Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


michaelmurfy

meow
13240 posts

Uber Geek

Moderator
ID Verified
Trusted
Lifetime subscriber

#223774 16-Oct-2017 23:56
Send private message

This is potentially bad... https://www.krackattacks.com/

 

We discovered serious weaknesses in WPA2, a protocol that secures all modern protected Wi-Fi networks. An attacker within range of a victim can exploit these weaknesses using key reinstallation attacks (KRACKs). Concretely, attackers can use this novel attack technique to read information that was previously assumed to be safely encrypted. This can be abused to steal sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on. The attack works against all modern protected Wi-Fi networks. Depending on the network configuration, it is also possible to inject and manipulate data. For example, an attacker might be able to inject ransomware or other malware into websites.

 

Note that if your device supports Wi-Fi, it is most likely affected. During our initial research, we discovered ourselves that Android, Linux, Apple, Windows, OpenBSD, MediaTek, Linksys, and others, are all affected by some variant of the attacks.

 





Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.


View this topic in a long page with up to 500 replies per page Create new topic
 1 | 2 | 3 | 4 | 5 | 6
kyhwana2
2566 posts

Uber Geek


  #1884698 17-Oct-2017 02:02
Send private message

Don't panic, yet! (But probably soon after all your androids never get patched for this and easy to use PoC's are released, panic then.)

 

 

Make sure your wifi encryption mode is set to WPA2-CCMP (ONLY!) as the worst bits of the attack are possible with WPA2-TKIP. With CCMP mode (ONLY) the worst an attacker can do is inject packets into TCP streams. (Unencrypted streams like HTTP etc.) They can also decrypt and replay the packets.

 

In TKIP mode they can forge packets from the client to AP (and any other device on the network) and AP to client.

 

You can also disable 802.11r (Fast BSS Transition) / roaming mode until there is a patch for your AP, as some of the attacks require this to be turned on. (And only require the attacker observe and send packets at the AP)

 

 

The main Key Reinstallation attacks require the attacker clone your AP and set up the clone (For MITM) on a different wifi channel and then force the client to connect to the cloned AP instead.

 

 

iOS is only vulnerable to the group key handshakes so an attacker can only replay broadcast/multicast back at the client from the AP. (Though look at NTP etc, you could in theory freeze an iPhone in Time if it's doing NTP over wifi)

 

 

Android is basically screwed here, unless you have a google Nexus 5x/6P, pixel or a high end device from a manufacturer that cares. (Apparently Spark is blocking security updates for the new Nokias).

 

 




lxsw20
3552 posts

Uber Geek

Subscriber

  #1884700 17-Oct-2017 04:57
Send private message

Interestingly Meraki are saying it's only an issue if you're using seamless handoff (802.11R). If that's the case then potentially only an issue in a multi AP environment?

 

 

 

https://meraki.cisco.com/blog/2017/10/critical-802-11r-vulnerability-disclosed-for-wireless-networks/

 

 

 

 


timmmay
20574 posts

Uber Geek

Trusted
Lifetime subscriber

  #1884703 17-Oct-2017 05:57
Send private message

kyhwana2: Make sure your wifi encryption mode is set to WPA2-CCMP (ONLY!) as the worst bits of the attack are possible with WPA2-TKIP. With CCMP mode (ONLY) the worst an attacker can do is inject packets into TCP streams. (Unencrypted streams like HTTP etc.)

 

Are there any downsides to this? My Fritzbox is set to WPA + WPA2, but I could change to WPA2 (CCMP). We have a mix of Android 4, 5, and 6 devices, a few consumer products that use WiFi such as Broadlink WiFi/IR controllers for heat pumps, and visitors that occasionally use WiFi.




andrewNZ
2487 posts

Uber Geek
Inactive user


  #1884712 17-Oct-2017 07:02
Send private message

I see part of the quote says an attacker could collect cc numbers among other things... Surely this only gets them the packets which should be https and encrypted also.

Obviously if the data isn't being sent over https, it's easy pickings anyway.

Am I missing something here, or are most of the things listed protected in other ways already.

Injecting ransomware is bad, but surely a local attack is less bad than an internet based attack. I'm not sure anyone is dumb enough to run around in public injecting ransomware, that'd likely get them caught.

I'm picking that an attacker is going to mostly get ads and porn out of this, both of which are freely available without breaking any laws.

/ramble

sbiddle
30853 posts

Uber Geek

Retired Mod
Trusted
Biddle Corp
Lifetime subscriber

  #1884738 17-Oct-2017 07:13
Send private message

I've always regarded WiFi as insecure so I guess none of this surprises me. 

 

Inherently there are many flaws in WiFi - not security flaws, but fundamental issues in the way peole and devices can connect securely. Even a public hotspot using WPA2 is totally insecure because the minute anybody knows the WPA2 key they can just decrypt all traffic therefore there is no point at all in using WPA2 and you may as well just stick with an open network.

 

 


michaelmurfy

meow
13240 posts

Uber Geek

Moderator
ID Verified
Trusted
Lifetime subscriber

  #1884741 17-Oct-2017 07:19
Send private message

Ubiquiti just released a firmware update to UniFi's to "patch" some of the issues here and I noticed my Chromebook has an update too for this. It is good to see some manufacturers being quick with updates. My OnePlus, on the other hand, will likely take a few moments.

 

Edit: Wow that was quick - my OnePlus is patched now. Looking at update logs this only leaves my doorbell (ping @freitasm) and alarm clock that remain unpatched.





Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.


timmmay
20574 posts

Uber Geek

Trusted
Lifetime subscriber

  #1884749 17-Oct-2017 07:55
Send private message

My Huawei P9 will probably never get patched. I changed my WiFi network to WPA2-CCMP and everything still works, so that's a mitigation. I consider phones insecure anyway, important things stored on there are encrypted inside applications.


