Slashdot Mirror
Microsoft Has Already Fixed the Wi-Fi Attack Vulnerability; Android Will Be Patched Within Weeks (theverge.com)
Microsoft says it has already fixed the problem for customers running supported versions of Windows. From a report: "We have released a security update to address this issue," says a Microsoft spokesperson in a statement to The Verge. "Customers who apply the update, or have automatic updates enabled, will be protected. We continue to encourage customers to turn on automatic updates to help ensure they are protected." Microsoft is planning to publish details of the update later today. While it looks like Android and Linux devices are affected by the worst part of the vulnerabilities, allowing attackers to manipulate websites, Google has promised a fix for affected devices "in the coming weeks." Google's own Pixel devices will be the first to receive fixes with security patch level of November 6, 2017, but most other handsets are still well behind even the latest updates. Security researchers claim 41 percent of Android devices are vulnerable to an "exceptionally devastating" variant of the Wi-Fi attack that involves manipulating traffic, and it will take time to patch older devices.
Grow up. The article links to the previous Slashdot story from earlier today and is still on the front page. The previous article links to a research paper explaining the vulnerability. For anyone who has looked at the front page this morning or even bothered to examine the links in the summary, it's blatantly obvious which vulnerability is being discussed here. Here's hoping you're modded -1 flamebait. You deserve it.
This is a high profile issue at the moment. I realize looking back at it in a few weeks may be worth that kind of comment, but there's been multiple slashdot articles on it today, and every tech news site is buzzing about it.
To fill your rage though,
The following Common Vulnerabilities and Exposures (CVE) identifiers were assigned to track which products are affected by specific instantiations of our key reinstallation attack:
CVE-2017-13077: Reinstallation of the pairwise encryption key (PTK-TK) in the 4-way handshake.
CVE-2017-13078: Reinstallation of the group key (GTK) in the 4-way handshake.
CVE-2017-13079: Reinstallation of the integrity group key (IGTK) in the 4-way handshake.
CVE-2017-13080: Reinstallation of the group key (GTK) in the group key handshake.
CVE-2017-13081: Reinstallation of the integrity group key (IGTK) in the group key handshake.
CVE-2017-13082: Accepting a retransmitted Fast BSS Transition (FT) Reassociation Request and reinstalling the pairwise encryption key (PTK-TK) while processing it.
CVE-2017-13084: Reinstallation of the STK key in the PeerKey handshake.
CVE-2017-13086: reinstallation of the Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) key in the TDLS handshake.
CVE-2017-13087: reinstallation of the group key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame.
CVE-2017-13088: reinstallation of the integrity group key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame.
Note that each CVE identifier represents a specific instantiation of a key reinstallation attack. This means each CVE ID describes a specific protocol vulnerability, and therefore many vendors are affected by each individual CVE ID. You can also read vulnerability note VU#228519 of CERT/CC for additional details on which products are known to be affected.
A WiFi attack allows one to manipulate a website? That escalated quickly.
Oh, just /. editors' normal approval of bunk write-ups.
Yep, I never spell check.
More incorrect spellings can be found he
The article wasn't quite clear? Made it sound like it was all, already taken care of... but didn't quite specify when that patch was released?
How do I patch my Nexus 5? It's running the default Android, but I don't see an update available. When will this fix be available for Nexus phones?
Worse, how many millions of Android handsets will never see this patch?
3rd party firmware is your only option at this point.
After those weeks it will take for google to patch it, add in several more weeks for the manufacturer and then yet more weeks for the carriers..... if they decide to do it at all.
So now most Android devices are, and will continue to be, vulnerable to both BlueBourne and WPA2 KRACK, meaning that essentially they are wide open to anyone pilfering whatever they want off the device itself and as they communicate over the air. With most manufacturers abandoning updates in 3 years or sooner, and for the small pool of supported devices having very infrequent updates available, many times 3-6 months behind the curve, why do we allow this kind of chronic insecurity?
It's insane that we allow businesses to behave like this: Give everyone computing devices they use to run their lives - healthcare, credit, banking, social, BYOD work, etc. and leave them open like Swiss cheese.
Won't make a bit of difference if the access points are still vulnerable.
This seems to be more of an attack on clients (e.g. laptops, tablets, phones) rather than access points.
Interestingly, this vulnerability does not expose a network's WPA2 passphrase.
#DeleteChrome
The attack requires spoofing the AP. The client (your device) will certainly need to be patched. The AP's firmware might be hardened so that spoofing is less likely is mostly likely the fix.
Well, there's spam egg sausage and spam, that's not got much spam in it.
So Microsoft "patched" this by not properly implementing the phase 3 handshake re-transmit as it's required in spec of 802.11i from the start.
Windows rejects retransmit requests, causing the attack to fail.
How many of these millions of phone and handsets will actually see a successful attack? How many have anything on them worth attacking?
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
Android Will Be Patched Within Weeks
What percentage of Android will be patched?
The 18% with 7/Nougat or better,
the 50% with 6/Marshmallow or better,
the 78% with 5/Lollipop or better,
the 92% with 4.4/Kitkat or better?
https://developer.android.com/...
https://forum.xda-developers.com/google-nexus-5/orig-development/rom-cm14-1-nexus-5-hammerhead-t3510548
https://download.lineageos.org/hammerhead
https://twrp.me/devices/lgnexus5.html
https://forum.xda-developers.com/google-nexus-5/general/noob-read-adb-fastboot-how-hep-t2807273
On his website, the researcher wrote that sometimes AP can be configured to act as clients towards other APs (e.g. repeaters), in which case they are vulnerable.
You're leaking smartquotes, bro.
There is no XUL, only WebExtensions...
As a Nexus 5 owner, I'm not holding my breath on that being a true statement.
