OpenBSD MitM attack against WPA1/WPA2 | Hacker News Reader

OpenBSD MitM attack against WPA1/WPA2

marc.info

90 pointspjf20 comments

If I'm reading things right, this sounds like a vulnerability in WPA itself kept open for backward compatibility. It's fixed by implementing the "4-way handshake", which a comment in the patch says is not in the standard. I'm pretty sure it is in 802.11i (published by IEEE), so maybe it's not in WPA (published by Wi-Fi Alliance)?. I don't know where to find the actual WPA version of the spec to check; maybe it was never public.

No, the standard is secure. This is a vulnerability in the implementation. The comment in the code merely says that the explicit definition of the state machine behind a 4-way handshake implementation is not in the standard (but it's described in prose). Most standards don't provide explicit state machines.

The 802.11i is the official standard. WPA1 is based on a draft of 802.11i, while WPA2 is based on the final version of 802.11i. All of them contain the 4-way handshake.

Okay, thanks for the clarification. I guess my main point of confusion is why it would work (edit: that is, why an OpenBSD client would be able to connect pre-patch), but I guess if there's no actual state machine that makes it possible for an attacker to "skip to the end"?

Exactly, since there is no state machine, an attacker can immediately send the last message. The client will try to check the integrity of this message. But it will use an uninitialized all-zero key to do this! So an attacker can spoof the last message. And once the client receives this message, it will accept all traffic.

Would this compromise any consumer routers?

If anyone has an AP in a repeater/client mode it might also be affected so better update.

Does anyone know any Vendors that use BSD an their underlying OS?

most that I have experience with are some flavor of custom linux.

Juniper Networks (the Junos operating system for their switches/routers) and Sony Interactive Entertainment (PlayStation 3 and PlayStation 4 operating systems) are the major ones I know of, both forking FreeBSD.

There's a pretty good list here for FreeBSD: https://en.m.wikipedia.org/wiki/List_of_products_based_on_Fr...

The exploit, though, is against OpenBSD.

Edit: Commercial products based on OpenBSD: https://github.com/ligurio/openbsd-awesome/blob/master/READM...

One interesting item on the list is Mercedes Benz, but not sure what, exactly, they use it for.

Here's a list for OpenBSD:

https://github.com/ligurio/openbsd-awesome/#openbsd-based-pr...

Here's a list for NetBSD:

http://www.netbsd.org/gallery/products.html

Apple seems to use NetBSD as the base system for virtually all of the recent AirPort routers, and the Time Capsule.

Beyond networking, it's also been used for storage appliances: Isilon, FreeNAS, etc...

Note that the announcement applies specifically to OpenBSD. Further analysis is necessary before including FreeBSD (and its derivatives) or NetBSD in this. The BSDs do not share everything.

I mean, if you were relying on WPA for security.. you have more important problems. As someone else pointed out, MitM attacks can happen at any hop on the Internet.

WEP yes, but AFAIK WPA/WPA2 with strong passphrase is still considered to be secure. Of course you need to have many security layers, but without described MITM, this layer doesn't seem to be broken.

WPA? No.

https://marc.info/?l=openbsd-cvs&m=148224048415556&w=2

https://marc.info/?l=openbsd-cvs&m=148455931602152&w=2

This is WPA-TKIP only. That doesn't mean WPA/2 is completely useless and broken.

What's your practical alternative for WiFi security than WPA2-AES?

Your favorite crypto protocol/hash function/secure RNG is likely already broken -- it's just that no one has found an exploit yet.

Reply on news.ycombinator.com