Interestingly, the paper mentions that CCMP is affected less than TKIP/GCMP, but not the FAQ.
Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse
341–350 of 424 posts
Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse
#342Earlier quoted context omitted.
Does this resolve the issue on the AP side of things? Could I theoretically have an AP update that would resolve this with no need to update clients?
Unfortunately no, from what I understand this is primarily an attack against clients.
Ah yes, I see now that the patch is actually to wpa_supplicant.
Well, hopefully this means no kernel patch will be needed.
Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse
#343As an Android user is there any mitigation for this other than ditching my handset and switching to an iPhone or waiting (hopelessly) for a patch from my vendor. This really does highlight the absolute disaster zone that the Android handset market has become as far as updates are concerned. I'm sure the Pixels will get a fix relatively quickly but almost every other Android user is going to be left in security limbo.
You should be good if you’re up to date as of November 6th (I think, it may be November 8th) Swiftonsecurity tweeted this out, it’s a description of KRACK and various devices affected by it. Apparently google already fixed it on android? Also it says that iOS is rumored to be protected against this since iOS 11 but it’s not confirmed. Nobody has put out an official statement yet. What’s weird is that commercial vendo…
October 6th/8th, you mean?
I found it interesting that, in his article, he said: "With our novel attack technique, it is now trivial to exploit implementations that only accept encrypted retransmissions of message 3 of the 4-way handshake. In particular this means that attacking macOS and OpenBSD is significantly easier than discussed in the paper"
but elsewhere it said recent versions of OS X and iOS are not impacted. I wonder if the "safe" OSes are only vulnerable to the blocking/replay but not the decryption of data?
My UniFi AP-PROs show up today so I'll make sure to update them first thing.
Also, I'm having a bit of a hard time understanding the attack. It sounds like he forces them to connect to his AP, performs the attack, then allows them to connect to the intended network with the zeroed key, THEN is able to sniff that client's traffic because he knows their key? If I understand correctly, this means he cannot sniff the whole network's traffic, only the traffic between the attacked client and the AP? This makes me wonder about the meaning of a pre-shared key, but I'm guessing the PSK is only used to setup the relationship between client and AP, and then after the initial connection/pairing the pre-shared key is no longer used...
Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse
#344Have I got this right in lay-mans terms. The client is forcibly disconnected from the WiFi network and reconnects to the attackers network instead. The attacker doesn't need to know the WPA2 password but it accepts the connection setting the encryption to zeros. The client thinks it is connected to the original wifi network and continues as normal. Wifi traffic is intercepted and unencrypted.
> The client is forcibly disconnected from the WiFi network and reconnects to the attackers network instead. The client is tricked into moving to what it thinks is the same WiFI network running on a different channel, but is actually the attackers network instead. > The attacker doesn't need to know the WPA2 password but it accepts the connection setting the encryption to zeros. The attacked doesn't need to know the…
Just the traffic between the impacted client and the network, right? Because each client is using a different key (has to be, if we're able to reset just one client's key to all zeros)
Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse
#345Earlier quoted context omitted.
This is one of those things that should be better with modern handsets and the security patch level for Android. Hopefully a fix for this is included in the November set. In general most bigger manufacturers have been somewhat decent in updating their flagship devices. With a Sony flagship from the last 18 months for example, you usually won't run more than two months behind on security updates. Samsung is similar if…
Any https traffic is going to be safe from this attack, a VPN would also protect you.
From TFA:
Although websites or apps may use HTTPS as an additional layer of protection, we warn that this extra protection can (still) be bypassed in a worrying number of situations. For example, HTTPS was previously bypassed in non-browser software, in Apple's iOS and OS X, in Android apps, in Android apps again, in banking apps, and even in VPN apps.
Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse
#346Earlier quoted context omitted.
I do think it's an end-of-the-world type vulnerability, at least as far as Wi-Fi goes. 1) The paper claims confidentiality compromise allows the attacker to hijack a tcp connection: "allow an adversary to decrypt a TCP packet, learn the sequence number, and hijack the TCP stream to inject arbitrary data", this on all cases, even in the cases where it doesn't allow forgery (CCMP) 2) There's no such claim on the paper…
You have two school of thought here... optimist vs pessimist. Remember that the attack affects mostly client implementations therefore still needs proximity to victim(s), this makes most of the end-of-the-world type scenarios impractical (they even state these on their QA) and leaves exploitation to direct/APT-groups alone.
Well I did mention it's "an end-of-the-world type vulnerability, at least as far as Wi-Fi goes".
I don't think it's a lot of consolation saying something along the lines of "Wi-Fi security is broken, but it's not so bad because it's Wi-Fi"
Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse
#347Earlier quoted context omitted.
I do think it's an end-of-the-world type vulnerability, at least as far as Wi-Fi goes. 1) The paper claims confidentiality compromise allows the attacker to hijack a tcp connection: "allow an adversary to decrypt a TCP packet, learn the sequence number, and hijack the TCP stream to inject arbitrary data", this on all cases, even in the cases where it doesn't allow forgery (CCMP) 2) There's no such claim on the paper…
Sky-is-falling is FUD: The attack is a standard break exiting secure TCP connection and trick the target to re-create it to a host controlled by the attacker via arp poisoning or route hijacking. After that either convince target to accept a bogus cert or redirect to insecure connection. In the former case the issue is that browsers have way too many root CAs included in them and those CAs can issue certs for any dom…
That's not the attack at all. And there's nothing standard about it.
The attack is the fact that someone couldn't do this you're describing on any WPA-2 protected Wi-Fi network before, and now they can.
Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse
#348As an Android user is there any mitigation for this other than ditching my handset and switching to an iPhone or waiting (hopelessly) for a patch from my vendor. This really does highlight the absolute disaster zone that the Android handset market has become as far as updates are concerned. I'm sure the Pixels will get a fix relatively quickly but almost every other Android user is going to be left in security limbo.
"is there any mitigation for this other than ditching my handset and switching to an iPhone or waiting (hopelessly) for a patch from my vendor."
Using a VPN is the best way to mitigate this until your device is patched, assuming you trust your VPN provider or run your own VPN.
Edit: Actually, even if you don't trust your VPN provider, you'll be protected against this attack (KRACK), given their client is implemented properly.
Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse
#349Earlier quoted context omitted.
You can mitigate with a vpn.
How do I install a VPN on my IoT lightbulbs?
My understanding is that only the light bulb's traffic will become decrypted. If you see it go from blue to red, without your consent, then you'll know. Otherwise, the Wifi password is still safe.
Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse
#350> how did this attack slip through, despite the fact that the 802.11i handshake was formally proven secure? So, we cannot trust even formal verification? > it’s a factual statement. In formal analysis, definitions really, really matter! If lack of definition implies flaws in formal verification, does that mean we need an additional formal verification of formal verification? Update: > We need machine-assisted verific…
> So, we cannot trust even formal verification? it's explained in the article, 2 unit tests, 0 integration tests. The formal verification appears to prove correctness of the 2 pieces independently, but not of the composition. > Haskell, here is your opportunity :-) you're just moving the problem to the correctness of the compiler.
> you're just moving the problem to the correctness of the compiler
But it would be a huge leap forward.