Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.




/dev/null
9029 posts

Uber Geek

Moderator
Trusted
Lifetime subscriber

# 223774 16-Oct-2017 23:56
Send private message

This is potentially bad... https://www.krackattacks.com/

 

We discovered serious weaknesses in WPA2, a protocol that secures all modern protected Wi-Fi networks. An attacker within range of a victim can exploit these weaknesses using key reinstallation attacks (KRACKs). Concretely, attackers can use this novel attack technique to read information that was previously assumed to be safely encrypted. This can be abused to steal sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on. The attack works against all modern protected Wi-Fi networks. Depending on the network configuration, it is also possible to inject and manipulate data. For example, an attacker might be able to inject ransomware or other malware into websites.

 

Note that if your device supports Wi-Fi, it is most likely affected. During our initial research, we discovered ourselves that Android, Linux, Apple, Windows, OpenBSD, MediaTek, Linksys, and others, are all affected by some variant of the attacks.

 





View this topic in a long page with up to 500 replies per page Create new topic
 1 | 2 | 3 | 4 | 5 | 6
2460 posts

Uber Geek


  # 1884698 17-Oct-2017 02:02
2 people support this post
Send private message

Don't panic, yet! (But probably soon after all your androids never get patched for this and easy to use PoC's are released, panic then.)

 

 

Make sure your wifi encryption mode is set to WPA2-CCMP (ONLY!) as the worst bits of the attack are possible with WPA2-TKIP. With CCMP mode (ONLY) the worst an attacker can do is inject packets into TCP streams. (Unencrypted streams like HTTP etc.) They can also decrypt and replay the packets.

 

In TKIP mode they can forge packets from the client to AP (and any other device on the network) and AP to client.

 

You can also disable 802.11r (Fast BSS Transition) / roaming mode until there is a patch for your AP, as some of the attacks require this to be turned on. (And only require the attacker observe and send packets at the AP)

 

 

The main Key Reinstallation attacks require the attacker clone your AP and set up the clone (For MITM) on a different wifi channel and then force the client to connect to the cloned AP instead.

 

 

iOS is only vulnerable to the group key handshakes so an attacker can only replay broadcast/multicast back at the client from the AP. (Though look at NTP etc, you could in theory freeze an iPhone in Time if it's doing NTP over wifi)

 

 

Android is basically screwed here, unless you have a google Nexus 5x/6P, pixel or a high end device from a manufacturer that cares. (Apparently Spark is blocking security updates for the new Nokias).

 

 


2336 posts

Uber Geek

Subscriber

  # 1884700 17-Oct-2017 04:57
Send private message

Interestingly Meraki are saying it's only an issue if you're using seamless handoff (802.11R). If that's the case then potentially only an issue in a multi AP environment?

 

 

 

https://meraki.cisco.com/blog/2017/10/critical-802-11r-vulnerability-disclosed-for-wireless-networks/

 

 

 

 


 
 
 
 


15564 posts

Uber Geek

Trusted
Subscriber

  # 1884703 17-Oct-2017 05:57
Send private message

kyhwana2: Make sure your wifi encryption mode is set to WPA2-CCMP (ONLY!) as the worst bits of the attack are possible with WPA2-TKIP. With CCMP mode (ONLY) the worst an attacker can do is inject packets into TCP streams. (Unencrypted streams like HTTP etc.)

 

Are there any downsides to this? My Fritzbox is set to WPA + WPA2, but I could change to WPA2 (CCMP). We have a mix of Android 4, 5, and 6 devices, a few consumer products that use WiFi such as Broadlink WiFi/IR controllers for heat pumps, and visitors that occasionally use WiFi.


2146 posts

Uber Geek


  # 1884712 17-Oct-2017 07:02
One person supports this post
Send private message

I see part of the quote says an attacker could collect cc numbers among other things... Surely this only gets them the packets which should be https and encrypted also.

Obviously if the data isn't being sent over https, it's easy pickings anyway.

Am I missing something here, or are most of the things listed protected in other ways already.

Injecting ransomware is bad, but surely a local attack is less bad than an internet based attack. I'm not sure anyone is dumb enough to run around in public injecting ransomware, that'd likely get them caught.

I'm picking that an attacker is going to mostly get ads and porn out of this, both of which are freely available without breaking any laws.

/ramble




Location: Dunedin

 


28598 posts

Uber Geek

Moderator
Trusted
Biddle Corp
Lifetime subscriber

  # 1884738 17-Oct-2017 07:13
One person supports this post
Send private message

I've always regarded WiFi as insecure so I guess none of this surprises me. 

 

Inherently there are many flaws in WiFi - not security flaws, but fundamental issues in the way peole and devices can connect securely. Even a public hotspot using WPA2 is totally insecure because the minute anybody knows the WPA2 key they can just decrypt all traffic therefore there is no point at all in using WPA2 and you may as well just stick with an open network.

 

 




/dev/null
9029 posts

Uber Geek

Moderator
Trusted
Lifetime subscriber

  # 1884741 17-Oct-2017 07:19
3 people support this post
Send private message

Ubiquiti just released a firmware update to UniFi's to "patch" some of the issues here and I noticed my Chromebook has an update too for this. It is good to see some manufacturers being quick with updates. My OnePlus, on the other hand, will likely take a few moments.

 

Edit: Wow that was quick - my OnePlus is patched now. Looking at update logs this only leaves my doorbell (ping @freitasm) and alarm clock that remain unpatched.