Sounds like a good fix to me. Instead of accepting retransmits, it's safer to restart the entire handshake.
This is a trolling effort worthy of the legendary posters of yore!
+5 Inciteful
echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
I guess that explains why my Win10 box rebooted by itself two days ago.
#DeleteFacebook
"The key negotiation process needs to allow for the possibility of radio interference, so it permits the access point to re-send the message that is step three of the handshake. If an attacker sends a copy of this message, the client device will be tricked into reverting back to the original encryption key and initialization vector used at the start of the session. The client's next transmissions will have been encrypted with the same key as earlier transmissions, even though that key was only meant for a single use. That allows for a key reuse attack, which doesn't directly expose the underlying encryption key but does make it relatively easy to decrypt the data that was encrypted, especially if something is known about the structure of the messages that were both encrypted with the same key. IP packet headers, in turn, provide exactly that."
Yes, if the phase 3 handshake re-transmit required by the specification inherently enables a key reuse attack, then the flaw is not in the implementation, but the specification itself, and security would dictate that one refuse to enable that portion of the specification. Losing the ability to initialize a connection in a high RFI environment, which most installations attempt to avoid and mitigate, is an inconvenience. Having your traffic snooped is quite a bit more of an issue.
From what I understand, the attack is on the router, forcing it to re use known keys for encryption. How do the client devices fix this issue?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
And don't forget that the front page shows the most recent submissions first.
Thank you. This is actually what happened here.
As some of us have jobs and don't live in our mom's basements we tend to read the news after we're done and what do we get? This masterpiece of editorial work.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion. -- Spazmania (174582)
wpa (2.1-0ubuntu1.5) trusty-security; urgency=medium
* SECURITY UPDATE: Multiple issues in WPA protocol
- debian/patches/2017-1/*.patch: Add patches from Debian jessie
- CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080,
CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087,
CVE-2017-13088
* SECURITY UPDATE: Denial of service issues
- debian/patches/2016-1/*.patch: Add patches from Debian jessie
- CVE-2016-4476
- CVE-2016-4477
-- Marc Deslauriers Mon, 16 Oct 2017 08:20:18 -0400
you can patch the issue on either side of the setup and this attack will fail so
P client and P router = no attack
N client and P router = no attack
P client and N router = no attack
N client and N router = PAWNED
Wrong.
If you patch a client that client is safe.
If you patch an AP all clients using that AP are safe.
It's not just the phones, tablets and computers that need to be updated. Since it's clients that need to be patched it's everything that connects to the network. Thermostats, scales, TVs, digital photo frames, ...
How many have anything on them worth attacking?
CPU cycles is one commodity. People tend to use the same password for multiple sites, so finding the one social network that sends it unencrypted is paydirt for someone who will take it and attempt it on other sites.
Unless the patch was deployed before the vulnerability was exposed, the word "already" shouldn't be in the headline.
What smartquotes? Those are the most stupid things that ever was invented since they screw up code examples royally.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
N client and Evil Router = PAWNED.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
The delay and ineptness from various vendors to not provide updates is probably what will hurt the Android environment the most in the long run.
Early days of MS-DOS had actually different computers that weren't compatible with each other when it came to hardware and each required its own version of MS-DOS. Android is in the same seat.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
Can't get to the link in the 8th word of the submission? How do you have a job with an attention span that short?
Or if you actually have a useful attention span, how do you have a job with time management skills so poor that you spend more time posting about not being spoon fed then clicking a link?
OK, so how do I check whether a system has been pwned via any of these CVE's before being patched? openBSD provided system updates that essentially leaked the vulnerability, and government agencies have known for at least two months, not to mention everyone that they notified. Of course, we all have complete faith in the fidelity of our beloved United States government and all commercial corporations - they've never let us down.....
Does anyone have utilities that checks all system programs and critical files via digital signatures against the versions that are supposed to be there? Bonus points if it identifies out-of-date programs and suggests updates. Let us ignore for now the possibilities that (1) the system has been pwned so cleverly that such utilities can be fooled (2) the utility installs a backdoor that pwns the system and reports false signatures, as (3) open-sourcing the utility is a basic requirement for transparency, or many independent versions could be easily written given an appropriate database...
The database of file signatures is the important part, and can be quickly developed from one or more clean installs (multiple installs to catch variable files). I'm already aware of signatures used to validate updates, but this is for validation of existing systems. Presumably a list of files not covered by the database is a starting point to complete the system validation.
A little searching turned up machinery-project.org - anyone familiar with that, or can suggest other tools?
I remember CP/M getting customized by the harware maker, but not MS-DOS.
"Good things don't end with eum, they end with mania or teria." - H. Simpson
Router? Huh? What do routers have to do with this?
On the off chance that you seriously don't know what's going on here: for the general public, all boxes that connect them to the internet are "routers." This is not too surprising since a high proportion of home devices do perform routing functions. The percentage of the general public that understands what a wireless access point is is very small.
... and first than MS, but I think they're not paying media like TheVerge to share this.
If you patch a client that client is safe.
If you patch an AP all clients using that AP are safe.
Wrong. There is no possible AP only patch that renders clients safe.
Before the IBM bios was clean room reverse engineered, every vendors version of MS DOS was different. Tandy and DEC were two examples.
He's not asking for a fucking link, asshole. He's asking for a proper description of the bug, specifically a CVE number. Your reading comprehension is pathetic. How the fuck do you operate without hand holding?
Don't contribute and allow improper use of router and AP terms. The OP should be shamed to prevent this kind of stupid talk.
I'm certain it'll be in next month's update for my BlackBerry phone.
"within weeks". Epic customer support.
I think Jared updated the pedo profile. s/cheetos/subs/.