Breaking Wi-Fi Easy Connect: A Security Analysis of DPP
Conducts a comprehensive security analysis of Wi-Fi Easy Connect (Device Provisioning Protocol v3.0), uncovering protocol design flaws and implementation vulnerabilities.
Summary
Wi-Fi Easy Connect (DPP) Architecture
Wi-Fi Easy Connect, standardized by the Wi-Fi Alliance as the Device Provisioning Protocol (DPP), is designed to replace insecure Wi-Fi Protected Setup (WPS) using QR codes, NFC, and public-key cryptography for IoT provisioning.
Protocol Analysis and Cryptographic Flaws
George Chatzisofroniou presents an in-depth security evaluation of DPP version 3.0, identifying vulnerabilities in cryptographic key exchange handshakes and mutual authentication routines.
Attacking Unauthenticated Configuration Channels
Design flaws allow nearby wireless adversaries to intercept provisioning frames, conduct denial-of-service attacks, or manipulate device configuration parameters during initial onboarding.
Recommendations for Wi-Fi Alliance Standards
Remediating Wi-Fi Easy Connect flaws requires updating the protocol specification to mandate strict public key validation and enforce timeout thresholds on provisioning sessions.
Related talks
Payment Village·35 min
Tom Chotia
Examines how extra features and protocol extensions in contactless payment systems introduce security vulnerabilities, proposing fixes for payment terminals.
Creator Stage·27 min
Kevin Mitchell
Details the discovery and exploitation of CVE-2023-52709 in the Texas Instruments BLE5-Stack, causing denial of service in bonded peer devices.
Main Stage·20 min
Mike Spicer
Presents three years of wireless traffic analysis from DEF CON, revealing attendee device behavior, probe requests, and passive surveillance capabilities.