George Chatzisofroniou

My curiosity is effortlessly sparked.

[George Chatzisofroniou @_sophron]

@droogie1xp Congrats.

[George Chatzisofroniou @_sophron]

In my latest research, I analyzed the security & privacy of Wi-Fi Easy Connect, the successor to WPS. Surprisingly, its design may increase the attack surface compared to WPS. Includes responses from the Wi-Fi Alliance on our findings. 📡

Read it here: https://t.co/6K2joEBvfq

[Sølst1c3 @s0lst1c3]

Original WPA/2-EAP attacks were Josh Wright and @brad_anton. MSCHAPv2 was @moxie / @0x31337. Karma was @dinodaizovi / Shane Macaulay, and later @singe and Ian de Villiers with Mana. Known Beacons was @_sophron, EAP Relays @_cablethief and @singe. GTC Downgrades was @wishbone1138 and PunK1npo0p. The Enhanced Open attacks were co-authored with @theDarracott, and we were just implementing first PoC techniques that had already been described in the threat model found within OWE’s RFC. So really the only reason this project was possible is that it stands upon quite a rich history of security research in this area. 2/2

[George Chatzisofroniou @_sophron]

(3/3) Commit that fixes the bug: https://t.co/ViwS0kPETH… CVE-2022-37660 has been assigned. Other vendors implementing DPP should be cautious of this implementation mistake as well. #security #CVE

[George Chatzisofroniou @_sophron]

(1/3) A year ago, I found a vulnerability in hostapd 2.10 & earlier: The PKEX code (used in one of the bootstrapping methods of DPP -- the successor of WPS) stayed active post successful PKEX association.

[George Chatzisofroniou @_sophron]

(2/3) If an attacker previously bootstrapped public keys using PKEX, they were able to subvert future bootstrapping by passively observing public keys, reusing Qi to subtract it from the captured message M to retrieve the ephemeral key (X = M - Qi).

[George Chatzisofroniou @_sophron]

I'm not sure how clear this is but the org/person who owns https://t.co/Mlpk5xTCy6 has power over the Internet which is often overlooked. Password reset emails can be abused, particularly when the registered address was never validated (e.g. during dev/testing or bad design).

[George Chatzisofroniou @_sophron]

@s0lst1c3 @vanhoefm @singe @ellwoodthewood @dinodaizovi @DaKahuna2007 @elkentaro @SecureThisNow @moxie @brad_anton Elaborating on (a): Areas that are lacking the implementation of protection systems such as a WIDS, have not attracted the same attention from the research community. There are some solutions that can be implemented on the station (e.g. a mob device) but suffer from (b), (c), (d)

[George Chatzisofroniou @_sophron]

@s0lst1c3 @vanhoefm @singe @ellwoodthewood @dinodaizovi @DaKahuna2007 @elkentaro @SecureThisNow @moxie @brad_anton (2/2)
(a) Can only be deployed in Enterprise environments (i.e. disregarding most public environments)
(b) Require modifications to the protocol
(c) Rely on active detection methods which can be avoided by most attackers
(d) Are only effective under certain conditions

[George Chatzisofroniou @_sophron]

@s0lst1c3 @vanhoefm @singe @ellwoodthewood @dinodaizovi @DaKahuna2007 @elkentaro @SecureThisNow @moxie @brad_anton (2/2)
(a) Can only be deployed in Enterprise environments (i.e. disregarding most public environments)
(b) Require modifications to the protocol
(c) Rely on active detection methods which can be avoided by most attackers
(d) Are only effective under certain conditions

[George Chatzisofroniou @_sophron]

@s0lst1c3 @vanhoefm @singe @ellwoodthewood @dinodaizovi @DaKahuna2007 @elkentaro @SecureThisNow @moxie @brad_anton (1/2)
Coincidentally, I spent some time the past few weeks reviewing known WIDS/WIPS solutions. While they are effective to a certain level, they do not offer adequate protection against Wi-Fi attacks. The most common limitations that I found are:

[George Chatzisofroniou @_sophron]

A great book written by exceptional security engineers. https://t.co/Oq2ZGZyZvy

[George Chatzisofroniou @_sophron]

Looking for a senior security engineer for a full-time telework position (within the US). The applicant needs to be experienced in pen. testing, red teaming, and security consulting. Experience in rev. engineering, h/w hacking or exploit devel. will be considered a plus. DM me.

[George Chatzisofroniou @_sophron]

@SwissHttp Agreed.

[George Chatzisofroniou @_sophron]

Penetration Testing and Low-Cost Freelancing: The Story of How I Hired 7 Freelancers to Exploit this Weird Vulnerability https://t.co/ZMcWzDFmaX

[George Chatzisofroniou @_sophron]

@emaragkos Almost all of them were on Fiverr.

[George Chatzisofroniou @_sophron]

@ittaia @AvishaiY Nice work. You may be interested in our BAR paper (https://t.co/v3hbGvQxsT), where we follow a similar approach. We leverage the broadcasting features of dc-net for strong anonymity.

[George Chatzisofroniou @_sophron]

(2/2) This would allow to "disappear" a network from the victim's Available Network List without the use of radio jamming techniques. After this point, the attacker can perform association attacks in a normal fashion.

[George Chatzisofroniou @_sophron]

(1/2) It appears that recent versions of macOS are displaying only one wireless network when receiving two beacon frames with the same SSID but different encryption types. E.g. assuming "foo" that is OPEN and "foo" that is WPA2-PSK, macOS will only show the network received last.