 
 
 

Cloud spending continues to surge globally, but most organisations haven’t made the changes necessary to maximise the value and cost-efficiency benefits of their cloud investments. Download the whitepaper From Overspend to Advantage now.
solival
160 posts

Master Geek


  #1884755 17-Oct-2017 08:21
Send private message

Any news from Vodafone and Slingshot? Will they release updates for Wi-fi routers and modems (or replace them) if they vulnerable?


Benjip
943 posts

Ultimate Geek

ID Verified

  #1884819 17-Oct-2017 09:10
Send private message

Apple has patched this already in the current developer betas of iOS, macOS, tvOS and watchOS.

 

Hopefully this accelerates their public release!!


tripp
3848 posts

Uber Geek

Trusted
Lifetime subscriber

  #1884844 17-Oct-2017 09:15
Send private message

Benjip:

 

Apple has patched this already in the current developer betas of iOS, macOS, tvOS and watchOS.

 

Hopefully this accelerates their public release!!

 

 

Times like this it is good to have iOS etc.  Will be a month or 2 before it starts rolling out for android etc


hio77
12999 posts

Uber Geek

ID Verified
Trusted
Lizard Networks

  #1884874 17-Oct-2017 09:32
Send private message

solival:

 

Any news from Vodafone and Slingshot? Will they release updates for Wi-fi routers and modems (or replace them) if they vulnerable?

 

 

for the most part, this is a client side exploit not router based.





#include <std_disclaimer>

 

Any comments made are personal opinion and do not reflect directly on the position my current or past employers may have.

 

 


alexx
867 posts

Ultimate Geek


  #1884882 17-Oct-2017 09:46
Send private message

List of patched devices and operating systems here:

 

https://char.gd/blog/2017/wifi-has-been-broken-heres-the-companies-that-have-already-fixed-it

 

Most likely missing a few things, but patches out for Debian and other Linux distributions, plus Microtik and several other router vendors.





#include <standard.disclaimer>


geocom
594 posts

Ultimate Geek

Subscriber

  #1884906 17-Oct-2017 10:19
Send private message

michaelmurfy:

 

Edit: Wow that was quick - my OnePlus is patched now. Looking at update logs this only leaves my doorbell (ping freitasm) and alarm clock that remain unpatched.

 

 

Are you sure? Just got the update as well but its showing September security patch. Looking at the sep patch none of the CVE's are listed and I cannot find any mentions in the Change Logs.

 

Google have said the patch will be in the November Security Patch.





Geoff E


michaelmurfy

meow
13240 posts

Uber Geek

Moderator
ID Verified
Trusted
Lifetime subscriber

  #1884909 17-Oct-2017 10:28
Send private message

geocom:

 

michaelmurfy:

 

Edit: Wow that was quick - my OnePlus is patched now. Looking at update logs this only leaves my doorbell (ping freitasm) and alarm clock that remain unpatched.

 

 

Are you sure? Just got the update as well but its showing September security patch. Looking at the sep patch none of the CVE's are listed and I cannot find any mentions in the Change Logs.

 

Google have said the patch will be in the November Security Patch.

 

Yep you're right so in that case my phone is not patched. Darn. Blame the early morning "hey your phone has an update" notification :)





Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.


PsychoSmiley
250 posts

Master Geek


  #1885010 17-Oct-2017 11:35
Send private message

By the looks of it vendors have been made aware of it since the end of August.

 

https://www.kb.cert.org/vuls/byvendor?searchview&Query=FIELD+Reference=228519&SearchOrder=4

 

At least knowing that I'm using a open Android OS that it should be patched relatively easily.

 

Concerning though when you think of how many Wi-Fi based devices you have in your home and how many may never get updates.

 

Apart from the obvious Android phones I need a update for off the top of my head:

 

  • PS4
  • Wii U
  • SteamLink
  • 3DS'
  • LG OLED TV.
  • Yamaha soundbar
  • Router

How many wont get them...


 1 | 2 | 3 | 4 | 5 | 6
View this topic in a long page with up to 500 replies per page Create new topic





News and reviews »

Air New Zealand Starts AI adoption with OpenAI
Posted 24-Jul-2025 16:00


eero Pro 7 Review
Posted 23-Jul-2025 12:07


BeeStation Plus Review
Posted 21-Jul-2025 14:21


eero Unveils New Wi-Fi 7 Products in New Zealand
Posted 21-Jul-2025 00:01


WiZ Introduces HDMI Sync Box and other Light Devices
Posted 20-Jul-2025 17:32


RedShield Enhances DDoS and Bot Attack Protection
Posted 20-Jul-2025 17:26


Seagate Ships 30TB Drives
Posted 17-Jul-2025 11:24


Oclean AirPump A10 Water Flosser Review
Posted 13-Jul-2025 11:05


Samsung Galaxy Z Fold7: Raising the Bar for Smartphones
Posted 10-Jul-2025 02:01


Samsung Galaxy Z Flip7 Brings New Edge-To-Edge FlexWindow
Posted 10-Jul-2025 02:01


Epson Launches New AM-C550Z WorkForce Enterprise printer
Posted 9-Jul-2025 18:22


Samsung Releases Smart Monitor M9
Posted 9-Jul-2025 17:46


Nearly Half of Older Kiwis Still Write their Passwords on Paper
Posted 9-Jul-2025 08:42


D-Link 4G+ Cat6 Wi-Fi 6 DWR-933M Mobile Hotspot Review
Posted 1-Jul-2025 11:34


Oppo A5 Series Launches With New Levels of Durability
Posted 30-Jun-2025 10:15









Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.