5 ms·

Is there anything at all we can do to protect ourselves until our router gets patched? From the earlier thread [1] I gleamed that maybe a MAC filter could help

Is there anything at all we can do to protect ourselves until our router gets patched? From the earlier thread [1] I gleamed that maybe a MAC filter could help, but it sounds like that's not going to help much because MAC addresses can be easily spoofed. The article here recommends sticking to sites with HTTPS, which isn't really something we always have control over, and isn't something we can realistically expect our non-technical WiFi users to be able to strictly adhere to. VPNs were also suggested, but again, mandating that everybody on our WiFi must connect through a VPN is rather impractical, and I'm personally not sure which VPN providers are supposed to be trustworthy to begin with. If people here have other suggestions, I'd love to hear them. [1] https://news.ycombinator.com/item?id=15478750 https://news.ycombinator.com/item?id=15478750

jagermo 9y ago
Use WPA with RADIUS. If you have a NAS at home, there is a good chance you can install a radius server on it. Or use a Raspberry Pi: http://www.binaryheartbeat.net/2013/12/raspberry-pi-based-freeradius-server.html http://www.binaryheartbeat.net/2013/12/raspberry-pi-based-fr...
- Xylakant 9y ago
  Quite a few clients lack WPA2 Enterprise capabilities, especially in the home network sector (hey, playstation, I'm looking at you), making this a no-go for a sizable chunk of the population.
  - Aaargh20318 9y ago
    A playstation is not a portable device, therefore it doesn't need wifi (they shouldn't even have included a wifi card IMO)
    - ocdtrekkie 9y ago
      Not only does it not need it, but the difference between gaming on Wi-Fi and gaming on Ethernet is immense. For any competitive game, Wi-Fi is a no-go to begin with.
      - Xylakant 9y ago
        There's people that still enjoy a good old-fashioned single player game, but would love to get patches via the internet. Wifi is perfectly fine for that, even sneakernet would be, but the playstation doesn't support that.
        Aaargh20318 9y ago
        PS4 games are getting quite large, I've got PS4 games that are 70+ GB. You really don't want to download those over wifi.
        arjie 9y ago
        My laptop pulls 280 Mbps according to fast.com. Switching to wired gives me 700 Mbps so I guess the difference is between a forty minute wait and a 15 minute wait, but either way it's fast enough that I'll take the convenience of not having to lay cables. I imagine everyone else feels the same way: mostly limited by the upstream. If I had 100 Mbps Internet, there'd be no difference, for instance.
        Aaargh20318 9y ago
        You fail to account for the shitty wifi chipset in the PS4, no way you're getting 280Mbps over wifi on a PS4. Even wired downloads max out at around 300Mbit, even though I easily get 900+ mbit on e.g. a speed test.
        Xylakant 9y ago
        That assumes you get 300Mbps internet. A common max in Germany is 50Mbps, many people are still stuck with 16Mbps. 100Mbps and more are comparatively rare. Wifi speed is not the restricting factor, even with the PS4s chipset.
    - hug 9y ago
      I rent an apartment with double brick walls everywhere. I cannot install cabling in the wall, or really anywhere it's not a severe trip hazard. For the most part, this is fine, because almost every device I own that requires internet access has wifi. (The few that don't, like my NAS, can live next to my networking equipment.) Your suggestion would have meant that I couldn't connect my Playstation to the Internet, which is a little bit silly, especially given that my scenario is not an uncommon one.
      - cjsuk 9y ago
        CAT5 and duct tape are your friend. I have the same problem and it’s quite easy to manipulate it around and behind things without problems. One section of cable I have is 19m to span a 3m floor. We have to do this because I live in crowded London and WiFi barely works when you have 40 other networks next to you.
        crowbahr 9y ago
        > CAT5 and duct tape are your friend. That's heinously ugly though.
        cjsuk 9y ago
        It's certainly not aesthetically pleasing, although there is some mileage in that department with printed duct tapes, but it works which is the main thing. To be honest with careful routing it's only taped down in one place in a corner. You wouldn't know there were any cables running around unless you look very carefully.
        varjag 9y ago
        There are cable channels out there, including really slim ones. They make it slightly less ugly.
        musage 9y ago
        That's only because you can't see RF pollution. In comparison, it's tidy.
      - 9y ago
    - Xylakant 9y ago
      Try telling your landlord to install cabling everywhere. I'm in the lucky position that I had cabling installed when they wired my apartment, but I'm aware that I'm the exception.
      - chmars 9y ago
        That is not a solution: Today's computer is the smartphone with wireless Internet access. (I know, I know, we here still use traditional computers but we are probably a minority …)
        Xylakant 9y ago
