Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.




6815 posts

Uber Geek
+1 received by user: 3140

Moderator
Trusted
Subscriber

Topic # 223774 16-Oct-2017 23:56
Send private message quote this post

This is potentially bad... https://www.krackattacks.com/

 

We discovered serious weaknesses in WPA2, a protocol that secures all modern protected Wi-Fi networks. An attacker within range of a victim can exploit these weaknesses using key reinstallation attacks (KRACKs). Concretely, attackers can use this novel attack technique to read information that was previously assumed to be safely encrypted. This can be abused to steal sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on. The attack works against all modern protected Wi-Fi networks. Depending on the network configuration, it is also possible to inject and manipulate data. For example, an attacker might be able to inject ransomware or other malware into websites.

 

Note that if your device supports Wi-Fi, it is most likely affected. During our initial research, we discovered ourselves that Android, Linux, Apple, Windows, OpenBSD, MediaTek, Linksys, and others, are all affected by some variant of the attacks.

 





Michael Murphy | https://murfy.nz
Want to be with an epic ISP? Want $20 to join them too? Well, use this link to sign up to BigPipe!
The Router GuideCommunity UniFi Cloud Controller | Ubiquiti Edgerouter Tutorial


View this topic in a long page with up to 500 replies per page Create new topic
 1 | 2 | 3 | 4 | 5 | 6
2374 posts

Uber Geek
+1 received by user: 104


  Reply # 1884698 17-Oct-2017 02:02
2 people support this post
Send private message quote this post

Don't panic, yet! (But probably soon after all your androids never get patched for this and easy to use PoC's are released, panic then.)

 

 

Make sure your wifi encryption mode is set to WPA2-CCMP (ONLY!) as the worst bits of the attack are possible with WPA2-TKIP. With CCMP mode (ONLY) the worst an attacker can do is inject packets into TCP streams. (Unencrypted streams like HTTP etc.) They can also decrypt and replay the packets.

 

In TKIP mode they can forge packets from the client to AP (and any other device on the network) and AP to client.

 

You can also disable 802.11r (Fast BSS Transition) / roaming mode until there is a patch for your AP, as some of the attacks require this to be turned on. (And only require the attacker observe and send packets at the AP)

 

 

The main Key Reinstallation attacks require the attacker clone your AP and set up the clone (For MITM) on a different wifi channel and then force the client to connect to the cloned AP instead.

 

 

iOS is only vulnerable to the group key handshakes so an attacker can only replay broadcast/multicast back at the client from the AP. (Though look at NTP etc, you could in theory freeze an iPhone in Time if it's doing NTP over wifi)

 

 

Android is basically screwed here, unless you have a google Nexus 5x/6P, pixel or a high end device from a manufacturer that cares. (Apparently Spark is blocking security updates for the new Nokias).

 

 


2069 posts

Uber Geek
+1 received by user: 617

Subscriber

  Reply # 1884700 17-Oct-2017 04:57
Send private message quote this post

Interestingly Meraki are saying it's only an issue if you're using seamless handoff (802.11R). If that's the case then potentially only an issue in a multi AP environment?

 

 

 

https://meraki.cisco.com/blog/2017/10/critical-802-11r-vulnerability-disclosed-for-wireless-networks/

 

 

 

 


 
 
 
 


13256 posts

Uber Geek
+1 received by user: 2220

Trusted
Subscriber

  Reply # 1884703 17-Oct-2017 05:57
Send private message quote this post

kyhwana2: Make sure your wifi encryption mode is set to WPA2-CCMP (ONLY!) as the worst bits of the attack are possible with WPA2-TKIP. With CCMP mode (ONLY) the worst an attacker can do is inject packets into TCP streams. (Unencrypted streams like HTTP etc.)

 

Are there any downsides to this? My Fritzbox is set to WPA + WPA2, but I could change to WPA2 (CCMP). We have a mix of Android 4, 5, and 6 devices, a few consumer products that use WiFi such as Broadlink WiFi/IR controllers for heat pumps, and visitors that occasionally use WiFi.





