KRACK WPA2 Vulnerability Exposed

[RMerlin]

On Linux, `wpa_supplicant` is used to perform that handshake; it's been patched already on RHEL and CentOS at least. The drivers should not be vulnerable, as far as I understand it.

That first CVE I listed only affects Windows. No idea about the second one, but Intel does list it as having been fixed in their driver release.

 

[john9527]

On Linux, `wpa_supplicant` is used to perform that handshake; it's been patched already on RHEL and CentOS at least. The drivers should not be vulnerable, as far as I understand it.

Also on Ubuntu/Mint....I was offered the wpa update yesterday.

 

[RogerSC]

[sfx2000]
It's a client side vuln - linux and android are high at risk, OpenBSD released a patch for their wpa supplicant, and I expect other OS's to release as well.

AP's are not impacted - however, repeats (as they are clients) are vulnerable.

Yes, I heard that Microsoft has already released a patch for this...in their last cumulative.

On the other hand, routers and a IoT devices all commonly use embedded Linux kernels, so there's that.

Just the other day I had our solar panel installer turn off the wifi between the solar panel monitor and our router, and it's now using powerline networking. Still have a lot of unpatched clients, though *sigh*. Have to wait for Apple and Google to get on it.

 

[wouterv]

KRACK WPA2 Wi-Fi flaw:
https://www.kb.cert.org/vuls/id/228519

Asus statement can be found here:
https://www.asus.com/Static_WebPage/ASUS-Product-Security-Advisory/
A fix seems in progress.
The last update I see now is of 10/18/2017.

 

[pege63]

ONE of the first Routers to get the WPA KRACK fix is the Dovado Routers

New Firmware containing fixes for WPA KRACK.
VERSION: 9.0.7

 

[rbird2]

ONE of the first Routers to get the WPA KRACK fix is the Dovado Routers

New Firmware containing fixes for WPA KRACK.
VERSION: 9.0.7

Never heard of a Dovado router.

Went to the Dovado website (http://www.dovado.com/en/where-to-buy) and it appears they do not do business in North America...

 

[rtcomputersinc]

My mention of this krack a week ago was deleted.

 

[RMerlin]

My mention of this krack a week ago was deleted.

There were a lot of separate threads at one point, they were mostly merged into this one: https://www.snbforums.com/threads/wpa2-vulnerability-exposed.41678/

It's possible that your post was among those Tim accidentally lost while cleaning up duplicate threads (see his post in that thread).

 

[pege63]

RETAIL
Please see the list of countries where purchase through retail is possible below;

ALL COUNTRIES

• MOVINGWIFI (BASED IN UK)

 

[sm00thpapa]

eero has been patched since 17 Oct. A company that is on top of their products.

 

[Morac]

Seems like a lot of companies are confused about the flaw. Chamberlain claimed their products weren’t affected because all their traffic is encrypted. It’s my understanding is that doesn’t completely mitigate the flaw, it just means traffic can’t easily be sniffed.

 

[joegreat]

Seems like a lot of companies are confused about the flaw. Chamberlain claimed their products weren’t affected because all their traffic is encrypted.

If all traffic is encrypted on top of the WPA2 WLAN communication (like having only https communication) you are fine.

Update: SSL can also be attacked... ...but this is a different attack!
Still you are not effected by the KRACK attack as the hacker might be able to hack WPA2, but not SSL to read your data... ...hopefully!

 

[sfx2000]

If all traffic is encrypted on top of the WPA2 WLAN communication (like having only https communication) you are fine.

Erm... not really - HTTPs can be attacked as well - sslstrip is but one example...

 

[RMerlin]

Erm... not really - HTTPs can be attacked as well - sslstrip is but one example...

...and that's until the next Heartbleed occurs...

 

[sfx2000]

...and that's until the next Heartbleed occurs...

yep

 

[Morac]

If all traffic is encrypted on top of the WPA2 WLAN communication (like having only https communication) you are fine.

Update: SSL can also be attacked... ...but this is a different attack!
Still you are not effected by the KRACK attack as the hacker might be able to hack WPA2, but not SSL to read your data... ...hopefully!

Technically even if all client/server traffic is encrypted can't network traffic like broadcast messages, UPNP, etc still be intercepted?