New Wi-Fi hack discovered

  • Thread starter jtbell
  • Start date

Answers and Replies

  • #2
46
13
Makes me wish I was still using an iPhone. I just switched to an Android phone and I hear those take time to get patched due to extra QA hoops. Google -> phone manufacturer -> cell carrier? So it sounds like Android devices will be the most vulnerable.
 
  • #3
Here's the paper describing the vulnerability in detail https://papers.mathyvanhoef.com/ccs2017.pdf.

It appears that under the WPA2 protocol, the client can be tricked into reinstalling a known network key by an attacker retransmitting the third message of WPA2's 4-way handshake. It is especially bad for linux devices since linux clears the key in ram after it is installed. If the attacker coaxes linux to re-install the key, it will install the cleared memory (which is all zeros) as the new key.
 
  • #4
ISamson
Gold Member
437
158
Would it be possible to hack it using Arduino? :smile:
 
  • #5
35,514
11,979
Use https. If websites don't offer that, bug the owners until they do.

Relying on Wifi security was never a good idea - even if the wireless connection is secure, it still means the owner of the router and every computer transferring the data over the internet can read everything if there is no encryption of the web traffic. Add the various exploits that can make the phone/laptop connect to the wrong router and you shouldn't rely on Wifi security anyway.
 
  • Like
Likes QuantumQuest, Vanadium 50 and ISamson
  • #7
Vanadium 50
Staff Emeritus
Science Advisor
Education Advisor
27,243
11,232
Use https.

This. Even with the best Wifi security, you have no idea what is listening on your traffic once it leaves the router. Who knows what is hooked up to the network in the back room of the Starbucks? You should behave as if everything on the network is insecure, and that means taking precautions.
 
  • Like
Likes QuantumQuest
  • #8
18,490
8,355
Use https. If websites don't offer that, bug the owners until they do.
Depends what you are doing. If you are reading news at WaPo what difference does HTTPS make? Even HTTPS has different security levels. I had to renew PF's certificate weeks after buying it because Google flagged it for using SHA-1 instead of SHA-2.
 
  • #9
447
94
It's not as bad as it sounds. wpa_supplicant on linux was patched on the same day the information was released. On an unpatched system, this attack can be used to capture and view data being sent from the client to the access point.
For example: The attacker can see that your system made a dns request for google.com but it doesn't know what was sent back.

The problem is mobile. I don't know how quickly android vendors will provide patches to fix your phone/tablet.

If you are using websites that have https correctly configured with HSTS and a browser that supports it, then you shouldn't be at risk. The problem is when websites don't, then a MITM attack can take place using a rogue access point and tools like sslstrip. But people won't be able to steal your gmail or facebook login credentials as your browser will warn you that you are using HTTP on a site that should always use HTTPS

It will be obvious. An error that looks like this:
hqdefault.jpg


Yeah it's bad but as an end user, you can still do a lot on your end to mitigate risk and safeguard your information.
 
  • Like
Likes QuantumQuest
  • #11
Gandes
Thanks god to the fast updates for Linux users, in the next day, try it
 

Related Threads on New Wi-Fi hack discovered

  • Last Post
Replies
5
Views
2K
  • Last Post
Replies
3
Views
6K
  • Last Post
Replies
13
Views
1K
  • Last Post
Replies
1
Views
2K
Replies
9
Views
3K
  • Last Post
2
Replies
29
Views
5K
  • Last Post
2
Replies
42
Views
15K
Replies
14
Views
2K
Replies
3
Views
2K
Top