5 ms·
KrØØk: Serious vulnerability affecting encryption of billion+ Wi‑Fi devices
- TekMol 7y agoAs everybody is using random Wi-Fi spots all the time, is Wi-Fi encryption still important? I thought we rely on https and ssh these days?
- m3kw9 7y agoYeah https is rendering public wifi safety talk moot
- nitrogen 7y agoPeople can still read your DNS queries and SNI, and attack your device...
- dependenttypes 7y agoGood thing that Firefox added DNS over HTTPS then.
- mrfusion 7y agoDNS queries just show domain name though, not any cgi parameters. Or resource names.
- nitrogen 7y agoMITMing DNS would be a problem, and DNS queries can still be revealing (and SNI in the case of DNS over HTTPS)
- deleted 7y ago[deleted]
- hannob 7y agoYes, we do. Which is why I cringe every time people find a new Wifi vuln and then tell people about stolen creditcards and alike.
- kerng 7y agoSecurity is multi layered, relying only on a single leads to bad things.
- roblabla 7y agoIt still allows to snoop on people's browsing history by looking at DNS lookups. And even mount some attacks against insecure client software that you might be running. The solutions to DNS snooping and tampering (DoH, DoTLS, DNSSEC, etc...) are still not wildly deployed or supported, and it'll take a while until they are. Even if browsers implement DoH, there is a large amount of software that does DNS requests using the system's default, insecure resolver. Those software might not have secure encryption (e.g. using their own protocol), or might be using outdated encryption software (e.g. using an old version of OpenSSL). If those software have vulnerabilities in them, anyone on an unencrypted WiFi can spoof your DNS and exploit this vulnerability.
- tptacek 7y agoDNSSEC is not a solution to snooping or tampering in this setting. Ironically, against link-layer attacks like this, DoH does address both.
- kevincox 7y agoDoH is good for tampering but doesn't help much against snooping since generally you will then connect to (almost) every site with a plaintext SNI.
- tptacek 7y agoThe attack we're talking about on this thread is people using KROOK to snoop on DNS lookups. DoH decisively addresses that threat, and DNSSEC does literally nothing about it; it doesn't even address integrity in this setting; link-layer DNS attacks will reveal QIDs that can be used to spoof AD=1 responses to DNSSEC-validated queries, and that obviously doesn't work against DoH.
- corey_moncure 7y agoWireguard + pi-hole is the solution I'm moving to.
- tedunangst 7y agoThings like the printer on your local network are still probably not great to leave exposed. Although krook wouldn't be that relevant here.
- BlackLotus89 7y agoThere are several concerns that warrant good encryption. Privacy for instance if you surf even with encrypted dns you still leak the sites you query (SNI). Depending in the traffic it can be known what kind of content you consume or even identify it explitly. Also there is the case of broken encryption. We got our fair share of ssl/tls exploits. Also the traffic inside your network is mostly unsecured or can you issue certificates for your NAS? (yeah you can if you do it right but who does that?) Your media libraries or samba/nfs traffic is probably unencrypted. Got in home security cameras connected over wifi? So yeah there are _plenty_ of reasons why you should have good security on your broadcast of your private data. Even if you got most of your lan in a VPN (which is a good practice tbh) your smart devices aren't probably in it.
- panarky 7y ago> even with encrypted dns you still leak the sites you query (SNI) DNS over HTTPS fixes this.
- abbeyj 7y agoI don't think it does. ESNI is the intended fix for this problem.
- aaomidi 7y agoNo it doesn't. SNI is still plaintext and has nothing to do with the DNS protocol. ESNI is the fix that's had a very slow rollout.
- krallja 7y agoSNI is part of the HTTPS protocol and is not related to host name resolution. You’re still vulnerable to it even if you are connecting to a host in your HOSTS file.
- rstupek 7y agoDNS over https doesn't fix SNI, only the newest tls 3.0 would fix that
- proactivesvcs 7y agoBoth Apple and Microsoft ignored my reports of them serving downloads over HTTP, sent within the last few months. It's still safe to assume that there's some HTTP lurking in the mix, in places we'd least expect.
- my123 7y agoHTTPS doesn't mix well with some caching techniques. In both Microsoft's and Apple's cases, HTTP is assumed as untrusted by design, and is not relied on security-wise.
- detaro 7y agopreviously: https://news.ycombinator.com/item?id=22425615 https://news.ycombinator.com/item?id=22425615
- teunispeters 7y agoKr00k – formally known as CVE-2019-15126 – is a vulnerability in Broadcom and Cypress Wi-Fi chips that allows unauthorized decryption of some WPA2-encrypted traffic. (from link on this link) Headline above on top is too alarmist - and largely wrong.
- ThePowerOfFuet 7y ago> These findings were presented publicly for the first time at the RSA Conference 2020. Why anyone would choose to have any association with RSA since Dual_EC_DRBG is a mystery. There are far more credible conferences at which to present findings.
- HomeComp2020 7y agoDoes anyone know a good way I can test to see if my router is vulnerable?
- ArinaLy 7y agoIn February 2020, ESET released the KR00K - CVE-2019-15126 SERIOUS VULNERABILITY DEEP INSIDE YOUR WI-FI ENCRYPTION research. Based on this research, the Hexway team created and published a PoC exploit of the kr00k attack. (https://hexway.io/research/r00kie-kr00kie/#description https://hexway.io/research/r00kie-kr00kie/#description)