Posted October 15, 2017 According to Mathy Vanhoef and Frank Piessens at Katholieke Universiteit Leuven in Belgium several core elements in WPA2 has been cracked. Source (In Swedish): https://kryptera.se/wpa2-har-blivit-knackt/ Source (Google translate): https://translate.google.com/translate?sl=sv&tl=en&js=y&prev=_t&hl=sv&ie=UTF-8&u=https%3A%2F%2Fkryptera.se%2Fwpa2-har-blivit-knackt%2F&edit-text= From Twitter Quote flaw in the 4-way handshake. As I understand it, in many cases, this will be: "Throw your router away and buy a new one." https://twitter.com/Nick_Lowe/status/919527451570638848 I guess this was bound to happen eventually, and it seems like most people will have to buy a new router. This is quite massive and it will be very interesting to see the report tomorrow. UPDATE! The paper has now been released: https://www.krackattacks.com/ WS: 13900K - 128GB - 6.5TB SSD - RTX 3090 24GB - 42" LG OLED C2 - W11 Pro LAPTOP: Lenovo Gaming 3 - 8GB - 512GB SSD - GTX 1650 NAS 1: HP MicroServer Gen8 - 32TB - FreeNAS NAS 2: 10400F - 44TB - FreeNAS Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted October 15, 2017 Does not fit Tech News format. You need to add personal thoughts to your post and possibly some more information from the source. I hope this is as easy as disabling WPA2 rather than buying replacements... Otherwise, my wallet is going to feel pain replacing 5 AP's and two managed switches. Cor Caeruleus Reborn v6 Spoiler CPU: Intel - Core i7-8700K CPU Cooler: be quiet! - PURE ROCK Thermal Compound: Arctic Silver - 5 High-Density Polysynthetic Silver 3.5g Thermal Paste Motherboard: ASRock Z370 Extreme4 Memory: G.Skill TridentZ RGB 2x8GB 3200/14 Storage: Samsung - 850 EVO-Series 500GB 2.5" Solid State Drive Storage: Samsung - 960 EVO 500GB M.2-2280 Solid State Drive Storage: Western Digital - Blue 2TB 3.5" 5400RPM Internal Hard Drive Storage: Western Digital - BLACK SERIES 3TB 3.5" 7200RPM Internal Hard Drive Video Card: EVGA - 970 SSC ACX (1080 is in RMA) Case: Fractal Design - Define R5 w/Window (Black) ATX Mid Tower Case Power Supply: EVGA - SuperNOVA P2 750W with CableMod blue/black Pro Series Optical Drive: LG - WH16NS40 Blu-Ray/DVD/CD Writer Operating System: Microsoft - Windows 10 Pro OEM 64-bit and Linux Mint Serena Keyboard: Logitech - G910 Orion Spectrum RGB Wired Gaming Keyboard Mouse: Logitech - G502 Wired Optical Mouse Headphones: Logitech - G430 7.1 Channel Headset Speakers: Logitech - Z506 155W 5.1ch Speakers Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted October 15, 2017 Author 37 minutes ago, ARikozuM said: Does not fit Tech News format. You need to add personal thoughts to your post and possibly some more information from the source. Added some thoughts, but for now this is the source I got, tomorrow we will have more info when the report will be released. WS: 13900K - 128GB - 6.5TB SSD - RTX 3090 24GB - 42" LG OLED C2 - W11 Pro LAPTOP: Lenovo Gaming 3 - 8GB - 512GB SSD - GTX 1650 NAS 1: HP MicroServer Gen8 - 32TB - FreeNAS NAS 2: 10400F - 44TB - FreeNAS Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted October 15, 2017 From what I can tell with a brief look over the paper, it MIGHT be able to be fixed with a firmware upgrade or code change to the key generation algorithm on the router's side. From reading one of the sections about getting the KEK, depending on what's used by the router itself to generate the key (big or small endians) then it can be a monumental task to get the key. The attack also appears to need TKIP to work, which should have been replaced by AES-256 at this point and using AES might make this attack moot, but I haven't read much more beyond that. Current Network Layout: Current Build Log/PC: Prior Build Log/PC: Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted October 15, 2017 3 minutes ago, Lurick said: From what I can tell with a brief look over the paper, it MIGHT be able to be fixed with a firmware upgrade or code change to the key generation algorithm on the router's side. From reading one of the sections about getting the KEK, depending on what's used by the router itself to generate the key (big or small endians) then it can be a monumental task to get the key. The attack also appears to need TKIP to work, which should have been replaced by AES-256 at this point and using AES might make this attack moot, but I haven't read much more beyond that. you lost me at