3 ms·

I don't understand how the attacker can block step 3 of the handshake from the client. Can someone ELI5? What I was able to understand so far is that the use o

I don't understand how the attacker can block step 3 of the handshake from the client. Can someone ELI5? What I was able to understand so far is that the use of a particular nonce is being forced on the client and given that invariant keystream one can decrypt known messages. I'm still fuzzy on how the attacker can force this step. EDIT: Further question, isn't timestamp synchronization taken into account here when invalidating a nonce? What happens when I disconnect from wifi to a mobile network and back to the wifi?

rocqua 9y ago
The attacker gets a Man in the Middle position on layer 2 (data link). So every step in the handshake goes through the attacker. The attacker couldn't just MitM the protocol on layer 3 as it cannot authenticate with the WiFi router. Of course, the attacker already could just pretend to be the wifi router and then forward and inspect all traffic to the internet. What is scary here is that it breaks into a Local network as opposed to the internet.
cesarb 9y ago
From what I understood, there are two ways to block step 3. The most obvious way is to jam it, that is, send noise at the same time so the radio fails to receive it. The other way (and the one which makes attacks easier) is to pretend to be the AP but in another channel. Suppose the real AP is on channel 1. The attacker is nearer the victim than the AP, and is on channel 6. The attacker repeats on channel 6 everything the AP sends on channel 1, and repeats on channel 1 everything the victim sends on channel 6. The victim sees the same AP on both channels, channel 1 and channel 6 (the attacker modifies the part of the AP beacon/responses which says "I'm on channel X"), which is a perfectly legitimate and normal thing, and chooses channel 6 because it has a stronger signal. Since now the attacker is in the middle, it can modify anything. Change the AP beacon to say "I'm on channel 6", drop any packet it wants, duplicate any packet it wants, and so on. > What happens when I disconnect from wifi to a mobile network and back to the wifi? The wifi negotiation starts from scratch, with a new step 1.
- vikiomega9 9y ago
  So it sounds like if the user knew which channel were legitimate they could potentially realize which AP is the real one?
tmpmov 9y ago
Two comments on this: 1) The way I read your post was "How can the attacker block step 3?" That's not what the linked webpage is suggesting: "... the acknowledgement to message #3 can be blocked ..." So really this is blocking step #4 from occurring, pedantic perhaps, but it's sort of important. 2) In response to "How can someone block step #4?" Since we're discussing Wifi then signal jamming seems apt. From the actual paper discussing krack: "Inspired by this observation, an adversary could also selectively jam message 4 ..." There's much literature here (google). The reference the KRACK paper provides is: "Mathy Vanhoef and Frank Piessens. 2014. Advanced Wi-Fi attacks using commodity hardware. In ACSAC" link here: [https://people.cs.kuleuven.be/~mathy.vanhoef/papers/acsac2014.pdf https://people.cs.kuleuven.be/~mathy.vanhoef/papers/acsac201...]
- vikiomega9 9y ago
  Awesome, thanks for clarification. I think I don't quite understand how one can selectively jam a particular "data packet" from a signal or signal jamming in general, and I will have to read up on this.

rocqua 9y ago

The attacker gets a Man in the Middle position on layer 2 (data link). So every step in the handshake goes through the attacker. The attacker couldn't just MitM the protocol on layer 3 as it cannot authenticate with the WiFi router. Of course, the attacker already could just pretend to be the wifi router and then forward and inspect all traffic to the internet. What is scary here is that it breaks into a Local network as opposed to the internet.

cesarb 9y ago

From what I understood, there are two ways to block step 3. The most obvious way is to jam it, that is, send noise at the same time so the radio fails to receive it. The other way (and the one which makes attacks easier) is to pretend to be the AP but in another channel. Suppose the real AP is on channel 1. The attacker is nearer the victim than the AP, and is on channel 6. The attacker repeats on channel 6 everything the AP sends on channel 1, and repeats on channel 1 everything the victim sends on channel 6. The victim sees the same AP on both channels, channel 1 and channel 6 (the attacker modifies the part of the AP beacon/responses which says "I'm on channel X"), which is a perfectly legitimate and normal thing, and chooses channel 6 because it has a stronger signal. Since now the attacker is in the middle, it can modify anything. Change the AP beacon to say "I'm on channel 6", drop any packet it wants, duplicate any packet it wants, and so on. > What happens when I disconnect from wifi to a mobile network and back to the wifi? The wifi negotiation starts from scratch, with a new step 1.

vikiomega9 9y ago
So it sounds like if the user knew which channel were legitimate they could potentially realize which AP is the real one?

tmpmov 9y ago

Two comments on this: 1) The way I read your post was "How can the attacker block step 3?" That's not what the linked webpage is suggesting: "... the acknowledgement to message #3 can be blocked ..." So really this is blocking step #4 from occurring, pedantic perhaps, but it's sort of important. 2) In response to "How can someone block step #4?" Since we're discussing Wifi then signal jamming seems apt. From the actual paper discussing krack: "Inspired by this observation, an adversary could also selectively jam message 4 ..." There's much literature here (google). The reference the KRACK paper provides is: "Mathy Vanhoef and Frank Piessens. 2014. Advanced Wi-Fi attacks using commodity hardware. In ACSAC" link here: [https://people.cs.kuleuven.be/~mathy.vanhoef/papers/acsac2014.pdf https://people.cs.kuleuven.be/~mathy.vanhoef/papers/acsac201...]

vikiomega9 9y ago
Awesome, thanks for clarification. I think I don't quite understand how one can selectively jam a particular "data packet" from a signal or signal jamming in general, and I will have to read up on this.