What You Need To Know About KRACK WPA2 Wi-Fi Attack

The Internet has been blowing up in the past week about the KRACK WPA2 attack that is extremely widespread and is a flaw in the Wi-Fi standard itself, not the implementation. It’s a flaw in the 4 way handshake for WP2 compromised by a Key Reinstallation Attack.

This means any device that has correctly implemented WPA2 is likely affected (so basically everything that has Wi-Fi capability) – this includes Android, Linux, Apple, Windows, OpenBSD and more.

Android 6 is especially vulnerable to this, and be aware the flaw is on both sides (client and access point) and both need to be patched.

An attacker within range of a victim can exploit these weaknesses using key reinstallation attacks (KRACKs). Concretely, attackers can use this novel attack technique to read information that was previously assumed to be safely encrypted. This can be abused to steal sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on. The attack works against all modern protected Wi-Fi networks. Depending on the network configuration, it is also possible to inject and manipulate data. For example, an attacker might be able to inject ransomware or other malware into websites.

The weaknesses are in the Wi-Fi standard itself, and not in individual products or implementations. Therefore, any correct implementation of WPA2 is likely affected. To prevent the attack, users must update affected products as soon as security updates become available. Note that if your device supports Wi-Fi, it is most likely affected.

From – https://www.krackattacks.com/

If you’re using a router that supports an alternative OS like DD-WRT, LEDE/OpenWRT or something open like MikroTik – they already have patches available.

We are using Ubiquiti gear and they came out with the patches super fast, we do have some Ruckus gear and they have an interesting post about it if you’re using the Mesh type network you’re pretty safe.

Which is good news since the last time we wrote about them, it wasn’t great – Ubiquiti Wi-Fi Gear Hackable Via 1997 PHP Version.

There’s a great list of what has been patched against KRACK WPA2 attack and what hasn’t here (regularly updated):

WiFi is broken – here’s the companies that have already fixed it

It kinda feels like the time when we all ran to abandon WEP for WPA2, but it’s not that straightforward and also it can be patched in a backwards compatible manner – which is fortunate.

The unfortunate part is all the devices that are NOT going to get patched (especially IoT devices, security cams, embedded systems etc).

The challenges also go beyond the mere availability of a patch. Take Netgear. To its credit, the company made fixes available for a dozen of its router models the day that Krack went public. But it makes over 1200 products, each of which needs to be tested for specific Krack impact. In many cases, Netgear also can’t make those fixes alone; it needs its chipset partners to tackle the issue as well.

And when those patches do become available, the company has limited ways to inform customers they need to update as soon as possible. It sends emails to those who register their products, and sends out an advisory, and posts in community forums. The remainder of Netgear customers—the bulk of them—will have to read a news report like this one, and hunt down the right download link to install the fix. And even if they do that, the actual patching process requires logging into Netgear’s access point web-management interface from your computer, which may rightly baffle a number of router owners.
“I wouldn’t claim that anyone can just do it,” says Netgear CIO Tejas Shah. “We recognize the need to educate the customer and help the customer when they’re faced with this problem.”

Those issues aren’t unique to Netgear, which, again, gets a star for making patches immediately available. But they do underscore just how ill-prepared wireless devices are for this kind of industry-wide calamity.

And that’s just routers, which people by and large are at least aware connect to the internet. IoT devices are a whole extra level of opaque.

Source: Wired

For the average user, they aren’t going to know what WPA2 is and that their fridge is using it to communicate to the Internet for patches and that’s it’s now vulnerable to the KRACK WPA2 Wi-Fi Attack.

And using SSL does help, but it doesn’t really stop KRACK being a serious issue.

For the moment it seems the code needed to execute the attack isn’t in the wild, and probably won’t be. But honestly, it won’t take long for the bad guys to get hold of the patches that fix the issue, reverse engineer them and figure out how to code an exploit around the flaw.

Patch your devices as soon as the fix comes out, and try and educate those around you as best you can. I’m not sure if this will turn into something serious or not yet, as it’s a pretty technical attack.

It’s also a very scary attack as the malicious actor doesn’t even need to join the network, they just need to be in signal range.

We will have to wait and see if this blows up, or just blows over like most things.

New Android Malware Found in Minecraft Apps on Google Play

A new, “highly prevalent” strain of Android malware was found infecting several Minecraft-related apps on the Google Play store, adding compromised devices into a botnet.According to security researchers at Symantec, at least eight mobile apps – with an install base ranging from 600,000 to 2.6 million devices – were infected with Sockbot.“The legitimate purpose of the apps is to modify the look of the characters in Minecraft: Pocket Edition (PE). [However], in the background, sophisticated and well-disguised attacking functionality is enabled,” explained Shaun Aimoto, Principal SQA Engineer at Symantec, in a blog post.From their analysis, researchers believe the malware aims to generate illegitimate ad revenue. Aimoto further explains:“The app connects to a command and control (C&C) server on port 9001 to receive commands. The C&C server requests that the app open a socket using SOCKS and wait for a connection from a specified IP address on a specified port. A connection arrives from the specified IP address on the specified port, and a command to connect to a target server is issued. The app connects to the requested target server and receives a list of ads and associated metadata (ad type, screen size name). Using this same SOCKS proxy mechanism, the app is commanded to connect to an ad server and launch ad requests.”

Furthermore, researchers warn this “highly flexible proxy topology” could easily be leveraged to exploit numerous network-based vulnerabilities, as well as launch distributed denial of service (DDoS) attacks.Researchers noted that the malware appears to primarily target users in the United States, but also has a presence in Russia, Ukraine, Brazil and Germany.Google Play was notified of the malicious apps earlier this month and has since removed them from the app store.As always, users are recommended to keep their software up-to-date, avoid downloading apps from unfamiliar sites, and pay close attention to the permissions requested by an app.