pull down to refresh

WiFi hackers can bypass WPA3 security by exploiting its weakest link: the usercybernews.com/security/wifi-hackers-can-bypass-wpa3-security/
172 sats \ 9 comments \ @ch0k1 29 Dec 2024 security
The WPA3 security standard makes WiFi access points more secure, protecting passwords from offline dictionary attacks. However, researchers have devised a clever man-in-the-middle attack that tricks users into entering their password when reconnecting.
You lose your WiFi connection. When trying to reconnect, you’re asked to enter the password. If you do, you’re compromised.
Researchers from the University of the West Indies spawned a rouge WPA3 access point and used the captive portal (a login page similar to those at hotels, airports, or companies) to capture user credentials.
write
preview
related posts
178 sats \ 2 replies \ @ek 29 Dec 2024
Researchers noted that they could not successfully implement a deauthentication attack during the experiment, possibly due to the “scripts provided not being able to work with the distro utilized.”
lol
reply
0 sats \ 1 reply \ @ch0k1 OP 29 Dec 2024
Me to also didn't get that part...
reply
21 sats \ 0 replies \ @cyphercosmo 29 Dec 2024
It means the router isn't considering the packets coming from rogue network agents, if you know how deauth attacks work the rogue agent sends a packet to the router spoofing the mac address and pretending to be the device it wants to disconnect from the network so the target starts a new handshake and then have the handshake captured to serve as material to weaken the encryption.
I don't know how the router is being able to distinguish which one is the real one, but it's really powerful it does.
reply
21 sats \ 0 replies \ @0393c53fc8 29 Dec 2024
This is nothing new really. It's called the evil-twin attack and it's independent of the wireless security used as it's a user vulnerability (phishing). You can try a demo here.
reply
0 sats \ 1 reply \ @af1f6f3e17 29 Dec 2024
well if you use a normal phone or windws and mac pc to connect to it, it's already compromised and those OSes leak data to their motherhouses.
reply
0 sats \ 0 replies \ @ch0k1 OP 29 Dec 2024
Kind of but I think with the right configuration you can avoid it (at least to some extend)
reply
0 sats \ 2 replies \ @Skipper 29 Dec 2024
You lose your WiFi connection. When trying to reconnect, you’re asked to enter the password. If you do, you’re compromised.
What? How?
reply
21 sats \ 0 replies \ @cyphercosmo 29 Dec 2024
I think this part of the article they are referring to a technique to compromise a WPA3-compliant router, since they wouldn't be able to use handshake material to crack the password "offline" (meaning without having to interact with other network elements), so the way to do it is to create a rogue router which will serve as an access point to the real one, that access point will offer a canonical page (those that open as soon as you connect to a hotel/mall/airport wifi networks) that will store the info entered before forwarding it to the real router.
reply
10 sats \ 0 replies \ @ch0k1 OP 29 Dec 2024
They can capture the handshake you make with the router and try to brute force it offline
reply