Looks like WPA2 have been cracked

[Linux-SWAT]

https://www.krackattacks.com/

Seems quite serious.

 

[pmprog]

It isn't a serious bug unless it has a name, tag line and a logo

 

[Xcl4m4t10n]

Was not it possible in the past with some tools? I remember a distro named Wifi Slax of something like that.

 

[Linux-SWAT]

No, it's a brand new flaw.
Huge, also.

The Slashdot article :
https://it.slashdot.org/story/17/10/16/149251/wpa2-security-flaw-puts-almost-every-wi-fi-device-at-risk-of-hijack-eavesdropping

 

[Caine]

Sounds like a death sentence for WPA2.

 

[Linux-SWAT]

No, it's upgradeable/patchable.

 

[levi]

No, it's upgradeable/patchable.

Yes, although I can't find any fixes for at least one of the bugs raised yet. Advice for now is turn off wifi when you're out and about I guess, and watch out for people in cars parked outside your house, I guess.

 

[notaz]

Most vulnerabilities apply to the client, so updating the clients is the most important. With that, any ideas how to deal with this on pandora? Pandora is currently using wpa_supplicant 2.2, while the patches were only published for 2.6 and dev version, so probably have to upgrade wpa_supplicant and hope that it still works with old dbus and NetworkManager. The site claims wpa_supplicant 2.4 has the worst bug (zeroing the key), so maybe 2.2 isn't affected so bad?

 

[WizardStan]

No, it's a brand new flaw.

As I understand it, it's a flaw in the spec itself so is not so much "brand new" as "recently exposed": it's been there the entire time, just no one noticed.

 

[Kippykip]

I'm still using WEP lmao

 

[levi]

There's very little point in using WEP - you may as well put up on open access point and at least be a friend to your neighbours. It's so trivially easy to break, that I doubt it would be any protection in court against someone unauthorised using your wifi to do something illegal (and it gets tracked back to your wifi).

It seems that while the bug is in the standards, Windows and MacOS engineers didn't read the literal spec properly, and accidentally mitigated the impact this bug has on those platforms. How secure wpa_supplicant 2.2 is I don't really understand yet, and it'll probably take until exploit code is released before we can test it properly. The stuff I've been reading recently talks about nonce reuse, but I've also heard about this resetting the key to 0 - presumably that's a different CVE.
[doublepost=1508286840,1508262728][/doublepost]The latest computerphile video is about this attack:

They seem to suggest it's about the counter getting reset to the nonce value, but I note one of them asks the other what would happen if the encryption key was zeroed, so that may be something else that's going on somehow. But it does sound like the thing that wpa_supplement gets right that makes it go wrong is this nonce reuse.

 

[Kippykip]

I only used WEP for my Nintendo DS, I might switch to WPA1 at some point

 

[Magic Sam]

Hi all

@levi : Debian has some nice info regarding the different CVEs involved:

http://www.debian.org/security/2017/dsa-3999

Cheers, Magic Sam

 

[levi]

Hmm, none of those description scream setting anything to zero to me.

Anyway, it seems like Debian have made a patch to 2.3 for Jessie. @notaz would that be of any more use as an upgrade path for the Pandora?

On Arch it seems I'm on v2.6. There was a patch that got released two days ago which was quick work if it does fix these holes.

 

[comradekingu]

Fixed in new LibreCMC release https://gogs.librecmc.org/libreCMC/libreCMC/releases
It didnt say that it was fixed on the LEDE site, but
http://downloads.lede-project.org/releases/packages-17.01/

Edit:

Is there a higher resolution version of the logo?
Yes there is.

Oh boy, this is a bad one. I feel a jingle is the next level of alert.

 

[Magic Sam]

Hi all

@notaz : could these patches (from Jouni Malinen's website, wpa_supplicant main author) be of any use to you ?

https://w1.fi/security/2017-1/

Cheers, Magic Sam

 

[notaz]

I already posted about those patches in this very thread, they're for 2.6, we use 2.2.

 

[sebt3]

I already posted about those patches in this very thread, they're for 2.6, we use 2.2.

as levi said, patches for 2.3 exists there : http://security.debian.org/debian-security/pool/updates/main/w/wpa/wpa_2.3-1+deb8u5.debian.tar.xz (see patches/2017/*)

 

[Magic Sam]

@notaz: oops, sorry for the noise...

Cheers, Magic Sam

 

[notaz]

as levi said, patches for 2.3 exists there : http://security.debian.org/debian-security/pool/updates/main/w/wpa/wpa_2.3-1+deb8u5.debian.tar.xz (see patches/2017/*)

Yes I've seen that, and?