15 ms·
Severe flaw in WPA2 protocol leaves Wi-Fi traffic open to eavesdropping
- Viper007Bond 9y agoSee also: https://news.ycombinator.com/item?id=15478750 https://news.ycombinator.com/item?id=15478750
- Mubassirpatel 9y agonice information shared by you
- cpressland 9y agoSo it looks like Ubiquiti UniFi firmware version 3.9.3.7537 patches against this - which was released to Beta testers ~two hours ago on their community site. I wonder if this is also going to require client side patching from the OS vendors.
- r00fus 9y agoHopefully their Amplifi line also gets these patches soon.
- deleted 9y ago[deleted]
- lucaspiller 9y agoHow do I download it? Their forums link to this page: https://community.ubnt.com/t5/UniFi-Beta-Blog/FIRMWARE-3-9-3-7537-for-UAP-USW-has-been-released/ba-p/2098382 https://community.ubnt.com/t5/UniFi-Beta-Blog/FIRMWARE-3-9-3... But I get an 'Access Denied' error when visiting it (I am logged in).
- mjcl 9y agoI believe you need to sign up for their beta program at https://account.ubnt.com/manage/settings https://account.ubnt.com/manage/settings
- lawnchair_larry 9y agoImagine all the random other wifi client devices that will never get updated too. This is going to be bad for a long time.
- d33 9y agoNice to see some mainstream news coverage! I had been calling for WPA3 for quite a long time... [0] Could you help me push that further? [0]: https://github.com/d33tah/call-for-wpa3 https://github.com/d33tah/call-for-wpa3
- pfranz 9y agoI'm also amazed that the coffee shop use-case has remained a terrible, frustrating hack (no way to encrypt without a password and no formal support for EULA/login screen). Like you, I figured in the 20 years since 802.11 they'd consider it a use-case worthy of first-party support--especially since every 3 or 4 years there's a new standard everyone adopts (a, c, g, n, and ac).
- TazeTSchnitzel 9y agoI continue to be astonished there is no support for passwordless encryption (open hotspots with no password needed to connect, but with some sort of automatically-negotiated encryption). Dropping encryption should not be required for a good user experience on open hotspots.
- Aissen 9y agoI spent 30 min this morning looking for this link (and failed)! Glad you posted it again :-)
- hoodoof 9y agoThis is not good.
- acdha 9y agoIt’ll be interesting to see what the mitigation options will be like given the massive install base of routers which are barely supported and WiFi gadgets which aren’t supported at all. There are some interesting wormable scenarios (e.g. apartment building with an attack combining this & things like those recent Broadcom exploits) which could be avoided if ISPs can push patches to a large percentage of their customers.
- microcolonel 9y agoMy home network is a fiction, all of the clients on it are either wired to the VPN host (except the smartphone, which just doesn't have access to most of my network), or connect through VPN even when I'm home. This only really became efficient enough to be viable for me with WireGuard.
- SSLy 9y agoWould you mind sharing details of your setup? Mostly the L3 structure.
- bleke 9y agoEvery time i start to think about similar architecture I start thinink why nobody come with idea that to add Wi-Fi support dump pipe mode (direct L2 mode if i'm right) and all security/packet droping handled by higher layer; like direct OpenVPN packets on air and everything handled by software. Ofcourse it will hurt some performance but security you can have few sacrifices.
- fro0116 9y agoIs there anything at all we can do to protect ourselves until our router gets patched? From the earlier thread [1] I gleamed that maybe a MAC filter could help, but it sounds like that's not going to help much because MAC addresses can be easily spoofed. The article here recommends sticking to sites with HTTPS, which isn't really something we always have control over, and isn't something we can realistically expect our non-technical WiFi users to be able to strictly adhere to. VPNs were also suggested, but again, mandating that everybody on our WiFi must connect through a VPN is rather impractical, and I'm personally not sure which VPN providers are supposed to be trustworthy to begin with. If people here have other suggestions, I'd love to hear them. [1] https://news.ycombinator.com/item?id=15478750 https://news.ycombinator.com/item?id=15478750
- jagermo 9y agoUse WPA with RADIUS. If you have a NAS at home, there is a good chance you can install a radius server on it. Or use a Raspberry Pi: http://www.binaryheartbeat.net/2013/12/raspberry-pi-based-freeradius-server.html http://www.binaryheartbeat.net/2013/12/raspberry-pi-based-fr...
- Xylakant 9y agoQuite a few clients lack WPA2 Enterprise capabilities, especially in the home network sector (hey, playstation, I'm looking at you), making this a no-go for a sizable chunk of the population.
