WPA2 has been cracked

[Dylanc1500]

7 minutes ago, kingfurykiller said:

This is true.  My experiences were the unfortunate exceptions; the application I was working with required outside communication.

Well I deeply apologize on behalf of those systems lol. What OS was it if you don't mind me asking?

[deltron3030]

17 minutes ago, Swatson said:

Now's the point when I ragret buying a TP-Link router. Doubtful I'll get a firmware update. It was a good price (even for TP-Link), I couldn't resist.....

Ditto. Last FW update is over a year old for my router.

[Donut417]

18 hours ago, Lurick said:

The attack also appears to need TKIP to work, which should have been replaced by AES-256 at this point

While this is true. Older devices dont support AES. For instance the PS3 I have connected to my network. I use it mostly for blu ray play back. I guess, it wont have a network connection from now on. 

[AnonymousGuy]

1 hour ago, Swatson said:

Now's the point when I ragret buying a TP-Link router. Doubtful I'll get a firmware update. It was a good price (even for TP-Link), I couldn't resist.....

Synology's router is crushing every other router I've ever used (Asus + Linksys).  They push out updates every 3-4 weeks and have an actual pro-level UI.

[Donut417]

21 minutes ago, AnonymousGuy said:

Synology's router is crushing every other router I've ever used (Asus + Linksys).  They push out updates every 3-4 weeks and have an actual pro-level UI.

Good thing your mentioned this. I just checked DDWRT's website for a new firmware. Seems the latest is September. I hope they release a new one quickly. 

[vanished]

This is very big news.  I remember back when people were realizing that WEP was no longer viable, other options (WPA) were already available so it wasn't a huge deal, you just had to use that instead.  But WPA2 is still the best option afaik so this basically means wireless is unsafe until the next thing comes out.  I also wonder how many devices will be able to be updated to support the new thing, whatever and whenever it is.  I suspect things like phones probably will get the update but I wouldn't be so sure about most routers.

[S w a t s o n]

1 hour ago, Donut417 said:

While this is true. Older devices dont support AES. For instance the PS3 I have connected to my network. I use it mostly for blu ray play back. I guess, it wont have a network connection from now on. 

No it's not true, the TKIP is a lie. It affects WPA2 as a whole.

49 minutes ago, AnonymousGuy said:

Synology's router is crushing every other router I've ever used (Asus + Linksys).  They push out updates every 3-4 weeks and have an actual pro-level UI.

 

Let me know when Synology is cheap.

 

[kingfurykiller]

1 hour ago, Dylanc1500 said:

Well I deeply apologize on behalf of those systems lol. What OS was it if you don't mind me asking?

Haha no apologies necessary. Fault lay with localized admins.

 

The OS's we're Windows XP and 98; the application I was working with was a proprietary piece of patient tracking software that the company I worked for developed and configured.

 

Really amazing piece of software. Significantly less amazing company.

[LAwLz]

6 minutes ago, Ryan_Vickers said:

This is very big news.  I remember back when people were realizing that WEP was no longer viable, other options (WPA) were already available so it wasn't a huge deal, you just had to use that instead.  But WPA2 is still the best option afaik so this basically means wireless is unsafe until the next thing comes out.  I also wonder how many devices will be able to be updated to support the new thing, whatever and whenever it is.  I suspect things like phones probably will get the update but I wouldn't be so sure about most routers.

There is no need to develop WPA3 or whatever it would be called.

WPA2 will be safe as soon as patches are released (a lot of vendors are already releasing patches).

It could have been a catastrophe, but luckily for us WPA2 will remain safe.

[deltron3030]

1 minute ago, Ryan_Vickers said:

This is very big news.  I remember back when people were realizing that WEP was no longer viable, other options (WPA) were already available so it wasn't a huge deal, you just had to use that instead.  But WPA2 is still the best option afaik so this basically means wireless is unsafe until the next thing comes out.  I also wonder how many devices will be able to be updated to support the new thing, whatever and whenever it is.  I suspect things like phones probably will get the update but I wouldn't be so sure about most routers.

So if my router is unlikely to provide updates, my only option is to buy a new router if I want to use wifi?

This sounds like a huge vulnerability, but how likely are you going to be affected by this though? I remember there being a huge vulnerability in android not too long ago, but it seemed like there was a low chance of it happening because how difficult it looked.

[Dylanc1500]

2 minutes ago, kingfurykiller said:

Haha no apologies necessary. Fault lay with localized admins.

 

The OS's we're Windows XP and 98; the application I was working with was a proprietary piece of patient tracking software that the company I worked for developed and configured.

 

Really amazing piece of software. Significantly less amazing company.

Honestly I have seen numerous systems still running 9x. Especially in the financial sector. Heck I couldn't tell you the amount of account systems still running 16bit software.

[ScratchCat]

First Bluetooth and now WPA2, better invest in a faraday cage.

 

So repeatedly sending this Step 3 of the handshake causes a stream cipher to be effectively turned into an electronic code book cipher ?

So theoretically one could monitor for a large number of handshake packets , once detected one knows that someone is attempting the attack.

This could be especially worrying as unlike most attacks on WPA2 such as the handshake capture does not require as

much computing power. This would mean one could place a bunch of raspberry pi zeros  or ESPs with wifi in monitor mode and simply repeat the attack and collect the packets encoded with an ECB method.

[Silentprototipe]

Well shit, Update everything? 

[vanished]

36 minutes ago, LAwLz said:

There is no need to develop WPA3 or whatever it would be called.

