WPA2 - Broken

[digip]

WPA2 is bypassed with MITM attack against Linux and Android devices.

 

[Just_a_User]

Some good reading

http://www.theregister.co.uk/2017/10/16/wpa2_inscure_krackattack/

https://www.blackhat.com/docs/webcast/08242017-securely-implementing-network2.pdf

https://github.com/vanhoefm/blackhat17-pocs

[digip]

https://www.krackattacks.com/

[Just_a_User]

5 minutes ago, digip said:

https://www.krackattacks.com/

Even better! thanks for sharing

[UnLo]

I was wondering while reading this morning if anyone here had posted yet. You don't disappoint! 

[Michael Weinstein]

Sample code! https://pastebin.com/aZyyS16w

[Zylla]

Awesome!

[LivingDodo]

Waiting to see this on the Hak5 devices :)

[Rkiver]

I know Seb said he is looking into it, and Patrick mentioned it on DTNS yesterday too. I am looking forward to seeing what comes now in new firmwares.

[Just_a_User]

Really nice break down of the mechanics of the attack. This guy is great to watch anyway.

 

[PoSHMagiC0de]

I like LiveOverflow's videos too.  His videos are the ones to watch if you want to get into the binary side of things.

[Just_a_User]

AP vuln test script released - as it was already leaked. https://github.com/vanhoefm/krackattacks-test-ap-ft

[10:41:56] AP transmitted data using IV=1 (seq=3757)
[10:41:56] AP transmitted data using IV=1 (seq=3757)
[10:41:56] IV reuse detected (IV=1, seq=3757). AP is vulnerable!
[10:41:56] AP transmitted data using IV=2 (seq=3772)

My main router is vulnerable :(

Edited October 19, 2017 by Just_a_User

[connorboucher]

WPA3 Confirmed? (I hope not ;-;)

[digip]

On 10/27/2017 at 5:25 PM, connorboucher said:

WPA3 Confirmed? (I hope not ;-;)

WPA3 is not even a thing yet. There is no new standard, as far as I know, that supersedes WPA2 and WPA2 Enterprise.

[Dave-ee Jones]

13 hours ago, digip said:

WPA3 is not even a thing yet. There is no new standard, as far as I know, that supersedes WPA2 and WPA2 Enterprise.

Correct-a-mundo.

I think it's a near-top-priority right now for WiFi Security engineers, but as to when there will be a superseding security method..I know not. Could be that they ditch passwords altogether and use a certificate-like authentication, but that means it needs to be secure against certificate spoofing.

[digip]

16 hours ago, Dave-ee Jones said:

Correct-a-mundo.

I think it's a near-top-priority right now for WiFi Security engineers, but as to when there will be a superseding security method..I know not. Could be that they ditch passwords altogether and use a certificate-like authentication, but that means it needs to be secure against certificate spoofing.

How do you issue certs to each device, and what devices will inherently be able to support it in this manner. This being the age of TV's, game consoles and DVD players all being WPA2 compliant now, I think you would ultimately kill a huge trunk of the user base, if you suddenly go to a new standard, vs patching the existing model to keep legacy devices working.

[Just_a_User]

Interesting

https://github.com/kukulo2011/Openwrt_CC_Krack_wpad-mini

[digip]

26 minutes ago, Just_a_User said:

Interesting

https://github.com/kukulo2011/Openwrt_CC_Krack_wpad-mini

I'd suggest getting patches from official sources, but that's just me.

[Just_a_User]

13 minutes ago, digip said:

I'd suggest getting patches from official sources, but that's just me.

Are there official ones released? I prob missed them

Edited November 6, 2017 by Just_a_User

[digip]

OpenWRT is an alternative to most linksys devices. What is the device it goes on, the manufacturer? Either that, or go to the OpenWRT site, get official 3rd party firmware, which I'm sure at some point, the OpenWRT community will patch. Unless the git repo is one of the developers for OpenWRT(I don't know them), then I would probably avoid randomly found patches. I mean, it could be legit patched, but I'm a bit more cautious when it comes to some things. Especially when I don't see the code used in them, although you could unzip all the way down to the IPK and unzip them as well, I wouldn't know where to look specifically for changes that fix this issue. They apparently have their own GIT repo as well - http://git.openwrt.org/?p=15.05/openwrt.git;a=commit;h=acfb6c2181b1589e5b2d0d121180bcc7d62d37d4

Edited November 7, 2017 by digip

[Just_a_User]

OK cool, thanks

[kukulo]

I added the code reference for the wpad-mini package on github. https://github.com/kukulo2011/Openwrt_CC_Krack_wpad-mini

If  you are too afraid to install, you can still build a single package according to Openwrt wiki or wait for an official update.

The build of the wpad-mini took me around 1 hour on core i5 running ubuntu. Pushing and updating the router took 5 mins.

[Just_a_User]