Manipulation of the Handshake Protocol
3 Pages1367 Words380 Views
Added on 2019-09-16
Manipulation of the Handshake Protocol
Added on 2019-09-16
ShareRelated Documents
Exploit ResearchDeliverableExecutive SummaryKey Reinstallation Attacks (KRACs)Most of the modern Wi-Fi networks is protected by the WPA2 protocol. It was recently discovered that the WPA2 protocol had a critical vulnerability that can be exploited using a method known as Key Reinstallation Attacks or “KRACs”. This method allows attackers to access private encrypted information,as well as inject and manipulate data for malicious means. This vulnerability was discovered in the WPA2standard as well, therefore affecting all unpatched Wi-Fi networks running on WPA2 protocol. KRACS attacks a vulnerability within the 4 way WPA2 handshake that connects a user to the Wi-Fi network. Currently almost all the Wi-Fi networks in use employ this protocol, thus making virtually every unpatched Wi-Fi network vulnerable to this attack. The attack works by reinstalling an already in use cryptographic key through a manipulation of the handshake protocol. Unpatched WPA2 protocol allows the key to be replayed, which in turn resets the values within the handshake protocol and allows attacker to obtain, decrypt and even forge packets between the client and the server. This is a critical vulnerability that has severe implications for data privacy and has a potential to compromise an entire network if the WPA2 access points are left unpatched. Technical Description Exploitation DescriptionKey reinstallation attacks work by tricking a victim into installing an already-in-use key through manipulating and replaying cryptographic handshake protocols. When a client attempts to connect to the Wi-Fi network, the client and the Wi-Fi access point perform a 4-way handshake in order to create an encryption key. This key is installed by both the client and the access point after the client receives 3rdmessage of the 4-way handshake. The 4-way handshake is part of an asymmetric encryption protocol that allows 2 users to share an encryption key over an unsecured network through a process known as a “Diffie-Hellman Key Exchange”. After the key is installed, it is used to encrypt and decrypt data between the client and the access point. When the WPA2 protocol was designed, it was based on many concepts that were used by the TCP/IP protocol. One of those protocols was the redundancy of packets in case they were lost, dropped or corrupted. This also applies to packets sent and received during the 4-way handshake. When the access point does not receive an ACK reply after the 3rd packet of the handshake, it will retransmit that message, therefore the client may receive the 3rd handshake packet multiple times. Every time the client receives that packet, it will reinstall the same encryption key. Reinstalling the key resets all the associated parameters such as the replay counter and the incremental transmit packet number to their initial value, thereby allowing the attacker to replay, decrypt and forge packets in transit. This weakness is the result of the flaw in WPA2 protocol that allows an attacker to use a cryptographic key more than once through manipulation of cryptographic handshakes. Several other keyexchange protocols have been shown to be vulnerable to this type of attack as well. Attack VectorThe attack vector for the key reinstallation attacks is always the connection between the client and the Wi-Fi access point. The attacker will likely try to manipulate the 4-way handshake protocol in order to
End of preview
Want to access all the pages? Upload your documents or become a member.
Related Documents
Security Issues in Wireless Protocolslg...
|21
|4955
|66
Wireless Network Vulnerabilities and Security Measures - Deskliblg...
|7
|1988
|258
Wpan technology Assignmentlg...
|6
|928
|23
Assignment on Computer Network and Securitylg...
|6
|1343
|177
Hacking WPA Networks Using Gerixlg...
|6
|545
|224
Network Security and Protocolslg...
|12
|4857
|176