        Oh, sure that's not the solution - I don't connect my laptop to cables everywhere I carry it. It's still nice to have wires strung because that allows me to connect all stationary equipment to a cable (IPTV receiver, apple TV, TV, Playstation, VOIP, etc.) and position Wifi APs where they're needed. Cables still provide the best and most stable network, despite all advances in Wifi tech. I can absolutely recommend doing this if you have the opportunity. The cost is negligible if you're about to (re)do the electrical wires.
        scarface74 9y ago
        Oh well. I guess I’ll be connecting my iPhone via Ethernet.... https://lifehacker.com/hack-together-a-way-to-connect-an-ipad-or-iphone-over-e-1770270331 https://lifehacker.com/hack-together-a-way-to-connect-an-ipa... Plug the USB-to-Ethernet adapter into the camera adapter Plug an Ethernet cable into the USB-to-Ethernet adapter Plug the Ethernet cable into your router Plug the lightning cable into the camera adapter Plug the lightning cable into the power adapter (or powered USB hub) Plug the power adapter (or powered USB hub) into the wall Connect the camera adapter (or the powered usb hub) to your iOS device
    - fgjjgutjvnu 9y ago
      Completely unrealistic, sorry, but I don't want to have to bother laying cables everywhere in my home.
- 6ue7nNMEEbHcM 9y ago
  Does it really help? One comment on reddit suggests that switching to RADIUS is not enough to be protected against this kind of attack. https://www.reddit.com/r/sysadmin/comments/76lj5q/this_is_a_core_protocollevel_flaw_in_wpa2_wifi/ https://www.reddit.com/r/sysadmin/comments/76lj5q/this_is_a_...
- ClashTheBunny 9y ago
  The other article says the opposite: The attack works against both WPA1 and WPA2, against personal and enterprise networks, and against any cipher suite being used (WPA-TKIP, AES-CCMP, and GCMP).
lucaspiller 9y ago
> I'm personally not sure which VPN providers are supposed to be trustworthy to begin with. You can host your own internal VPN, it's just to ensure the traffic over wifi is secure. If you are a corporation you probably have a VPN already, for people outside the office to access the internal network. Then just setup rules so wifi clients can only access the VPN server (however yes, it is easier said that done for most home users).
baby 9y ago
> The article here recommends sticking to sites with HTTPS, which isn't really something we always have control over, and isn't something we can realistically expect our non-technical WiFi users to be able to strictly adhere to. Luckily most major websites/applications you'll use will have HTTPS and HSTS enabled.
pantulis 9y ago
In fact, using secure traffic and/or VPNs is the least important of worries, as an end user I can be taught to use these mechanisms for communication. The real issue here is that, if I understand correctly, all of a sudden the technical infrastructure of any relevant IT operation is exposed. As an IT manager this would be my worst nightmare: if I am running a WPA2 network, I need to make sure that there is no in-the-clear communication going on on these particular network segments.
lukepothier 9y ago
> I'm personally not sure which VPN providers are supposed to be trustworthy to begin with. I can recommend Mullvad[1] which takes none of your information for registration, and which ticks all the right boxes on That One Privacy Site's VPN comparison chart[2]. [1] https://www.mullvad.net https://www.mullvad.net [2] https://thatoneprivacysite.net/vpn-comparison-chart https://thatoneprivacysite.net/vpn-comparison-chart
dspillett 9y ago
> Is there anything at all we can do to protect ourselves until our router gets patched? Only use secure transports over wireless connections. Which many including myself have been recommending for years anyway. Properly configured HTTPS (i.e. servers with good protocol/cypher/key options preferably with HSTS too) should be sufficient so as a user you can make sure you limit what you access over wireless. Luckily HTTPS is becoming very common both for actual web-sites/-applications and other services that use it as a transport (TFS for instance). As a service admin, protect your users by mandating HTTPS. Similarly, SSH and protocols wrapped in it are safe. RDP should be good too if correctly configured. If you are using "plain" or broken protocols over wireless (for example, file access via SMB/samba): stop unless the content being accessed is public anyway. This may affect many in office environments. If you are responsible for running a network make sure no traffic via unprotected protocols goes over network legs with wireless access points. DNS is generally not secure which could a concern for this if spoofing attacks are successful (so far only inspection/eavesdropping attacks have been proven?) as that would allow DNS poisoning. HTTPS and friends still protect your content here if your users use them properly (i.e. they never ignore certificate warnings), though if you are paranoid about privacy (which some people need to be) an outsider knowing what DNS lookups you make could be enough of a concern.
YouKnowBetter 9y ago
It is more the CLIENTS (unless your router is acting as a range extender, it is not a client) that needs to be patched / updated. Source: https://www.krackattacks.com/ https://www.krackattacks.com/
3pt14159 9y ago
Assuming you're running an IT department for something serious, you could theoretically get a sophisticated enough router (like a Pineapple) you can force all unencrypted traffic through it to an internal CA that you manually install on all clients. Then just do the opposite of a protocol downgrade attack, lol.

