Has a New Wi-Fi Hack Been Discovered in the WPA2 Security Protocol?

[jtbell]

Specifically, in the WPA2 security protocol. Watch for updates to client (phone, computer, etc.) system software that patches this.

'All wifi networks' are vulnerable to hacking, security expert discovers (The Guardian)

 

[onoturtle]

Makes me wish I was still using an iPhone. I just switched to an Android phone and I hear those take time to get patched due to extra QA hoops. Google -> phone manufacturer -> cell carrier? So it sounds like Android devices will be the most vulnerable.

 

[NFuller]

Here's the paper describing the vulnerability in detail https://papers.mathyvanhoef.com/ccs2017.pdf.

It appears that under the WPA2 protocol, the client can be tricked into reinstalling a known network key by an attacker retransmitting the third message of WPA2's 4-way handshake. It is especially bad for linux devices since linux clears the key in ram after it is installed. If the attacker coaxes linux to re-install the key, it will install the cleared memory (which is all zeros) as the new key.

 

[ISamson]

Would it be possible to hack it using Arduino?

 

[mfb]

Use https. If websites don't offer that, bug the owners until they do.

Relying on Wifi security was never a good idea - even if the wireless connection is secure, it still means the owner of the router and every computer transferring the data over the internet can read everything if there is no encryption of the web traffic. Add the various exploits that can make the phone/laptop connect to the wrong router and you shouldn't rely on Wifi security anyway.

 

[Greg Bernhardt]

Update Windows, they have a fix
https://www.engadget.com/2017/10/16/microsoft-already-has-krack-attack-wifi-fix/

 

[Vanadium 50]

Use https.

This. Even with the best Wifi security, you have no idea what is listening on your traffic once it leaves the router. Who knows what is hooked up to the network in the back room of the Starbucks? You should behave as if everything on the network is insecure, and that means taking precautions.

 

[Greg Bernhardt]

Use https. If websites don't offer that, bug the owners until they do.

Depends what you are doing. If you are reading news at WaPo what difference does HTTPS make? Even HTTPS has different security levels. I had to renew PF's certificate weeks after buying it because Google flagged it for using SHA-1 instead of SHA-2.

 

[Routaran]

It's not as bad as it sounds. wpa_supplicant on linux was patched on the same day the information was released. On an unpatched system, this attack can be used to capture and view data being sent from the client to the access point.
For example: The attacker can see that your system made a dns request for google.com but it doesn't know what was sent back.

The problem is mobile. I don't know how quickly android vendors will provide patches to fix your phone/tablet.

If you are using websites that have https correctly configured with HSTS and a browser that supports it, then you shouldn't be at risk. The problem is when websites don't, then a MITM attack can take place using a rogue access point and tools like sslstrip. But people won't be able to steal your gmail or facebook login credentials as your browser will warn you that you are using HTTP on a site that should always use HTTPS

It will be obvious. An error that looks like this:

Yeah it's bad but as an end user, you can still do a lot on your end to mitigate risk and safeguard your information.

 

[mfb]

If you are reading news at WaPo what difference does HTTPS make?

Not much, but then the wifi encryption is not important either.

 

[Gandes]

Thanks god to the fast updates for Linux users, in the next day, try it