15564 posts

Uber Geek

Trusted
Subscriber

  # 1884749 17-Oct-2017 07:55
Send private message

My Huawei P9 will probably never get patched. I changed my WiFi network to WPA2-CCMP and everything still works, so that's a mitigation. I consider phones insecure anyway, important things stored on there are encrypted inside applications.


 
 
 
 


157 posts

Master Geek


  # 1884755 17-Oct-2017 08:21
Send private message

Any news from Vodafone and Slingshot? Will they release updates for Wi-fi routers and modems (or replace them) if they vulnerable?


686 posts

Ultimate Geek

Subscriber

  # 1884819 17-Oct-2017 09:10
Send private message

Apple has patched this already in the current developer betas of iOS, macOS, tvOS and watchOS.

 

Hopefully this accelerates their public release!!


3410 posts

Uber Geek

Trusted
Lifetime subscriber

  # 1884844 17-Oct-2017 09:15
One person supports this post
Send private message

Benjip:

 

Apple has patched this already in the current developer betas of iOS, macOS, tvOS and watchOS.

 

Hopefully this accelerates their public release!!

 

 

Times like this it is good to have iOS etc.  Will be a month or 2 before it starts rolling out for android etc


'That VDSL Cat'
11547 posts

Uber Geek

Trusted
Spark
Subscriber

  # 1884874 17-Oct-2017 09:32
One person supports this post
Send private message

solival:

 

Any news from Vodafone and Slingshot? Will they release updates for Wi-fi routers and modems (or replace them) if they vulnerable?

 

 

for the most part, this is a client side exploit not router based.





#include <std_disclaimer>

 

Any comments made are personal opinion and do not reflect directly on the position my current or past employers may have.


645 posts

Ultimate Geek


  # 1884882 17-Oct-2017 09:46
Send private message

List of patched devices and operating systems here:

 

https://char.gd/blog/2017/wifi-has-been-broken-heres-the-companies-that-have-already-fixed-it

 

Most likely missing a few things, but patches out for Debian and other Linux distributions, plus Microtik and several other router vendors.





#include <standard.disclaimer>


543 posts

Ultimate Geek

Subscriber

  # 1884906 17-Oct-2017 10:19
Send private message

michaelmurfy:

 

Edit: Wow that was quick - my OnePlus is patched now. Looking at update logs this only leaves my doorbell (ping freitasm) and alarm clock that remain unpatched.

 

 

Are you sure? Just got the update as well but its showing September security patch. Looking at the sep patch none of the CVE's are listed and I cannot find any mentions in the Change Logs.

 

Google have said the patch will be in the November Security Patch.





Geoff E



/dev/null
9029 posts

Uber Geek

Moderator
Trusted
Lifetime subscriber

  # 1884909 17-Oct-2017 10:28
Send private message

geocom:

 

michaelmurfy:

 

Edit: Wow that was quick - my OnePlus is patched now. Looking at update logs this only leaves my doorbell (ping freitasm) and alarm clock that remain unpatched.

 

 

Are you sure? Just got the update as well but its showing September security patch. Looking at the sep patch none of the CVE's are listed and I cannot find any mentions in the Change Logs.

 

Google have said the patch will be in the November Security Patch.

 

Yep you're right so in that case my phone is not patched. Darn. Blame the early morning "hey your phone has an update" notification :)





57 posts

Master Geek


  # 1885010 17-Oct-2017 11:35
Send private message

By the looks of it vendors have been made aware of it since the end of August.

 

https://www.kb.cert.org/vuls/byvendor?searchview&Query=FIELD+Reference=228519&SearchOrder=4

 

At least knowing that I'm using a open Android OS that it should be patched relatively easily.

 

Concerning though when you think of how many Wi-Fi based devices you have in your home and how many may never get updates.

 

Apart from the obvious Android phones I need a update for off the top of my head:

 

  • PS4
  • Wii U
  • SteamLink
  • 3DS'
  • LG OLED TV.
  • Yamaha soundbar
  • Router

How many wont get them...


 1 | 2 | 3 | 4 | 5 | 6
View this topic in a long page with up to 500 replies per page Create new topic



Twitter and LinkedIn »



Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

Ring launches indoor-only security camera
Posted 23-Jan-2020 17:26


New report findings will help schools implement the digital technologies curriculum content
Posted 23-Jan-2020 17:25


N4L to upgrade & support wireless internet inside schools
Posted 23-Jan-2020 17:22


Netflix releases 21 Studio Ghibli works
Posted 22-Jan-2020 11:42


Vodafone integrates eSIM into device and wearable roadmap
Posted 17-Jan-2020 09:45


Do you need this camera app? Group investigates privacy implications
Posted 16-Jan-2020 03:30


JBL launches headphones range designed for gaming
Posted 13-Jan-2020 09:59


Withings introduces ScanWatch wearable combining ECG and sleep apnea detection
Posted 9-Jan-2020 18:34


NZ Police releases public app
Posted 8-Jan-2020 11:43


Suunto 7 combine sports and smart features on new smartwatch generation
Posted 7-Jan-2020 16:06


Intel brings innovation with technology spanning the cloud, network, edge and PC
Posted 7-Jan-2020 15:54


AMD announces high performance desktop and ultrathin laptop processors
Posted 7-Jan-2020 15:42


AMD unveils four new desktop and mobile GPUs including AMD Radeon RX 5600
Posted 7-Jan-2020 15:32


Consolidation in video streaming market with Spark selling Lightbox to Sky
Posted 19-Dec-2019 09:09


Intel introduces cryogenic control chip to enable quantum computers
Posted 10-Dec-2019 21:32



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.


Support Geekzone »

Our community of supporters help make Geekzone possible. Click the button below to join them.

Support Geezone on PressPatron



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.