47 ms·
FragAttacks: new security vulnerabilities that affect wi-fi devices
- Pick-A-Hill2019 5y agoThe chained CVE's made for interesting reading. Book-marked for future reference when I have my SDR to hand.
- pmlnr 5y ago> By default devices don't send fragmented frames. This means that the mixed key attack and the fragment cache attack, on their own, will be hard to exploit in practice, unless Wi-Fi 6 is used. When using Wi-Fi 6, which is based on the 802.11ax standard, a device may dynamically fragment frames to fill up available airtime. Why does this feel like Spectre? We're trying to speed things up in a way that eventually blows back into our face.
- dylan604 5y agoDoes it have anything to do with the speed of development->deployment? If something that is going to be standardized is rushed, then these kind of easily-ish found flaws will continually haunt us. If things slowed down and allowed a serious amount of pentesting before standarization, then maybe we can avoid these herpes like flaws where they sit dormant and then flare up, but can never be eliminated once discovered.
- lupire 5y agoDoubtful. > several of the newly discovered design flaws have been part of Wi-Fi since its release in 1997! And spectre is also based on a decades old documented flaw. It's just not very practical to predict every feasible attack until a lot of people have real systems to explore.
- high_byte 5y agowhy do you need complex systems at all? just use a flat memory system with no kernel. no stack cookies. in fact, no internet is probably better.
- nopeYouAreWrong 5y agoseriously, have we learned nothing from Battlestar Galactica?
- miles 5y agoFrom the industry response[1]: > "It’s important to note that there is presently no evidence of the vulnerabilities being used against Wi-Fi users maliciously and these issues are mitigated through routine device updates once updated firmware becomes available. > "Like many previous vulnerabilities, FragAttacks has been academically well-researched and responsibly reported in a manner allowing the industry to proactively prepare and begin to roll out updates that fully eliminate the vulnerabilities. This set of vulnerabilities requires a potential attacker to be physically within range of the Wi-Fi network (or user device) in order to exploit it. This significantly reduces the likelihood of actual exploitation or attack." [1] https://www.commscope.com/blog/2021/wi-fi-alliance-discloses-fragattacks/ https://www.commscope.com/blog/2021/wi-fi-alliance-discloses...
- lupire 5y agoHow would a victim know if someone in a coffeeshop used this attack? > these issues are mitigated through routine device updates once updated firmware becomes available. Unless you are one of the millions upon millions of people who have an Android device that launched >3 years ago.
- atatatat 5y agoConcept correct, # of years off by a lot.
- asclepi 5y agoI agree with the industry response here. KRACK was the same thing. The author finds a vulnerability that is absolutely valid (no denying here), easy to exploit in a lab but very hard to exploit in practice. Back in the day, we did test our equipment for KRACK. We concluded that someone had to circumvent all our physical security barriers (challenging, but theoretically possible) to get close enough to an AP that would see sensitive stuff, had to know WHEN to do that, or at least plant a device that could easily be noticed, and they would still fail because we didn't have 802.11r enabled on those AP's. Is it a concern? It depends on what you're doing. It is absolutely a concern if your corporation is handling ultra-sensitive information. However, you should also question your physical barriers in that case and whether you should use Wi-Fi at all for some aspects of your operation. Is it a concern for the vast majority of office workers or someone at home? Probably not; there would be easier ways to find a valid credit card number that don't involve the time and effort for a hacker to travel to your place where they could be discovered. There's no need to replace all your AP's with new hardware, although the Wi-Fi Alliance would love for you to do that. Does this exploit warrant its own fancy name and domain name? As was the case for KRACK, I don't believe so. That should be reserved for vulnerabilities that have a severe impact AND are extremely trivial to exploit with no proximity requirements. If not, the fancy-name-vulns risk being deprived of their ability to get the attention that is required.
- tptacek 5y agoFrom the researcher that brought you KRACK: https://www.krackattacks.com/ https://www.krackattacks.com/
- BelenusMordred 5y agoEverytime I see a headline like this always think "this is probably Mathy at it again". The guy is a titan in breaking wifi.