jagermo 9y ago

Use WPA with RADIUS. If you have a NAS at home, there is a good chance you can install a radius server on it. Or use a Raspberry Pi: http://www.binaryheartbeat.net/2013/12/raspberry-pi-based-freeradius-server.html http://www.binaryheartbeat.net/2013/12/raspberry-pi-based-fr...

Xylakant 9y ago
Quite a few clients lack WPA2 Enterprise capabilities, especially in the home network sector (hey, playstation, I'm looking at you), making this a no-go for a sizable chunk of the population.
- Aaargh20318 9y ago
  A playstation is not a portable device, therefore it doesn't need wifi (they shouldn't even have included a wifi card IMO)
  - ocdtrekkie 9y ago
    Not only does it not need it, but the difference between gaming on Wi-Fi and gaming on Ethernet is immense. For any competitive game, Wi-Fi is a no-go to begin with.
    - Xylakant 9y ago
      There's people that still enjoy a good old-fashioned single player game, but would love to get patches via the internet. Wifi is perfectly fine for that, even sneakernet would be, but the playstation doesn't support that.
      - Aaargh20318 9y ago
        PS4 games are getting quite large, I've got PS4 games that are 70+ GB. You really don't want to download those over wifi.
        arjie 9y ago
        My laptop pulls 280 Mbps according to fast.com. Switching to wired gives me 700 Mbps so I guess the difference is between a forty minute wait and a 15 minute wait, but either way it's fast enough that I'll take the convenience of not having to lay cables. I imagine everyone else feels the same way: mostly limited by the upstream. If I had 100 Mbps Internet, there'd be no difference, for instance.
        Aaargh20318 9y ago
        You fail to account for the shitty wifi chipset in the PS4, no way you're getting 280Mbps over wifi on a PS4. Even wired downloads max out at around 300Mbit, even though I easily get 900+ mbit on e.g. a speed test.
        Xylakant 9y ago
        That assumes you get 300Mbps internet. A common max in Germany is 50Mbps, many people are still stuck with 16Mbps. 100Mbps and more are comparatively rare. Wifi speed is not the restricting factor, even with the PS4s chipset.
  - hug 9y ago
    I rent an apartment with double brick walls everywhere. I cannot install cabling in the wall, or really anywhere it's not a severe trip hazard. For the most part, this is fine, because almost every device I own that requires internet access has wifi. (The few that don't, like my NAS, can live next to my networking equipment.) Your suggestion would have meant that I couldn't connect my Playstation to the Internet, which is a little bit silly, especially given that my scenario is not an uncommon one.
    - cjsuk 9y ago
      CAT5 and duct tape are your friend. I have the same problem and it’s quite easy to manipulate it around and behind things without problems. One section of cable I have is 19m to span a 3m floor. We have to do this because I live in crowded London and WiFi barely works when you have 40 other networks next to you.
      - crowbahr 9y ago
        > CAT5 and duct tape are your friend. That's heinously ugly though.
        cjsuk 9y ago
        It's certainly not aesthetically pleasing, although there is some mileage in that department with printed duct tapes, but it works which is the main thing. To be honest with careful routing it's only taped down in one place in a corner. You wouldn't know there were any cables running around unless you look very carefully.
        varjag 9y ago
        There are cable channels out there, including really slim ones. They make it slightly less ugly.
        musage 9y ago
        That's only because you can't see RF pollution. In comparison, it's tidy.
    - 9y ago
  - Xylakant 9y ago
    Try telling your landlord to install cabling everywhere. I'm in the lucky position that I had cabling installed when they wired my apartment, but I'm aware that I'm the exception.
    - chmars 9y ago
      That is not a solution: Today's computer is the smartphone with wireless Internet access. (I know, I know, we here still use traditional computers but we are probably a minority …)
      - Xylakant 9y ago
        Oh, sure that's not the solution - I don't connect my laptop to cables everywhere I carry it. It's still nice to have wires strung because that allows me to connect all stationary equipment to a cable (IPTV receiver, apple TV, TV, Playstation, VOIP, etc.) and position Wifi APs where they're needed. Cables still provide the best and most stable network, despite all advances in Wifi tech. I can absolutely recommend doing this if you have the opportunity. The cost is negligible if you're about to (re)do the electrical wires.
      - scarface74 9y ago
        Oh well. I guess I’ll be connecting my iPhone via Ethernet.... https://lifehacker.com/hack-together-a-way-to-connect-an-ipad-or-iphone-over-e-1770270331 https://lifehacker.com/hack-together-a-way-to-connect-an-ipa... Plug the USB-to-Ethernet adapter into the camera adapter Plug an Ethernet cable into the USB-to-Ethernet adapter Plug the Ethernet cable into your router Plug the lightning cable into the camera adapter Plug the lightning cable into the power adapter (or powered USB hub) Plug the power adapter (or powered USB hub) into the wall Connect the camera adapter (or the powered usb hub) to your iOS device
  - fgjjgutjvnu 9y ago
    Completely unrealistic, sorry, but I don't want to have to bother laying cables everywhere in my home.
6ue7nNMEEbHcM 9y ago
Does it really help? One comment on reddit suggests that switching to RADIUS is not enough to be protected against this kind of attack. https://www.reddit.com/r/sysadmin/comments/76lj5q/this_is_a_core_protocollevel_flaw_in_wpa2_wifi/ https://www.reddit.com/r/sysadmin/comments/76lj5q/this_is_a_...
ClashTheBunny 9y ago
The other article says the opposite: The attack works against both WPA1 and WPA2, against personal and enterprise networks, and against any cipher suite being used (WPA-TKIP, AES-CCMP, and GCMP).

