The Wi-Fi Alliance has published an official statement:
'There is no evidence that the vulnerability has been exploited maliciously […].'
That is probably about to change …
https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-se...
Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse
201–210 of 424 posts
Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse
#202Earlier quoted context omitted.
Also doesn't it require the attacker to have access to your wifi already? If that's the case, it's a hazard for connecting in a Starbucks or on your mobile service wifi, but you would be safe on your home or corporate wifi (unless the attacker is a colleague or relative!).
Totally safe, until your local war-driver sniffs out your insecure device and comes back at two in the morning to upload illegal content via your ISP.
You're freaking me out with that scenario
Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse
#203Earlier quoted context omitted.
The Nexus 5 was released 4 years ago. At the same time the iPhone 5C was released. The 5C also won't receive a patch for this. There is a problem with handset abandonment, but this is true across all vendors, and it does not underline sequence7's claim that this is solely an Android problem.
To be fair, these two examples are both on the extreme end: The Nexus 5 being one of the longest supported Android phones on the market, and the 5C having a rather short support period, compared to other iPhones like the 5S, which was released along with the 5C and got iOS 11. Security updates for the Nexus 5 also stopped shipping about a year earlier. There's still room for improvement for Apple (5 years of security…
The problem is that these aren't phones anymore; they're small computers. They should have support lifetimes that are comparable to desktop computers.
Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse
#204As an Android user is there any mitigation for this other than ditching my handset and switching to an iPhone or waiting (hopelessly) for a patch from my vendor. This really does highlight the absolute disaster zone that the Android handset market has become as far as updates are concerned. I'm sure the Pixels will get a fix relatively quickly but almost every other Android user is going to be left in security limbo.
This is one of those things that should be better with modern handsets and the security patch level for Android. Hopefully a fix for this is included in the November set. In general most bigger manufacturers have been somewhat decent in updating their flagship devices. With a Sony flagship from the last 18 months for example, you usually won't run more than two months behind on security updates. Samsung is similar if…
Any https traffic is going to be safe from this attack, a VPN would also protect you.
Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse
#205Earlier quoted context omitted.
To underline your point, even my Nexus 5 (_from Google_), which is a little less than 3 years old, will never receive security updates. And one of the main reasons I chose the Nexus was to be sure to get updates on time. Except for the security vulnerabilities, everything of the device is totally fine. It's such a waste of resources… (In this case I at least have an alternative in the form of Lineage OS, which will o…
The Nexus 5 was released 4 years ago. At the same time the iPhone 5C was released. The 5C also won't receive a patch for this. There is a problem with handset abandonment, but this is true across all vendors, and it does not underline sequence7's claim that this is solely an Android problem.
A lot of phone companies are locking their devices from receiving new kernels. Its dumb and I hate it.
Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse
#206This is not an end-of-the-world type vulnerability. 1. Does not affect long-term credentials - certs, wifi passwords are still safe. Rather, confidentiality (secrecy) from client --> AP is affected, and in some cases packet forgery is possible (integrity). 2. Actually accomplishing this attack, for now, requires special and expensive hardware (med to high range SDR gear). Its also not that reliable outside of a lab e…
Wrong, my devices have already been attacked with a handheld device. The attacker managed to hack my phone through this attack, which means that there is a compromise to kernel available in all Android's from wifi.
They changed multiple parameters and downloaded my banking information as well as account details. Unfortunately for them, I am financially very poor.
NSA and FBI are worthless. They never warn and just leave everyone exposed and vulnerable just to make their career points. Good thing for independent researchers.
Never tell the NSA or FBI about security vulnerabilities. They will just threaten you to shut up. They are extremely nasty, cruel people. Nothing is too low or out of bounds to them to get you to keep quiet. Go direct to company and public.
Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse
#207Earlier quoted context omitted.
To be fair, these two examples are both on the extreme end: The Nexus 5 being one of the longest supported Android phones on the market, and the 5C having a rather short support period, compared to other iPhones like the 5S, which was released along with the 5C and got iOS 11. Security updates for the Nexus 5 also stopped shipping about a year earlier. There's still room for improvement for Apple (5 years of security…
The problem is that these aren't phones anymore; they're small computers. They should have support lifetimes that are comparable to desktop computers.
> they're small computers.
And they are more expensive than many computers you can buy on the market. 2 years support on a device that can cost $500+ isn't acceptable.
Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse
#208As an Android user is there any mitigation for this other than ditching my handset and switching to an iPhone or waiting (hopelessly) for a patch from my vendor. This really does highlight the absolute disaster zone that the Android handset market has become as far as updates are concerned. I'm sure the Pixels will get a fix relatively quickly but almost every other Android user is going to be left in security limbo.
Currently the only mitigation is to constrain your browsing to properly configured https (SSL) web sites.
Too bad DNS doesn't fall under properly protected against local attacks.
Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse
#209As an Android user is there any mitigation for this other than ditching my handset and switching to an iPhone or waiting (hopelessly) for a patch from my vendor. This really does highlight the absolute disaster zone that the Android handset market has become as far as updates are concerned. I'm sure the Pixels will get a fix relatively quickly but almost every other Android user is going to be left in security limbo.
Ditch wifi, go 4G only!
Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse
#210Earlier quoted context omitted.
So if i use my wired in node as an ssh tunnel out to the "internets" to tunnel all traffic from my wifi connected nodes then this mitigates the issue till updates come through?
That's a feasible option on laptops running macOS or Linux, but not for Android clients. Running a SSH VPN (tunneling all traffic) requires root and has a severe performance penalty (which you will notice on your battery). You'd notice it on the laptops as well, but I guess that matters less. Funny enough, OpenBSD didn't impleemnt WPA(2) for a while. Instead, they were forcing their users to use IPsec and OpenSSH ins…
OpenVPN doesn't require root. You can use your own server or find a trusted commercial provider. I recommend airvpn, https://airvpn.org/?referred_by=287899