- motohagiography 5y agoIt's as though supporting fragmentation in any protocol makes preventing replays and offset overwrites a next order Hard problem.
- jtchang 5y agoI wonder if hardcoding your DNS servers will help. I guess sometimes this is not possible because in corporate environments DNS servers are sent via DHCP.
- beermonster 5y ago“ More technically, the impact of attacks can also be reduced by manually configuring your DNS server so that it cannot be poisoned. Specific to your Wi-Fi configuration, you can mitigate attacks (but not fully prevent them) by disabling fragmentation, disabling pairwise rekeys, and disabling dynamic fragmentation in Wi-Fi 6 (802.11ax) devices.” So yes, but as you say lots of things can override your explicit DNS settings. Even browsers can do it these days. Run WireGuard. Effectively treat WiFi as untrusted and VPN over it. Have WireGuard send over your DNS on the other side, and have that DNS use D-o-T or D-o-H depending on your threat model. Use Ethernet on stationary devices, and WiFi on mobile devices.
- Reventlov 5y agoMathy strikes again ! This has been fixed in Linux and certain firmware / driver already: https://lore.kernel.org/linux-wireless/20210511180259.159598-1-johannes@sipsolutions.net/ https://lore.kernel.org/linux-wireless/20210511180259.159598...
- DanAtC 5y agoOnly because they agreed to sit on the patches for an inordinate amount of time. Theo de Raadt did the right thing for KRACK. Shame it would be his only chance to do so before getting kicked out of Mathy Vanhoef's secret club.
- wing-_-nuts 5y agoI'm out of the loop. Expand?
- ygjb 5y agohttps://www.krackattacks.com/ https://www.krackattacks.com/ Probably referring to the internet drama related to silent patching and disclosure embargo. There are some details here, and others on various mailing lists, including an airing of differences if you want to look for that sort of thing after making a bowl of popcorn.
- spijdar 5y agoFrom someone mostly out of the drama loop, here's my brief recollection: Generally in the security sphere we consider it the most ethical and responsible to give vendors plenty of time to patch vulnerabilities, especially critical ones, before publishing details or anything that could lead to a working 0-day exploit. Theo de Raadt was one of the people notified of a previous WiFi exploit, and there was a set length of time intended for the vulnerability to be made private, in order for the (inordinately slow) vendors to create and push/prepare patches. If the patches were released early, it'd be easy to determine what the original vulnerability was. So, Theo de Raadt decided, in the interest of keeping OpenBSD secure, to push the patch early, effectively letting the whole cat out of the bag. I'm not going to get into the drama of whether that was right, wrong, foolish, wise, whatever, but because of that, he no longer receives these ahead-of-time notifications of vulnerabilities.
- SCHiM 5y ago""" How can the adversary construct unencrypted Wi-Fi frames so they are accepted by a vulnerable device? First, certain Wi-Fi devices accept any unencrypted frame even when connected to a protected Wi-Fi network. """ This actually made me angry. How fucking long are we doing this already? This is so. basic. Why is this possible? This should incur liability, we know the IT environment is adversarial. I understand one can make technical mistakes, or shoot oneself in the foot in low level languages that are difficult to handle correctly. But this is a conceptual mistake, involving crypto! How can you possibly have written this code for an issue like this to occur? What is the control flow that leads to this? I almost cannot imagine how someone could code this up by accident, this must be a backdoor. Just imagine: if decrypt(encrypted) == false { memcpy(plaintext, encrypted); // lets try to use the encrypted data anyway, you never know! } handle_packet(plaintext);
- Reventlov 5y agoWiFi has always been developed on being retro-compatible. The good side is you can use something from 2003 with AP from today (let's ditch the 5MHz and 10MHz bandwidth), the downside is you have a big stack of technical debt in most of the chipset out there, which might be why this kind of things happens. Not having any access to the firmware source (thanks FCC) does not help at all.
- thereddaikon 5y agoWhy is it the FCC's fault specifically? The FCC doesn't regulate Intellectual Property. They regulate radios. Are you implying its within the FCC's power to say radio firmware must be open source?