KEK i guess i will just have to replace my router or update it Want free ram? Get some here: Spoiler https://downloadmoreram.com/ Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted October 15, 2017 Just now, That Minecraft Player said: you lost me at KEK i guess i will just have to replace my router or update it Depends on how old the router is. Not going to say anything yet since I'm still reading and double checking but you might be okay if you can disable TKIP and force AES encryption, or at least I hope that's it Current Network Layout: Current Build Log/PC: Prior Build Log/PC: Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted October 15, 2017 *grins to self as I don't have a home wifi point to begin with* Would a custom firmware be able to ward off such attacks without replacement of hardware? My eyes see the past… My camera lens sees the present… Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted October 15, 2017 3 minutes ago, Zodiark1593 said: *grins to self as I don't have a home wifi point to begin with* Would a custom firmware be able to ward off such attacks without replacement of hardware? Possibly, it would depend on if the routers can handle the change, if a manufacturer will update the code, and if clients won't need an update to work on the new changes. The clients shouldn't need any changes since it's basically how the router generates the initial keys for encryption of traffic, but you never know Current Network Layout: Current Build Log/PC: Prior Build Log/PC: Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted October 15, 2017 Might sound stupid here (probably). But what if you don't broadcast your SSID? Please quote my post, or put @paddy-stone if you want me to respond to you. Spoiler PCs:- Main PC build https://uk.pcpartpicker.com/list/2K6Q7X ASUS x53e - i7 2670QM / Sony BD writer x8 / Win 10, Elemetary OS, Ubuntu/ Samsung 830 SSD Lenovo G50 - 8Gb RAM - Samsung 860 Evo 250GB SSD - DVD writer Displays:- Philips 55 OLED 754 model Panasonic 55" 4k TV LG 29" Ultrawide Philips 24" 1080p monitor as backup Storage/NAS/Servers:- ESXI/test build https://uk.pcpartpicker.com/list/4wyR9G Main Server https://uk.pcpartpicker.com/list/3Qftyk Backup server - HP Proliant Gen 8 4 bay NAS running FreeNAS ZFS striped 3x3TiB WD reds HP ProLiant G6 Server SE316M1 Twin Hex Core Intel Xeon E5645 2.40GHz 48GB RAM Gaming/Tablets etc:- Xbox One S 500GB + 2TB HDD PS4 Nvidia Shield TV Xiaomi/Pocafone F2 pro 8GB/256GB Xiaomi Redmi Note 4 Unused Hardware currently :- 4670K MSI mobo 16GB ram i7 6700K b250 mobo Zotac GTX 1060 6GB Amp! edition Zotac GTX 1050 mini Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted October 15, 2017 huh, this could be pretty bad. all my wifi is running WPA2 security I spent $2500 on building my PC and all i do with it is play no games atm & watch anime at 1080p(finally) watch YT and write essays... nothing, it just sits there collecting dust... Builds: The Toaster Project! Northern Bee! The original LAN PC build log! (Old, dead and replaced by The Toaster Project & 5.0) Spoiler "Here is some advice that might have gotten lost somewhere along the way in your life. #1. Treat others as you would like to be treated. #2. It's best to keep your mouth shut; and appear to be stupid, rather than open it and remove all doubt. #3. There is nothing "wrong" with being wrong. Learning from a mistake can be more valuable than not making one in the first place. Follow these simple rules in life, and I promise you, things magically get easier. " - MageTank 31-10-2016 Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted October 15, 2017 3 minutes ago, paddy-stone said: Might sound stupid here (probably). But what if you don't broadcast your SSID? Just a minor nuisance for people who would actively look to attack a wireless network. It still broadcasts out, it just can't be seen by some consumer devices and script kiddies or idiots looking for a "lul" Current Network Layout: Current Build Log/PC: Prior Build Log/PC: Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted October 15, 2017 29 minutes ago, paddy-stone said: Might sound stupid here (probably). But what if you don't broadcast your SSID? Super easy to get a "hidden" SSID. I havent read the article but wpa2 has been "cracked" years ago exploiting 4 way handshake so this is either super old or a different method. Edit: looks like it might actually be new. Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted October 15, 2017 Just now, Lurick said: Just a minor nuisance for people who would actively look to attack a wireless network. It still broadcasts out, it just can't be seen by some consumer devices Ahh yeah, if it's a focused attack then yeah I kinda knew that you could have better equipment to see those. I meant more so as a stop-gap to prevent drive-by attacks/circumstancial. I'm only using AES on my wifi networks anyway, so if it's only for TKIP I'm OK. 1 minute ago, JAKEBAB said: Super easy to get a "hidden" SSID. Yes I am running mine like that now. I meant would it stop these attacks from passers-by basically Please quote my post, or put @paddy-stone if you want me to respond to you. Spoiler PCs:- Main PC build https://uk.pcpartpicker.com/list/2K6Q7X ASUS x53e - i7 2670QM / Sony BD writer x8 / Win 10, Elemetary OS, Ubuntu/ Samsung 830 SSD Lenovo G50 - 8Gb RAM - Samsung 860 Evo 250GB SSD - DVD writer Displays:- Philips 55 OLED 754 model Panasonic 55" 4k TV LG 29" Ultrawide Philips 24" 1080p monitor as backup Storage/NAS/Servers:- ESXI/test build https://uk.pcpartpicker.com/list/4wyR9G Main Server https://uk.pcpartpicker.com/list/3Qftyk Backup server - HP Proliant Gen 8 4 bay NAS running FreeNAS ZFS striped 3x3TiB WD reds HP ProLiant G6 Server SE316M1 Twin Hex Core Intel Xeon E5645 2.40GHz 48GB RAM Gaming/Tablets etc:- Xbox One S 500GB + 2TB HDD PS4 Nvidia Shield TV Xiaomi/Pocafone F2 pro 8GB/256GB Xiaomi Redmi Note 4 Unused Hardware currently :- 4670K MSI mobo 16GB ram i7 6700K b250 mobo Zotac GTX 1060 6GB Amp! edition Zotac GTX 1050 mini Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted October 15, 2017 Will be interesting to see what gets announced tomorrow. We have next to no info about how the attack works, but judging by the abstract removing support for RC4 might fix it. I don't know what the spec says, but using separate keys for unicast traffic vs broadcast/multicast traffic might solve the issue too. Apparently Meraki has pushed out a vague update to their access points which some speculate is a fix for this issue. Gonna try and find the bugfix in the change log and see what it says. Edit: I can't find where to check older firmware change logs. Does anyone know? I can only see the change logs of yet-to-be-installed firmware. 26 minutes ago, paddy-stone said: Might sound stupid here (probably). But what if you don't broadcast your SSID? Doesn't help. I recommend you turn on your SSID again if you have it hidden. Your clients will leak the SSID anyway. It really adds no extra protection whatsoever. In the worst case scenario it might actually reduce security because your device might be sending out your SSID even when you are not in range. So if you take your laptop to school it might be broadcasting your home WiFi name for everyone at your school to see. Edit: Links to related vulnerabilities so that people can find them easily tomorrow: CVE-2017-13077 | CVE-2017-13078 CVE-2017-13079 | CVE-2017-13080 CVE-2017-13081 | CVE-2017-13082 CVE-2017-13084 | CVE-2017-13086 CVE-2017-13087 | CVE-2017-13088 Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted October 15, 2017 1 minute ago, LAwLz said: Will be interesting to see what gets announced tomorrow. We have next to no info about how the attack works, but judging by the abstract removing support for RC4 might fix it. I don't know what the spec says, but using separate keys for unicast traffic vs broadcast/multicast traffic might solve the issue too. Apparently Meraki has pushed out a vague update to their access points which some speculate is a fix for this issue. Gonna try and find the bugfix in the change log and see what it says. Doesn't help. I recommend you turn on your SSID again if you have it hidden. Your clients will leak the SSID anyway. It really adds no extra protection whatsoever. In the worst case scenario it might actually reduce security because your device might be sending out your SSID even when you are not in range. So if you take your laptop to school it might be broadcasting your home WiFi name for everyone at your school to see. Don't go to school at my age fortunately, lol. Anyone else that has access to my hidden wifi turns the wifi off when they leave the house.. all others go on my guest wifi. I know it's not a fix, just was saying that "hey it might be better than broadcasting". Hopefully