WPA2 will be safe as soon as patches are released (a lot of vendors are already releasing patches).

It could have been a catastrophe, but luckily for us WPA2 will remain safe.

It seems to me this still has the issue of updates that I mentioned though: some devices will be slow to get them, and some may never get them.

[ScratchCat]

4 minutes ago, Ryan_Vickers said:

It seems to me this still has the issue of updates that I mentioned though: some devices will be slow to get them, and some may never get them.

Given the security of virtually all IoT devices none will be getting any updates and nor will most routers no longer supported by the manufacturer (read anything but the latest model for most ISP routers ). Not to mention the vast number of android phones no longer supported , 14.5% are still running KitKat!

Thankfully only one side must be patched, not both so either getting a new router / update or updating your devices will fix everything.

[kingfurykiller]

54 minutes ago, Dylanc1500 said:

Honestly I have seen numerous systems still running 9x. Especially in the financial sector. Heck I couldn't tell you the amount of account systems still running 16bit software.

I worked for a company in the financial side of the car business that had a flagship product that ran off of 30 year old code; and it showed.

 

I had heard that developers who had worked a year at that company had a harder time finding a job than devs with no experience.

 

Said company has the largest market share of US car dealerships.

 

Most of their web-based software only supports IE8

 

[leadeater]

4 hours ago, LAwLz said:

Apple - No statement yet but as with Windows, it seems like it is largely unaffected by this.

From what I read iOS, like Windows, had a limited vulnerability to this however Mac OS is one of the most susceptible. 

[vanished]

24 minutes ago, ScratchCat said:

Given the security of virtually all IoT devices none will be getting any updates and nor will most routers no longer supported by the manufacturer (read anything but the latest model for most ISP routers ). Not to mention the vast number of android phones no longer supported , 14.5% are still running KitKat!

Yeah agreed

24 minutes ago, ScratchCat said:

Thankfully only one side must be patched, not both so either getting a new router / update or updating your devices will fix everything.

*informative*

[LtStaffel]

21 hours ago, paddy-stone said:

Might sound stupid here (probably). But what if you don't broadcast your SSID?

easily found

[jagdtigger]

Great, none of my AP's got any update, and only one of them has openwrt support... (both tplink, wa901nd(v3 if my memory serves me correctly) and AP500) I guess its time to look for a new AP....

 

/EDIT

Just gone through all of my wifi equipment. None of them received any updates. Okay, TP-Link added to my black-list....

Edited October 17, 2017 by jagdtigger

[KeitaRR]

Quote

Our main attack is against the 4-way handshake, and does not exploit access points, but instead targets clients. So it might be that your router does not require security updates.

Looks like no new routers needed, just need updates on your devices

[pyconaut]

Here are some of the current articles released by Ars technica, on this issue.  

 

https://arstechnica.com/information-technology/2017/10/crypto-failure-cripples-millions-of-high-security-keys-750k-estonian-ids/

 

https://arstechnica.com/information-technology/2017/10/how-the-krack-attack-destroys-nearly-all-wi-fi-security/

 

This is going to last a long time, as most devices currently use WPA2 as the standard crypto these days, and there are many ways this attack can be used.  Guess we are going back to handing off and shipping encrypted USB drives for a while.  

 

Also a bit of further reading will show this actually also can hurt the security of VPN's, as now closed internet can be opened.

 

https://arstechnica.com/information-technology/2015/06/even-with-a-vpn-open-wi-fi-exposes-users/

 

 

[Donut417]

I do have a question. So I read an article about this earlier. It said that AES encryption was in better shape. That, an attacker could only look at the info transmitting. Would that mean they can read the information, such as if I used my network to access my bank? Or is that information still encrypted? I would assume the bank would use HTTPS which should have some level of encryption on it. Might be time to look for a VPN? Only reason I dont use one, is Netflix is assholes if you use one, plus Im not sure on Sony's policy with PS Vue. 

[LAwLz]

4 minutes ago, pyconaut said:

Also a bit of further reading will show this actually also can hurt the security of VPN's, as now closed internet can be opened.

 

https://arstechnica.com/information-technology/2015/06/even-with-a-vpn-open-wi-fi-exposes-users/

If you use a VPN then everything will still be encrypted. This exploit will strip away the WPA2 encryption, but underneath that you got the IPsec/OpenVPN/whatever encryption from the VPN.

 

There is no need to panic or spread fear.

 

 

1 minute ago, Donut417 said:

I do have a question. So I read an article about this earlier. It said that AES encryption was in better shape. That, an attacker could only look at the info transmitting. Would that mean they can read the information, such as if I used my network to access my bank? Or is that information still encrypted? I would assume the bank would use HTTPS which should have some level of encryption on it. Might be time to look for a VPN? Only reason I dont use one, is Netflix is assholes if you use one, plus Im not sure on Sony's policy with PS Vue. 

No need to worry. Like you said, your bank uses HTTPS and this security hole will only remove the WPA2 encryption.

[paddy-stone]

25 minutes ago, LAwLz said:

If you use a VPN then everything will still be encrypted. This exploit will strip away the WPA2 encryption, but underneath that you got the IPsec/OpenVPN/whatever encryption from the VPN.

 

There is no need to panic or spread fear.

 

 

No need to worry. Like you said, your bank uses HTTPS and this security hole will only remove the WPA2 encryption.

That's good to know. I will be fine then as all my traffic goes through my VPN provider AND I always use https when available too.