Looks like WPA2 have been cracked


It isn't a serious bug unless it has a name, tag line and a logo :)
 
Was not it possible in the past with some tools? I remember a distro named Wifi Slax of something like that.
 
Most vulnerabilities apply to the client, so updating the clients is the most important. With that, any ideas how to deal with this on pandora? Pandora is currently using wpa_supplicant 2.2, while the patches were only published for 2.6 and dev version, so probably have to upgrade wpa_supplicant and hope that it still works with old dbus and NetworkManager. The site claims wpa_supplicant 2.4 has the worst bug (zeroing the key), so maybe 2.2 isn't affected so bad?
 
There's very little point in using WEP - you may as well put up on open access point and at least be a friend to your neighbours. It's so trivially easy to break, that I doubt it would be any protection in court against someone unauthorised using your wifi to do something illegal (and it gets tracked back to your wifi).

It seems that while the bug is in the standards, Windows and MacOS engineers didn't read the literal spec properly, and accidentally mitigated the impact this bug has on those platforms. How secure wpa_supplicant 2.2 is I don't really understand yet, and it'll probably take until exploit code is released before we can test it properly. The stuff I've been reading recently talks about nonce reuse, but I've also heard about this resetting the key to 0 - presumably that's a different CVE.
[doublepost=1508286840,1508262728][/doublepost]The latest computerphile video is about this attack:

They seem to suggest it's about the counter getting reset to the nonce value, but I note one of them asks the other what would happen if the encryption key was zeroed, so that may be something else that's going on somehow. But it does sound like the thing that wpa_supplement gets right that makes it go wrong is this nonce reuse.
 
Hmm, none of those description scream setting anything to zero to me.

Anyway, it seems like Debian have made a patch to 2.3 for Jessie. @notaz would that be of any more use as an upgrade path for the Pandora?

On Arch it seems I'm on v2.6. There was a patch that got released two days ago which was quick work if it does fix these holes.
 
Back
Top