnerabilities in the WPA3 WiFi security standard, which may help attackers crack WiFi passwords. It is known that WPA, known as Wi-Fi Protected Access, is a WiFi security standard designed to prevent hackers from stealing wireless data from users by using the Advanced Encryption Standard protocol. The WPA3 protocol is a new version of the standard that was introduced a year ago.

However, shortly after the launch of the WAP3 protocol, researchers were aware of loopholes in the handshake of WPA3. Although the WiFi Alliance has released patches and provided security recommendations, these remedies not only did not work but exists two new vulnerabilities.

Image: Mathy Vanhoef & Eyal Ronen

The first vulnerability was marked as CVE-2019-13377. The vulnerability allows hackers to bypass WPA3’s Dragonfly handshake. This bypass leak error is located in Dragonfly’s cryptographic algorithm. Researchers say hackers may take the opportunity to use brute-force attack attacks to crack passwords.

The second vulnerability (CVE-2019-13456) is an information leak error that exists in FreeRADIUS. FreeRADIUS is a widely-used open source RADIUS server, which is used as a central database for verifying remote users. Experts claim that an attacker can steal information by initiating several EAP-pwd (Extensible Authentication Protocol) handshakes and then reset the user’s WiFi password by performing a dictionary attack and a brute force attack.

It is reported that the researchers have shared the information of these two vulnerabilities with the WiFi Alliance, and I believe that the corresponding solution will appear soon.

Via: ZDNet