lucaspiller 9y ago

> I'm personally not sure which VPN providers are supposed to be trustworthy to begin with. You can host your own internal VPN, it's just to ensure the traffic over wifi is secure. If you are a corporation you probably have a VPN already, for people outside the office to access the internal network. Then just setup rules so wifi clients can only access the VPN server (however yes, it is easier said that done for most home users).

baby 9y ago

> The article here recommends sticking to sites with HTTPS, which isn't really something we always have control over, and isn't something we can realistically expect our non-technical WiFi users to be able to strictly adhere to. Luckily most major websites/applications you'll use will have HTTPS and HSTS enabled.

pantulis 9y ago

In fact, using secure traffic and/or VPNs is the least important of worries, as an end user I can be taught to use these mechanisms for communication. The real issue here is that, if I understand correctly, all of a sudden the technical infrastructure of any relevant IT operation is exposed. As an IT manager this would be my worst nightmare: if I am running a WPA2 network, I need to make sure that there is no in-the-clear communication going on on these particular network segments.

lukepothier 9y ago

> I'm personally not sure which VPN providers are supposed to be trustworthy to begin with. I can recommend Mullvad[1] which takes none of your information for registration, and which ticks all the right boxes on That One Privacy Site's VPN comparison chart[2]. [1] https://www.mullvad.net https://www.mullvad.net [2] https://thatoneprivacysite.net/vpn-comparison-chart https://thatoneprivacysite.net/vpn-comparison-chart

dspillett 9y ago

> Is there anything at all we can do to protect ourselves until our router gets patched? Only use secure transports over wireless connections. Which many including myself have been recommending for years anyway. Properly configured HTTPS (i.e. servers with good protocol/cypher/key options preferably with HSTS too) should be sufficient so as a user you can make sure you limit what you access over wireless. Luckily HTTPS is becoming very common both for actual web-sites/-applications and other services that use it as a transport (TFS for instance). As a service admin, protect your users by mandating HTTPS. Similarly, SSH and protocols wrapped in it are safe. RDP should be good too if correctly configured. If you are using "plain" or broken protocols over wireless (for example, file access via SMB/samba): stop unless the content being accessed is public anyway. This may affect many in office environments. If you are responsible for running a network make sure no traffic via unprotected protocols goes over network legs with wireless access points. DNS is generally not secure which could a concern for this if spoofing attacks are successful (so far only inspection/eavesdropping attacks have been proven?) as that would allow DNS poisoning. HTTPS and friends still protect your content here if your users use them properly (i.e. they never ignore certificate warnings), though if you are paranoid about privacy (which some people need to be) an outsider knowing what DNS lookups you make could be enough of a concern.

YouKnowBetter 9y ago

It is more the CLIENTS (unless your router is acting as a range extender, it is not a client) that needs to be patched / updated. Source: https://www.krackattacks.com/ https://www.krackattacks.com/

3pt14159 9y ago

Assuming you're running an IT department for something serious, you could theoretically get a sophisticated enough router (like a Pineapple) you can force all unencrypted traffic through it to an internal CA that you manually install on all clients. Then just do the opposite of a protocol downgrade attack, lol.