there'll be a fix for the crack anyway. But I live a bit off the beaten path anyway, so unless someone's actively targetting my home shouldn't be too much danger, I hope. Please quote my post, or put @paddy-stone if you want me to respond to you. Spoiler PCs:- Main PC build https://uk.pcpartpicker.com/list/2K6Q7X ASUS x53e - i7 2670QM / Sony BD writer x8 / Win 10, Elemetary OS, Ubuntu/ Samsung 830 SSD Lenovo G50 - 8Gb RAM - Samsung 860 Evo 250GB SSD - DVD writer Displays:- Philips 55 OLED 754 model Panasonic 55" 4k TV LG 29" Ultrawide Philips 24" 1080p monitor as backup Storage/NAS/Servers:- ESXI/test build https://uk.pcpartpicker.com/list/4wyR9G Main Server https://uk.pcpartpicker.com/list/3Qftyk Backup server - HP Proliant Gen 8 4 bay NAS running FreeNAS ZFS striped 3x3TiB WD reds HP ProLiant G6 Server SE316M1 Twin Hex Core Intel Xeon E5645 2.40GHz 48GB RAM Gaming/Tablets etc:- Xbox One S 500GB + 2TB HDD PS4 Nvidia Shield TV Xiaomi/Pocafone F2 pro 8GB/256GB Xiaomi Redmi Note 4 Unused Hardware currently :- 4670K MSI mobo 16GB ram i7 6700K b250 mobo Zotac GTX 1060 6GB Amp! edition Zotac GTX 1050 mini Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted October 15, 2017 13 minutes ago, paddy-stone said: Ahh yeah, if it's a focused attack then yeah I kinda knew that you could have better equipment to see those. I meant more so as a stop-gap to prevent drive-by attacks/circumstancial. I'm only using AES on my wifi networks anyway, so if it's only for TKIP I'm OK. Yes I am running mine like that now. I meant would it stop these attacks from passers-by basically No it will do nothing. If your scanning for networks, every ssid will show regardless if its "hidden" or not. Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted October 15, 2017 38 minutes ago, Lurick said: The attack also appears to need TKIP to work, which should have been replaced by AES-256 at this point and using AES might make this attack moot, but I haven't read much more beyond that. Apparently not? MOAR COARS: 5GHz "Confirmed" Black Edition™ The Build AMD 5950X 4.7/4.6GHz All Core Dynamic OC + 1900MHz FCLK | 5GHz+ PBO | ASUS X570 Dark Hero | 32 GB 3800MHz 14-15-15-30-48-1T GDM 8GBx4 | PowerColor AMD Radeon 6900 XT Liquid Devil @ 2700MHz Core + 2130MHz Mem | 2x 480mm Rad | 8x Blacknoise Noiseblocker NB-eLoop B12-PS Black Edition 120mm PWM | Thermaltake Core P5 TG Ti + Additional 3D Printed Rad Mount Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted October 15, 2017 26 minutes ago, Lurick said: Depends on how old the router is Well, with some luck D-Link will push an update for mine. It's been a while (and yes, I'm on the latest version) Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted October 15, 2017 Can't remember how old my router is but it doesn't have wifi so not sure if this affects me or not and I got it a bit before borderlands was released, so 8 years+ so it probably has multiple issues I'm unaware of anyway. Regardless if I need to replace it I'll make one essentially to avoid these potential issues down the line. https://linustechtips.com/main/topic/631048-psu-tier-list-updated/ Tier Breakdown (My understanding)--1 Godly, 2 Great, 3 Good, 4 Average, 5 Meh, 6 Bad, 7 Awful Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted October 16, 2017 4 hours ago, Lurick said: The attack also appears to need TKIP to work Haven't most people in the security industry recommended to not use TKIP for a few years now? I thought flaws with it were already discovered, or at least theorized. Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted October 16, 2017 So... how's that WPA3 work coming along? Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted October 16, 2017 took way too long. had to buy wifi ...... -.- Folding stats Vigilo Confido Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted October 16, 2017 This is going to cause businesses problems and security weaknesses for years to come Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted October 16, 2017 This can indeed be fixed via a firmware update, as my wireless AP had an update to fix this very handshake issue. Proof: Do you even fanboy bro? Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted October 16, 2017 MAC FILTERING ON. SEPARATED VLAN ON. Still only would able to access my wireless network unless i have made firewall pinhole for certain mac addresses. Magical Pineapples
