New Wi-Fi hack discovered

  • Thread starter jtbell
  • Start date

Answers and Replies

  • #2
onoturtle
46
13
Makes me wish I was still using an iPhone. I just switched to an Android phone and I hear those take time to get patched due to extra QA hoops. Google -> phone manufacturer -> cell carrier? So it sounds like Android devices will be the most vulnerable.
 
  • #3
Here's the paper describing the vulnerability in detail https://papers.mathyvanhoef.com/ccs2017.pdf.

It appears that under the WPA2 protocol, the client can be tricked into reinstalling a known network key by an attacker retransmitting the third message of WPA2's 4-way handshake. It is especially bad for linux devices since linux clears the key in ram after it is installed. If the attacker coaxes linux to re-install the key, it will install the cleared memory (which is all zeros) as the new key.
 
  • #4
ISamson
Gold Member
440
162
Would it be possible to hack it using Arduino? :smile:
 
  • #5
36,167
13,154
Use https. If websites don't offer that, bug the owners until they do.

Relying on Wifi security was never a good idea - even if the wireless connection is secure, it still means the owner of the router and every computer transferring the data over the internet can read everything if there is no encryption of the web traffic. Add the various exploits that can make the phone/laptop connect to the wrong router and you shouldn't rely on Wifi security anyway.
 
  • Like
Likes QuantumQuest, Vanadium 50 and ISamson
  • #7
Vanadium 50
Staff Emeritus
Science Advisor
Education Advisor
2021 Award
29,181
14,425
Use https.

This. Even with the best Wifi security, you have no idea what is listening on your traffic once it leaves the router. Who knows what is hooked up to the network in the back room of the Starbucks? You should behave as if everything on the network is insecure, and that means taking precautions.
 
  • Like
Likes QuantumQuest
  • #8
18,834
9,018
Use https. If websites don't offer that, bug the owners until they do.
Depends what you are doing. If you are reading news at WaPo what difference does HTTPS make? Even HTTPS has different security levels. I had to renew PF's certificate weeks after buying it because Google flagged it for using SHA-1 instead of SHA-2.
 
  • #9
Routaran
447
94
It's not as bad as it sounds. wpa_supplicant on linux was patched on the same day the information was released. On an unpatched system, this attack can be used to capture and view data being sent from the client to the access point.
For example: The attacker can see that your system made a dns request for google.com but it doesn't know what was sent back.

The problem is mobile. I don't know how quickly android vendors will provide patches to fix your phone/tablet.

If you are using websites that have https correctly configured with HSTS and a browser that supports it, then you shouldn't be at risk. The problem is when websites don't, then a MITM attack can take place using a rogue access point and tools like sslstrip. But people won't be able to steal your gmail or facebook login credentials as your browser will warn you that you are using HTTP on a site that should always use HTTPS

It will be obvious. An error that looks like this:
hqdefault.jpg


Yeah it's bad but as an end user, you can still do a lot on your end to mitigate risk and safeguard your information.
 
  • Like
Likes QuantumQuest
  • #11
Thanks god to the fast updates for Linux users, in the next day, try it
 

Suggested for: New Wi-Fi hack discovered

  • Last Post
Replies
14
Views
743
  • Last Post
Replies
13
Views
1K
Replies
10
Views
456
Replies
4
Views
732
  • Last Post
Replies
30
Views
1K
Replies
16
Views
720
Replies
1
Views
383
Replies
15
Views
358
  • Last Post
Replies
3
Views
518
Top