- Aaargh20318 9y agoA playstation is not a portable device, therefore it doesn't need wifi (they shouldn't even have included a wifi card IMO)
- ocdtrekkie 9y agoNot only does it not need it, but the difference between gaming on Wi-Fi and gaming on Ethernet is immense. For any competitive game, Wi-Fi is a no-go to begin with.
- epaga 9y agoOne important additional piece of information: "As Hudson notes, the attacker would have to be on the same base station as the victim, which restricts any attack's impact somewhat." https://www.theregister.co.uk/2017/10/16/wpa2_inscure_krackattack/?mt=1508136351680 https://www.theregister.co.uk/2017/10/16/wpa2_inscure_kracka...
- r00fus 9y agoSo only as bad as Firesheep. Great.
- PinguTS 9y agoWhat is so important about that fact? It is basic knowledge, that in a radio based system, like Wifi, Bluetooth, ZigBee, … you need to be near the source. That is called physics. With some techniques you may passively can monitor radio waves, but for active attacks you will always need to be close by. That is called physics in general and specifically electromagnetic waves.
- deleted 9y ago[deleted]
- mlu 9y ago/r/iamverysmart
- scott_karana 9y agoLooks like a dupe of https://news.ycombinator.com/item?id=15478750 https://news.ycombinator.com/item?id=15478750
- cpach 9y agoNot really a dupe. There is additional information in the Ars Technica article that isn’t available in the research paper.
- empressplay 9y agoAm I understanding this correctly that you still need to authenticate with the router before using the exploit? If so, I thought it was already prudent to assume that unencrypted traffic (by the client) was effectively visible to everyone else connected over the same Wi-Fi base station? Or is this a way to break the Wi-Fi password and connect without it?
- shakna 9y agoKRACK attacks the RNG, so you don't need to be authenticated before attacking, only in-range.
- lawnchair_larry 9y agoSecond one. You just need to find another device that is connected and manipulate its traffic.
- pmontra 9y agoIt's more than connecting without the password > attackers will be able to eavesdrop on nearby Wi-Fi traffic as it passes between computers and access points. It might also mean it's possible to forge Dynamic Host Configuration Protocol settings, opening the door to hacks involving users' domain name service. Basically they can see all your traffic and modify it. Your LAN becomes the Internet over an open AP and you don't know which servers you're connecting to.
- Canada 9y agoI'm looking forward to learning the details of these weaknesses. I'm sure they will be with us for many years. That said, I'm not hugely concerned for myself because I already already assume whatever LAN I use might be malicious. We're living in a world where many name brand ISPs are openly hostile to subscribers.
- tryingagainbro 9y agoDo you guys think NSA or another country NSA knew, and exploited this? It's amazing how many years it took for this flaw to be found, despite being widely used. How many engineers looked at this over the years, thousands? memo to self: Assume that nothing is really secure, so behave.
- deleted 9y ago[deleted]
- h1d 9y agoWas this intentionally left in the protocol since the beginning or was it that hard to find for everyone over the years?
- Integer 9y agoThe patches are out for your Mikrotik devices: https://forum.mikrotik.com/viewtopic.php?f=21&t=126695 https://forum.mikrotik.com/viewtopic.php?f=21&t=126695
- tinix 9y agoSome good details can be found here on the hostapd security disclosure page: https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-r...
- tinix 9y agoWelp, the main site is live now with more details, and the paper... https://www.krackattacks.com/ https://www.krackattacks.com/ https://papers.mathyvanhoef.com/ccs2017.pdf https://papers.mathyvanhoef.com/ccs2017.pdf
- greggman 9y agoI wonder if apple's privacy stance will get them to update their discontinued airport extremes.
- Corrado 9y agoI was thinking the same thing. If they don't it might be time to replace my Airport Extreme. I love it and it works flawlessly, but if they don't provide updates it's worse than not having WiFi at all.
- tvararu 9y agoAirport routers are not vulnerable to this exploit. macOS and iOS computers have been issued patches to mitigate the issue on vulnerable networks. Source: https://m.imore.com/krack-wpa2-wi-fi-exploit-already-fixed-ios-macos-tvos-watchos-betas https://m.imore.com/krack-wpa2-wi-fi-exploit-already-fixed-i...
- NamTaf 9y agoThe page seems live now, I was only getting a domain test before: https://www.krackattacks.com https://www.krackattacks.com
- pedrocr 9y agoDoesn't everyone simply assume all networks are hostile, even your home LAN? This makes DoS very easy but if you're worried about eavesdropping from this you have much bigger problems.
- staunch 9y agoWireless is a pretty huge attack vector that has always worried me. I think I'm going to order some powerline networking gear and switch to that, since I don't have hardwired ethernet. Seems cheap enough.
- janci 9y agoHow the attacked device can talk to the AP after its keys / nonces have been altered? Does not it lose it's connection, manifesting to the user that something shady is going on?