- the8472 5y agoThey require that users can't use restricted frequency ranges or raise the power level. The easiest and cheapest way for manufacturers to comply is to lock down firmwares. And since they didn't also require open firmwares that's the effective outcome in many cases.
- 5y ago
- riobard 5y agoBy now it's probably easier in mind to treat any Wi-Fi as Open Network and always use something like WireGuard/Tailscale for secure communication between devices.
- DanAtC 5y agoIf only we knew 6 months earlier after a reasonable disclosure.
- fmajid 5y agoIt’s always been my working assumption that WiFi security should be presumed to be broken until it is proven to be broken.
- doggodaddo78 5y agoYeap. I'm trying to remember if 802.11x would help or it's just AAA. Point-to-point tunnels up one layer are the way to go.
- totetsu 5y agoAnd set your own DNS, and maybe block DNS on the standard port...
- timwis 5y agoCan you help me understand why this is necessary if all your services use https?
- DanAtC 5y agoA 9 month embargo is disgusting. Linux users have been sitting ducks while others may or may not received silent updates.
- haukem 5y agoOften many companies and organizations from many countries are getting informed about such security problems under the embargo. I assume that the intelligence agencies form many countries are also getting these information. Either they are officially informed, because they also protect the government networks or they have just good working relationships with their local companies. I assume Microsoft would inform the NSA about such things, Huawei would inform the Chinese intelligence agencies and Siemens would inform the German BND.
- DanAtC 5y agoAnd those nations got a chance to freely exploit it* for way longer than a typical reasonable disclosure of 90 days. *Assuming they didn't already know about it which is why fast disclosure is so important.
- Dah00n 5y agoI can't read from your comment if you think this is A Good Thing. In my opinion it is s Very Bad Thing. None of those entities are more important than everyone else. If anyone should be alerted it should only be those that fix the vulnerability in WiFi devices. Anyone else and not only does the risk of leaks rise exponentially but some of them will rub their fingers with glee and exploit it ASAP.
- haukem 5y agoI think such long embargoes are bad. Embargoes prevent that the average cyber criminal knows about the problems, but the resourceful organizations already get the information before the public knows about them. I think even 90 days are pretty long. For example 253 vendors were informed about the problem in dnsmasq about 3 months before it was published: https://www.kb.cert.org/vuls/id/434904 https://www.kb.cert.org/vuls/id/434904 (all vendors listed here were informed) In each organization probably multiple people know about this.
- inetknght 5y ago> certain devices accept plaintext aggregated frames that look like handshake messages. An adversary can exploit this by sending an aggregated frame whose starts resembles a handshake message and whose second subframe contains the packet that the adversary wants to inject. That reminds me of a thread [0] that came up a month ago mentioning discussion of packets in packets [1]. That paper was from 2011! [0]: https://news.ycombinator.com/item?id=26778236 https://news.ycombinator.com/item?id=26778236 [1]: https://static.usenix.org/events/woot11/tech/final_files/Goodspeed.pdf https://static.usenix.org/events/woot11/tech/final_files/Goo...
- risedotmoe 5y agoI've always felt an always listening radio, especially the ones in televisions that try to connect to anything it can, in any device is a big gaping security hole. We've already seen how Bluetooth makes things vulnerable. If you're truly worried about security, go with the cable.
- SavantIdiot 5y agoFragmentation is usually disabled in home APs. I've played with it on hostapd, but didn't find a performance improvement, and investigating withe WireShark found even 64k packets were not being fragmented. Is the same true for enterprise AP?
- Dah00n 5y agoIt's enabled with WiFi6 so a forward compatible vulnerability!
- lwhi 5y agoI just checked for an update for my TP Link Rouer, nothing yet. How likely are large manufacturers likely to react to this?
- beermonster 5y agoWell you may find you can run (but May understandably not want to) OpenWRT on your TP Link Router. And OpenWRT released an update following KRACK
- lwhi 5y agoNot my model yet (unfortunately)
- crookshanked 5y agoFrom my own experience with TP Link routers I don't expect them to update at all.
- Dah00n 5y agoIf the device didn't first appear on the market in the last six months? About as likely as Apple opening their hardware.
