361–370 of 424 posts
Earlier quoted context omitted.
The researcher’s lack of full disclosure may have lead to this vulnerability being discovered and exploited by other people.
Also an embargo lasting months seems excessive. You also can not guarantee me that no one who gets this information early is not working for a bad actor.
Earlier quoted context omitted.
" As a compromise, I allowed them to silently patch the vulnerability. " The way I read that they broke no embargo
They were pressured by OpenBSD to do so, and regret it. That doesn't mean they broke embargo, but it also doesn't reflect well on them. Do you think Theo would've respected the embargo if they had said "no, do not patch until the embargo date?"
Earlier quoted context omitted.
Well I did mention it's "an end-of-the-world type vulnerability, at least as far as Wi-Fi goes". I don't think it's a lot of consolation saying something along the lines of "Wi-Fi security is broken, but it's not so bad because it's Wi-Fi"
You should read "Silence on the Wire: A Field Guide to Passive Reconnaissance and Indirect Attacks" by Michal Zalewski to expand your universe on things you should be afraid pal. Interesting book that can really burst your bubble on how bad things are and yet we are still here.
I'm not sure how that compares to the fact that WPA2 is completely insecure and trivial to decrypt on Android as "no, that is bad". Except maybe in a "well who trusts Wi-Fi security anyway?" to which I'd reply: "Actually, a lot of people. Including people on this thread".
I actually buy the argument that the RSA issue that affects YubiKey, that was announced today, is perhaps more important since it's harder to mitigate than using a VPN, but I don't know how bringing up silence in the wire makes this any less important.
Again, I haven't fully or detailedly read the book, so I could be wrong about that I guess.
Earlier quoted context omitted.
As a user I am completely fine with that.
Even when the author states that now as a result of that selfishness OpenBSD won't get notified about vulnerabilities until well after everyone else?
http://espressif.com/en/media_overview/news/espressif-releas...
Earlier quoted context omitted.
Seems rather prisoner-dilemma-ish[1]. Up until now, there were no indications that this was being exploited publicly. After a flaw like this gets known (whether through a coordinated disclosure or through OpenBSD's early patch) you can be assured people will be exploiting this. Do you both stay silent and take the minor risk of your users being vulnerable for a short time longer whilst patching and disclosure is bein…
And be sure to note the iterated version which is where things get interesting https://en.wikipedia.org/wiki/Prisoner%27s_dilemma#The_itera... You can already see it in this case, where Theo "defecting" leads to less cooperation in future rounds.
if (win7 && smb && wpa2) then vulnerable to password theftEarlier quoted context omitted.
Currently the only mitigation is to constrain your browsing to properly configured https (SSL) web sites.
Or using a VPN.
As an Android user is there any mitigation for this other than ditching my handset and switching to an iPhone or waiting (hopelessly) for a patch from my vendor. This really does highlight the absolute disaster zone that the Android handset market has become as far as updates are concerned. I'm sure the Pixels will get a fix relatively quickly but almost every other Android user is going to be left in security limbo.
Ubiquity just released a patch for KRACK and soon others will I imagine. From a client perspective, same as always, wait for a patch from your OS vendor. edit: it seems this patch only handles modes where the AP is a client like a bridge or site-to-site. Its still a client-side fix and patching AP's used traditionally won't fix this. In practice, everything of value should be going over TLS. If you're worried you sho…
Earlier quoted context omitted.
You should be good if you’re up to date as of November 6th (I think, it may be November 8th) Swiftonsecurity tweeted this out, it’s a description of KRACK and various devices affected by it. Apparently google already fixed it on android? Also it says that iOS is rumored to be protected against this since iOS 11 but it’s not confirmed. Nobody has put out an official statement yet. What’s weird is that commercial vendo…
October 6th/8th, you mean? I found it interesting that, in his article, he said: "With our novel attack technique, it is now trivial to exploit implementations that only accept encrypted retransmissions of message 3 of the 4-way handshake. In particular this means that attacking macOS and OpenBSD is significantly easier than discussed in the paper" but elsewhere it said recent versions of OS X and iOS are not impacte…
He forces them to connect to his own AP and forwards all traffic to the destination so that the client is unaware it has been redirected.
He then forces the client to re-install the key which (on anything that is derived from wpa_supplicant e.g. Linux, Android, etc) the client has blanked out after first use, so the key it reinstalls is now all zero bytes.
He can continue to forward the traffic to the destination so that the client gets responses, but now he can decrypt all of the traffic too.
For clients that re-install the correct key (which the account does not recover in any way) the attacker has to rely on snooping enough encrypted data in order to perform a birthday attack as the key re-installation also resets the frame counters which leads to nonce-reuse which is a problem in ciphers like AES-GCM.