5 ms·
WPA2 is toast. Ref to the CVEs that will make a lot of network admins hate Monday: https://twitter.com/nick_lowe/status/919527451570638848 https://twitter.com/
by evgen 9y ago
WPA2 is toast.
Ref to the CVEs that will make a lot of network admins hate Monday: https://twitter.com/nick_lowe/status/919527451570638848 https://twitter.com/nick_lowe/status/919527451570638848
And some background: https://eprint.iacr.org/2016/475.pdf https://eprint.iacr.org/2016/475.pdf
- evgen 9y agoAlso worth nothing that the attack in the OP is on TKIP, but the KRACK attack that will be revealed tomorrow is based upon problems with the RNG (the example RNG, which apparently everyone used, is trivial to break and the protocol is also kind enough to provide you with a huge chunk of the entropy used in seeding the RNG. D'oh!)
- mschuster91 9y agoThis comment should be made the top comment. Thanks for the information. I guess this implies not "only" passive eavesdropping but also network access in environments without a MAC address filter (not that these can't be spoofed regardless)?
- sengork 9y agoSpoofed yes but they're hard to guess in advance without prior knowledge of the device's MAC address.
- djrogers 9y agoMAC addresses are broadcast in the clear regularly, so any device doing that without some randomization is ripe for the picking.
- willstrafach 9y agoWorth noting also: You vannot randomize it when connected to a Wi-Fi network.
- deleted 9y ago[deleted]
- throwaway613834 9y agoWPA2 in general, or just WPA2-TKIP?
- evgen 9y agoWPA2 in general. The 4-way handshake is vulnerable. Might be patchable, but there is a ton of embedded stuff out there that will never get updated...
- cm2187 9y agoI guess the question is whether only the AP needs to be patched or the client as well.
- ztjio 9y agoIn fact it is only clients that need patching. However, sometimes AP's are also clients. Disable any such features if you have them and are not depending on them.
- vermilingua 9y agoIt has already been patched by some vendors, but you're right, if the IoT has given us anything, it's tonnes of unpatchable consumer gear.
- YouKnowBetter 9y ago> WPA2 is toast. No it is not. It is "just" one part of the 4 way handshake. Source: https://www.krackattacks.com/ https://www.krackattacks.com/