- jeroenhd 5y agoFrom my experience with TP-LINK software, you don't need to worry about this attack. The attack demonstrated is complex, requires physical proximity and a lot of knowledge about the target. Meanwhile, your router will probably give any attacker root if they ask it nicely. TP-Link doesn't seem to care about device security at all if you're already paid for the device, so don't expect any updates and expect a whole range of vulnerabilities to be exploitable against your router. Now, it must be said, TP-Link is no D-Link, a company that almost seems to add security problems to their software intentionally with their awful software quality, but if you're conscious about security, any consumer device will probably have a whole bunch of exploits that would work easier and more reliably. EDIT: replaced the word "access" with "proximity" to avoid confusion.
- mdeck_ 5y ago“Frag” as a portmanteau of FRagmentation and AGgregation is hardly a non-ambiguous choice of terminology.
- colinbr96 5y agoWould using a VPN prevent the malicious DNS packet?
- swiley 5y agoAuthenticating the remote end of the connection (which all decent software does because using it on other people's WiFi would be very unsafe otherwise) makes it irrelevant.
- throwitaway12 5y agoCould you elaborate on this? I, too, would like to know the definitive answer to this, as I feel like a malicious DNS packet was used against a computer of mine before connected to the VPN. Very serious attack...
- transpute 5y agoFuture Wi-Fi devices will be able to see through your home and business walls, for activity monitoring and biometric identification, https://www.theregister.com/2021/03/31/wifi_devices_monitoring/ https://www.theregister.com/2021/03/31/wifi_devices_monitori... > In three years or so, the Wi-Fi specification is scheduled to get an upgrade that will turn wireless devices into sensors capable of gathering data about the people and objects bathed in their signals... When 802.11bf will be finalized and introduced as an IEEE standard in September 2024, Wi-Fi will cease to be a communication-only standard and will legitimately become a full-fledged sensing paradigm... tracking can be done surreptitiously because Wi-Fi signals can penetrate walls, don't require light, and don't offer any visible indicator of their presence. IEEE 802.11bf paper: https://arxiv.org/abs/2103.14918 https://arxiv.org/abs/2103.14918 Papers on device-free wireless sensing (DFWS): https://dhalperi.github.io/linux-80211n-csitool/ https://dhalperi.github.io/linux-80211n-csitool/ Remote sensing with low-cost ESP32 and 802.11n: https://academic.oup.com/jcde/article/7/5/644/5837600 https://academic.oup.com/jcde/article/7/5/644/5837600
- beermonster 5y agoAnd let’s not forget also Amazon Sidewalk Scary times.
- 1vuio0pswjnm7 5y agoSuprised there is nothing in the "Q&A" that refers to wired devices. As if there is no choice.
- johnklos 5y agoI think this will make for an excellent litmus test for companies that make wifi products. Is this a critical fix? No. Is it important, if not critical? Yes. Some vendors aren't going to care about this in the least and won't offer any updates. Some will only fix this in new and future devices. And perhaps some will update all their devices going back several years. Currently I buy used 802.11ac Airport Extremes for wireless for people because they're simple, they stay out of the way, and the last time there was a major update, Apple updated every Airport model all the way back to the Airport Express from 2008. But I want to be able to buy new wifi devices, and how vendors handle this will inform me about which ones I'll buy going forward.
- jakob223 5y agoAs far as I can tell Apple has not released an update for my Airport Express since 2018 :/
- EricE 5y agoMaybe because it's the same year they announced they were dropping support for it? Time to get a newer piece of gear. This is the problem with software - it doesn't age like a fine wine; it has to be maintained - and that usually means someone is going to have to be paid to do the not so fun work of maintaining and fixing old stuff that is no longer "OoOh tEh sHiNeY!"
- 1over137 5y agoI don't think it's so much the paying of programmers for maintenance, as the desire for forced-obsolescence, so they can sell new stuff.
- btach 5y agoSo, will I need to go beyond the tinfoil hat? Maybe line the walls with tinfoil?
- billpg 5y agoExactly how terrified should I be right now?
- throwitaway12 5y agoI would really like to know, if someone could, the definitive answer to if using a VPN would prevent the malicious packet? Do we even know at this point?