AWS Certified Solution Architect Professional, Sysop Administrator Associate, and Developer Associate
TOGAF certified enterprise architect
Professional photographer


1724 posts

Uber Geek
+1 received by user: 885


  Reply # 1884712 17-Oct-2017 07:02
One person supports this post
Send private message quote this post

I see part of the quote says an attacker could collect cc numbers among other things... Surely this only gets them the packets which should be https and encrypted also.

Obviously if the data isn't being sent over https, it's easy pickings anyway.

Am I missing something here, or are most of the things listed protected in other ways already.

Injecting ransomware is bad, but surely a local attack is less bad than an internet based attack. I'm not sure anyone is dumb enough to run around in public injecting ransomware, that'd likely get them caught.

I'm picking that an attacker is going to mostly get ads and porn out of this, both of which are freely available without breaking any laws.

/ramble




Location: Dunedin

25594 posts

Uber Geek
+1 received by user: 5371

Moderator
Trusted
Biddle Corp
Subscriber

  Reply # 1884738 17-Oct-2017 07:13
One person supports this post
Send private message quote this post

I've always regarded WiFi as insecure so I guess none of this surprises me. 

 

Inherently there are many flaws in WiFi - not security flaws, but fundamental issues in the way peole and devices can connect securely. Even a public hotspot using WPA2 is totally insecure because the minute anybody knows the WPA2 key they can just decrypt all traffic therefore there is no point at all in using WPA2 and you may as well just stick with an open network.

 

 




6815 posts

Uber Geek
+1 received by user: 3140

Moderator
Trusted
Subscriber

  Reply # 1884741 17-Oct-2017 07:19
3 people support this post
Send private message quote this post

Ubiquiti just released a firmware update to UniFi's to "patch" some of the issues here and I noticed my Chromebook has an update too for this. It is good to see some manufacturers being quick with updates. My OnePlus, on the other hand, will likely take a few moments.

 

Edit: Wow that was quick - my OnePlus is patched now. Looking at update logs this only leaves my doorbell (ping @freitasm) and alarm clock that remain unpatched.





Michael Murphy | https://murfy.nz
Want to be with an epic ISP? Want $20 to join them too? Well, use this link to sign up to BigPipe!
The Router GuideCommunity UniFi Cloud Controller | Ubiquiti Edgerouter Tutorial


13256 posts

Uber Geek
+1 received by user: 2220

Trusted
Subscriber

  Reply # 1884749 17-Oct-2017 07:55
Send private message quote this post

My Huawei P9 will probably never get patched. I changed my WiFi network to WPA2-CCMP and everything still works, so that's a mitigation. I consider phones insecure anyway, important things stored on there are encrypted inside applications.





AWS Certified Solution Architect Professional, Sysop Administrator Associate, and Developer Associate
TOGAF certified enterprise architect
Professional photographer


151 posts

Master Geek
+1 received by user: 20


  Reply # 1884755 17-Oct-2017 08:21
Send private message quote this post

Any news from Vodafone and Slingshot? Will they release updates for Wi-fi routers and modems (or replace them) if they vulnerable?


447 posts

Ultimate Geek
+1 received by user: 93

Subscriber

  Reply # 1884819 17-Oct-2017 09:10
Send private message quote this post

Apple has patched this already in the current developer betas of iOS, macOS, tvOS and watchOS.

 

Hopefully this accelerates their public release!!


2553 posts

Uber Geek
+1 received by user: 579

Trusted
Subscriber

  Reply # 1884844 17-Oct-2017 09:15
One person supports this post
Send private message quote this post

Benjip:

 

Apple has patched this already in the current developer betas of iOS, macOS, tvOS and watchOS.

 

Hopefully this accelerates their public release!!

 

 

Times like this it is good to have iOS etc.  Will be a month or 2 before it starts rolling out for android etc


'That VDSL Cat'
6676 posts

Uber Geek
+1 received by user: 1267

Trusted
Spark
Subscriber

  Reply # 1884874 17-Oct-2017 09:32
One person supports this post
Send private message quote this post

solival:

 

Any news from Vodafone and Slingshot? Will they release updates for Wi-fi routers and modems (or replace them) if they vulnerable?

 

 

for the most part, this is a client side exploit not router based.





#include <std_disclaimer>

 

Any comments made are personal opinion and do not reflect directly on the position my current or past employers may have.


