Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse • Hacker News Board

Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse

#211

Post by whyever » Mon, Oct 16, 2017, 1:47 PM UTC

> OpenBSD was notified of the vulnerability on 15 July 2017, before CERT/CC was involved in the coordination. Quite quickly, Theo de Raadt replied and critiqued the tentative disclosure deadline: “In the open source world, if a person writes a diff and has to sit on it for a month, that is very discouraging”. Note that I wrote and included a suggested diff for OpenBSD already, and that at the time the tentative disclosure deadline was around the end of August. As a compromise, I allowed them to silently patch the vulnerability. In hindsight this was a bad decision, since others might rediscover the vulnerability by inspecting their silent patch. To avoid this problem in the future, OpenBSD will now receive vulnerability notifications closer to the end of an embargo.

I'm not convinced it was a bad decision. Why would you want to leave your users vulnerable? It's possible that this has been exploited in the wild.

Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse

#212

Post by hollander » Mon, Oct 16, 2017, 1:47 PM UTC

jannes wrote: post #167

bjpbakker wrote: post #147

Earlier quoted context omitted.

As others suggested ensure that all communication uses TLS (be it https et al or tunnel traffic through a VPN). Also you could install a better version of Android on your phone rather than an outdated vendor version. That will probably fix more security related issues than just this one :)

How would you make sure that apps use TLS for comunication? In the browser it's easy to see, but in apps those details are hidden away from the user.

Use a VPN, a commercial one that actually works, like F-secure Freedome.

Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse

#213

Post by blurbleblurble » Mon, Oct 16, 2017, 1:48 PM UTC

JumpCrisscross wrote: post #99

titzer wrote: post #91

Earlier quoted context omitted.

Perhaps "defect" is the wrong word given the circumstances, but the result is the same. There's a good reason for the embargo: this all takes cooperation, as it's not a Nash equilibrium. I still agree with their decision not to include OpenBSD so early in further disclosures, given Theo's short-sighted statement.

> Perhaps "defect" is the wrong word It's precisely the correct word. Prisoner's dilemma are simple, mathematically. This was one. OpenBSD defected. The joke's on the security researcher, though, since this doesn't appear to have been their first time [1][2]. Robert Axelrod outlined, in his 1984 classic The Evolution of Cooperation [3] four requirements for a successful iterative prisoner's dilemma strategy. One is r…

So does the simple mathematical treatment also include language like "the joke's on ____”? Or was that more of a philosophical interpretation of yours?

Real life is messier than any model.

https://www.quantamagazine.org/in-game-theory-no-clear-path-...

Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse

#214

Post by whyever » Mon, Oct 16, 2017, 1:48 PM UTC

hollander wrote: post #209

sequence7 wrote: post #102

As an Android user is there any mitigation for this other than ditching my handset and switching to an iPhone or waiting (hopelessly) for a patch from my vendor. This really does highlight the absolute disaster zone that the Android handset market has become as far as updates are concerned. I'm sure the Pixels will get a fix relatively quickly but almost every other Android user is going to be left in security limbo.

Ditch wifi, go 4G only!

I'm not convinced 4G is more secure.

Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse

#215

Post by pnutjam » Mon, Oct 16, 2017, 1:48 PM UTC

discreditable wrote: post #188

dboreham wrote: post #185

"This can be abused to steal sensitive information such as credit card numbers, passwords" This really isn't true (because that kind of information is protected by TLS) and the article is highly disingenuous to not say so. Nobody has trusted WiFi encryption as protection for sensitive information for more than a decade.

Demonstration video has the researcher sniff passwords from match.com, which uses TLS. The catch is they aren't using HSTS and so they are vulnerable to sslstrip.

True, using a vpn gives you control over "an" encryption layer for your traffic, relying on the sites https will always be less ideal.

Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse

#216

Post by pnutjam » Mon, Oct 16, 2017, 1:50 PM UTC

s17tnet wrote: post #4

l2dy wrote: post #3

Do we now need WPA3? No, luckily implementations can be patched in a backwards-compatible manner.

The problem is that tons and tons of devices will not receive update until they die.

You can mitigate with a vpn.

Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse

#217

Post by blurbleblurble » Mon, Oct 16, 2017, 1:51 PM UTC

Fnoord wrote: post #157

mimi89999 wrote: post #60

Earlier quoted context omitted.

You got everything wrong. If big vendors are unable to patch their proprietary products in an acceptable time, that shouldn't put others at risk. Users shouldn't choose their products... Think about it in a different way: What if a vulnerability was discovered in TLS and FOSS implementations patched it, but there is an embargo for supposedly protecting some banking software? What if NSA/CIA/other agencies find out ab…

What if [...] is FUD. What if Theo de Raadt works for the FSB? We need to work with the facts. If you don't agree with an embargo and decide to break it, that's on you. But the consequence is that you shouldn't be surprised if next time you're informed later, or not at all. What OpenBSD proponents and developers are doing right now, is damage control. It may work this time, it may work next time, but it won't keep wo…

No, I don't. And its stupid, because it doesn't have to be that way. But telecoms have complicated the situation with their greedy firmware reinforced planned obsolescence.

Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse

#218

Post by sp332 » Mon, Oct 16, 2017, 1:51 PM UTC

whyever wrote: post #211

> OpenBSD was notified of the vulnerability on 15 July 2017, before CERT/CC was involved in the coordination. Quite quickly, Theo de Raadt replied and critiqued the tentative disclosure deadline: “In the open source world, if a person writes a diff and has to sit on it for a month, that is very discouraging”. Note that I wrote and included a suggested diff for OpenBSD already, and that at the time the tentative discl…

This probably hasn't been exploited in the wild. Anyway the point of coordinating disclosure is to leave fewer people vulnerable overall. If one team releases a patch early, attackers can analyze the patch and start using the vulnerability against unpatched systems. Waiting for everyone to patch at once closes that window.

Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse

#219

Post by breakingcups » Mon, Oct 16, 2017, 1:53 PM UTC

whyever wrote: post #211

> OpenBSD was notified of the vulnerability on 15 July 2017, before CERT/CC was involved in the coordination. Quite quickly, Theo de Raadt replied and critiqued the tentative disclosure deadline: “In the open source world, if a person writes a diff and has to sit on it for a month, that is very discouraging”. Note that I wrote and included a suggested diff for OpenBSD already, and that at the time the tentative discl…

Seems rather prisoner-dilemma-ish[1].

Up until now, there were no indications that this was being exploited publicly. After a flaw like this gets known (whether through a coordinated disclosure or through OpenBSD's early patch) you can be assured people will be exploiting this.

Do you both stay silent and take the minor risk of your users being vulnerable for a short time longer whilst patching and disclosure is being coordinated with all parties (-1/-1), or do you "betray party B" but get your own users secured as soon as possible (-3, 0).

I think coordination makes more sense in a flaw as big as this.

1: https://en.wikipedia.org/wiki/Prisoner%27s_dilemma

Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse

#220

Post by masswerk » Mon, Oct 16, 2017, 1:56 PM UTC

Now, the OS of processor management units like Intel AMT and the AMD equivalent also incorporate wireless stacks. What are the chances of them becoming effectively fixed?