KRACK - WPA2 essentially cracked.

Forums › LAN (ethernet/Wifi/routers/Bluetooth) › KRACK - WPA2 essentially cracked.

1 | 2 | 3 | 4 | 5 | 6

8030 posts

Uber Geek
+1 received by user: 3819

#1885641 18-Oct-2017 12:40

The open VPN android app just seems to be a client. I need something that works from my phone when I'm out and about.

Nord seems to be consistently rated highly by experts and play store users so I think I'll try it.

Mike

Paul1977

5171 posts

Uber Geek
+1 received by user: 2192

#1885670 18-Oct-2017 12:50

MikeAqua:

The open VPN android app just seems to be a client. I need something that works from my phone when I'm out and about.

Nord seems to be consistently rated highly by experts and play store users so I think I'll try it.

Yes, the app is just the client. You would need to install an open VPN server at your home/premises. This can be installed on many different kinds of devices, including some routers.

Paul1977

5171 posts

Uber Geek
+1 received by user: 2192

#1885674 18-Oct-2017 12:52

I've gone and updated my iPhone and iPad to iOS 11.1 public beta 3, which is apparently patched (I can't find any specific comment from Apple saying that this specific release is patched, but they have said that their latest betas are - so I assume this includes the public beta 3).

kyhwana2

2572 posts

Uber Geek
+1 received by user: 233

#1885680 18-Oct-2017 13:00

This includes devices sold by Spark

Spark are going to have to pull finger, how many of their Android phones are even on the October Security patch level? (Google are apparently including the patch in the November Patches)

BarTender

3629 posts

Uber Geek
+1 received by user: 2572

ID Verified

Trusted

Lifetime subscriber

#1885695 18-Oct-2017 13:31

Watched this explanation which tried it's hardest to be explainable for non-technical people.

Paul1977

5171 posts

Uber Geek
+1 received by user: 2192

#1885783 18-Oct-2017 16:12

BarTender:

Watched this explanation which tried it's hardest to be explainable for non-technical people.

Still over my head!

Geekzone support

Support Geekzone with one-off or recurring donations Donate via PressPatron.

MadEngineer

4591 posts

Uber Geek
+1 received by user: 2570

Trusted

#1885890 18-Oct-2017 19:13

My brief understanding of it is that a malicious person could trigger a reset of the sequenced encryption process on a vulnerable device and because the encryption data gets repeated, some simple math could applied between the two lots of data to get the key.

You're not on Atlantis anymore, Duncan Idaho.

michaelmurfy

meow
13580 posts

Uber Geek
+1 received by user: 10912

Moderator

ID Verified

Trusted

Lifetime subscriber

#1885917 18-Oct-2017 19:24

Paul1977:

BarTender:

Watched this explanation which tried it's hardest to be explainable for non-technical people.

Still over my head!

I think this one may be better:

Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.

Paul1977

5171 posts

Uber Geek
+1 received by user: 2192

#1885966 18-Oct-2017 21:14

I’m most interested in how vulnerable unpatched iOS and Windows are (particularly iOS which is not yet patched in the latest general release 11.03).

The paper shows they are the least vulnerable, but I’m finding it difficult interpreting what the specific risks are for these devices.

1101

3141 posts

Uber Geek
+1 received by user: 1143

#1886095 19-Oct-2017 09:44

My understanding was that WPA2 was 'crackable' 2+ years ago , so not secure regardless. (?)

Give all the non patchable androids out there, and there are millions, as mid/low price Androids will NEVER get any patches & updates (I have 2 samsungs that will never get any updates)
- should companies close down internal wifi competely , or change the pass & only let patched devices connect
- Many companies have a guest wifi , should that be shut down as well, just to mitigate any liability (as vistors often are give access to guest wifi)
- is closing down company wifi a necessary reaction, necessary to mitigate any possible liability of either IT or the company itself ?

most company ph's & laptops could hardly be considered secure regardless , unless completely locked down & install of any apps blocked

hashbrown

463 posts

Ultimate Geek
+1 received by user: 131

#1886125 19-Oct-2017 10:42

Paul1977: I’m most interested in how vulnerable unpatched iOS and Windows are (particularly iOS which is not yet patched in the latest general release 11.03).

The paper shows they are the least vulnerable, but I’m finding it difficult interpreting what the specific risks are for these devices.

As I read it they are only vulnerable to the group key attacks - CVE-2017-13080 and CVE-2017-13081. As these are used for transmitting broadcast and multicast frames, the amount of sensitive information you could decrypt would be negligible.

Samsung

Shop now on Samsung phones, tablets, TVs and more (affiliate link).

MikeAqua

8030 posts

Uber Geek
+1 received by user: 3819

#1886162 19-Oct-2017 11:14

1101:

- Many companies have a guest wifi , should that be shut down as well, just to mitigate any liability (as vistors often are give access to guest wifi)

If someone tried to assert liability on the company's part in relation to our guest WiFi, I would simply argue there is no scope for liability because: -

- Guest Wifi is free;
- Therefore, the company has received no consideration;
- Therefore, the company has no duty of care.

The solution is an Accept page which includes a waiver the user must agree to.

Mike

dejadeadnz

2394 posts

Uber Geek
+1 received by user: 2287
Inactive user

#1886168 19-Oct-2017 11:22

MikeAqua:

If someone tried to assert liability on the company's part in relation to our guest WiFi, I would simply argue there is no scope for liability because: -

- Guest Wifi is free;
- Therefore, the company has received no consideration;
- Therefore, the company has no duty of care.

The solution is an Accept page which includes a waiver the user must agree to.

As a general proposition, in respect to whether one entity owes a duty of care to another for the purpose of liability in tort for negligence, the first three matters are either not decisive or even irrelevant. The last idea will help but only if the Ts&Cs are properly drafted, which pretty much 95% of NZ companies will fail at.

Tinkerisk

4798 posts

Uber Geek
+1 received by user: 3660

#1886622 20-Oct-2017 07:51

Patch for Grandstream fw confirmed to be released asap.

- NET: FTTH & VDSL, OPNsense, 10G backbone, GWN APs
- SRV: 12 RU HA server cluster, 0.1 PB storage on premise
- IoT: thread, zigbee, tasmota, BidCoS, LoRa, WX suite, IR
- 3D: two 3D printers, 3D scanner, CNC router, laser cutter

Paul1977

5171 posts

Uber Geek
+1 received by user: 2192

#1886702 20-Oct-2017 09:22

MikeAqua:

If someone tried to assert liability on the company's part in relation to our guest WiFi, I would simply argue there is no scope for liability because: -

- Guest Wifi is free;
- Therefore, the company has received no consideration;
- Therefore, the company has no duty of care.

The solution is an Accept page which includes a waiver the user must agree to.

It's also not uncommon for guest wifi to not even use WPA2 and just be unencrypted (with a guest portal login and a disclaimer), potentially more commonplace in cafes, hotels, etc than at businesses. This type wifi network is unaffected by KRACK as they were never secure in the first place.

But assuming your guest wifi is using WPA2 and APs are patched or not affected then it is the vulnerability in THEIR phone that is being exploited, not your network. IANAL, but I don't see how you could be held liable for that.

1 | 2 | 3 | 4 | 5 | 6