602 posts

Ultimate Geek
+1 received by user: 38


  Reply # 1884882 17-Oct-2017 09:46
Send private message quote this post

List of patched devices and operating systems here:

 

https://char.gd/blog/2017/wifi-has-been-broken-heres-the-companies-that-have-already-fixed-it

 

Most likely missing a few things, but patches out for Debian and other Linux distributions, plus Microtik and several other router vendors.





#include <standard.disclaimer>

458 posts

Ultimate Geek
+1 received by user: 95

Subscriber

  Reply # 1884906 17-Oct-2017 10:19
Send private message quote this post

michaelmurfy:

 

Edit: Wow that was quick - my OnePlus is patched now. Looking at update logs this only leaves my doorbell (ping freitasm) and alarm clock that remain unpatched.

 

 

Are you sure? Just got the update as well but its showing September security patch. Looking at the sep patch none of the CVE's are listed and I cannot find any mentions in the Change Logs.

 

Google have said the patch will be in the November Security Patch.





Geoff E



6815 posts

Uber Geek
+1 received by user: 3140

Moderator
Trusted
Subscriber

  Reply # 1884909 17-Oct-2017 10:28
Send private message quote this post

geocom:

 

michaelmurfy:

 

Edit: Wow that was quick - my OnePlus is patched now. Looking at update logs this only leaves my doorbell (ping freitasm) and alarm clock that remain unpatched.

 

 

Are you sure? Just got the update as well but its showing September security patch. Looking at the sep patch none of the CVE's are listed and I cannot find any mentions in the Change Logs.

 

Google have said the patch will be in the November Security Patch.

 

Yep you're right so in that case my phone is not patched. Darn. Blame the early morning "hey your phone has an update" notification :)





Michael Murphy | https://murfy.nz
Want to be with an epic ISP? Want $20 to join them too? Well, use this link to sign up to BigPipe!
The Router GuideCommunity UniFi Cloud Controller | Ubiquiti Edgerouter Tutorial


36 posts

Geek
+1 received by user: 6


  Reply # 1885010 17-Oct-2017 11:35
Send private message quote this post

By the looks of it vendors have been made aware of it since the end of August.

 

https://www.kb.cert.org/vuls/byvendor?searchview&Query=FIELD+Reference=228519&SearchOrder=4

 

At least knowing that I'm using a open Android OS that it should be patched relatively easily.

 

Concerning though when you think of how many Wi-Fi based devices you have in your home and how many may never get updates.

 

Apart from the obvious Android phones I need a update for off the top of my head:

 

  • PS4
  • Wii U
  • SteamLink
  • 3DS'
  • LG OLED TV.
  • Yamaha soundbar
  • Router

How many wont get them...


 1 | 2 | 3 | 4 | 5 | 6
View this topic in a long page with up to 500 replies per page Create new topic



Twitter »

Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

Air New Zealand experiments with blockchain technology
Posted 23-Nov-2017 15:39


Symantec selects Amazon Web Services to deliver cloud security
Posted 23-Nov-2017 10:40


New Zealand Ministry of Education chooses Unisys for cloud-based education resourcing management system
Posted 22-Nov-2017 22:00


Business analytics software powers profits for NZ wine producers
Posted 22-Nov-2017 21:52


Pyrios strikes up alliance with Microsoft integrator UC Logiq
Posted 22-Nov-2017 21:51


The New Zealand IT services ecosystem - it's all digital down here
Posted 22-Nov-2017 21:49


Volvo to supply tens of thousands of autonomous drive compatible cars to Uber
Posted 22-Nov-2017 21:46


From small to medium and beyond: Navigating the ERP battlefield
Posted 21-Nov-2017 21:12


Business owners: ERP software selection starts (and finishes) with you
Posted 21-Nov-2017 21:11


Why I'm not an early adopter
Posted 21-Nov-2017 10:39


Netatmo launches smart home products in New Zealand
Posted 20-Nov-2017 20:06


Huawei Mate 10: Punchy, long battery life, artificial intelligence
Posted 20-Nov-2017 16:30


Propel launch Disney Star Wars Laser Battle Drones
Posted 19-Nov-2017 21:26


UFB killer app: Speed
Posted 17-Nov-2017 17:01


The case for RSS — MacSparky
Posted 13-Nov-2017 14:35



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.