Tuesday, October 17th 2017
Taking Hold of Your Signal - Critical Flaw Discovered in WPA2 Wi-Fi Security
Researchers have recently discovered a critical flaw that affects all WPA2 protected Wi-Fi devices. This can't be remedied solely by user intervention, or password changes, or even by the usage of HTTPS website; this is a flaw with the core of WPA's protection scheme, and means that an attacker could intercept every single traffic data point that your device sends over Wi-Fi, including passwords, credit card details, images - the whole treasure trove. Adding insult to injury, it's even possible for attackers using this method to inject malware into your devices. The new attack method - dubbed KRACK for Key Reinstallation Attack - basically forces your device's encryption code to default to a known, plain-text all-zero decryption key, which is trivial for hackers to reuse.
Adding to the paranoia, this is basically a device and software-agnostic attack - it's effective against devices running Android, Linux, and OpenBSD, and to a lesser extent macOS and Windows, as well as MediaTek Linksys, and other types of devices. HTTPS isn't the best solution either, simply because some website's implementation of it isn't the best, and there are scripts (such as SSLScript) that can force a website to downgrade its connection to a simple HTTP link - which can then be infiltrated by the attacker.
Asked whether this signaled the need for a reworked security protocol - ala WPA3 - , one of the principal researches responsible for bringing this problem to light answered that "No, luckily [WPA2] implementations can be patched in a backwards-compatible manner. This means a patched client can still communicate with an unpatched access point, and vice versa. In other words, a patched client or access points sends exactly the same handshake messages as before, and at exactly the same moments in time. However, the security updates will assure a key is only installed once, preventing our attacks. So again, update all your devices once security updates are available."
This is a video where the researchers show how fast it is to hack an Android device through this flaw:
The US-CERT (United States Computer Emergency Readiness Team) has already acknowledged the issue, alerting companies and state-based services to the flaw. Follow the sources below for the researchers' KRACK attack page, and the white paper, on the second link, which may shed some more light on this issue. In the meantime, be sure to check for device updates for all your internet access points - which if you hadn't noticed already, is pretty much everything around you.
Sources:
KRACK Attacks, KRACK Attack Paper, US CERT, Ars Technica
Adding to the paranoia, this is basically a device and software-agnostic attack - it's effective against devices running Android, Linux, and OpenBSD, and to a lesser extent macOS and Windows, as well as MediaTek Linksys, and other types of devices. HTTPS isn't the best solution either, simply because some website's implementation of it isn't the best, and there are scripts (such as SSLScript) that can force a website to downgrade its connection to a simple HTTP link - which can then be infiltrated by the attacker.
This is a video where the researchers show how fast it is to hack an Android device through this flaw:
The US-CERT (United States Computer Emergency Readiness Team) has already acknowledged the issue, alerting companies and state-based services to the flaw. Follow the sources below for the researchers' KRACK attack page, and the white paper, on the second link, which may shed some more light on this issue. In the meantime, be sure to check for device updates for all your internet access points - which if you hadn't noticed already, is pretty much everything around you.
43 Comments on Taking Hold of Your Signal - Critical Flaw Discovered in WPA2 Wi-Fi Security
Can they?
The devil is in the details and while this is serious problem not everyone should panic. Wifi serving devices[routers and AP's] are going to be the most important type of devices to patch. Once that group is patched the flaw will be mitigated because the serving device controls the key exchange and renewal. While a client device can still be exploited, once patched a serving device will reject key streams from a tampered device, thus forcing a disconnection and reinitialization which forces a complete key reset. The effected device will then try to reconnect and the serving device will create a new key that is unknown to the attacker.
It should be noted that this vulnerability is completely unrelated to the known problems with router password capturing due to packet sniffing and MAC address spoofing vulnerabilities inherent within the WPA/WPA2 protocols. However, those can only be used to gain access to a wifi connection and steal internet. They can not be used to view the data traffic coming in and out of the network itself. That is what makes "KRACK" so scary.
wiki.lineageos.org/devices/ so much samsung, lg, htc...
stats.lineageos.org/ so much non-google used, the first to appear is TENTH placereview.lineageos.org/#/q/topic:krack-n+(status:merged) but there are multiple, if 7.1 is not affected, why did lineage put the fixes into 7.1? fedora didnt patch until the day of or day after
what i meant by fedora was that a distro known for being decently updated & secure didnt get the patch until after the huge disclosure
official google roms for pixel/nexus also didnt get it until november according to news articles, apple didnt until a similar delay with 11.1 instead of 11.0.3 or something
just seems odd for MS to have a fix months in advance, while at the same time the issue is a complex series of bugs left open after disclosure & only openbsd patched early
boy it could have been much worse if it was a major protocol issue like WEP or if clients couldnt fix it