Home Network Community > All Threads > [Security Flaws] Severe flaws called "KRACK" are discovered in the WPA2 protocol
< All Threads

[Security Flaws] Severe flaws called "KRACK" are discovered in the WPA2 protocol

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
191011...

[Security Flaws] Severe flaws called "KRACK" are discovered in the WPA2 protocol

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
149 Reply
Re:[Security Flaws] Severe flaws called "KRACK" are discovered in the WPA2 protocol
2017-10-20 22:52:01

flairmedic wrote

I'm sure this has been stated on the forum already but I hope people will read and understand this explanation of the current situation:

The Krack Attack method is not really a hardware / software issue completely. The hardware / software will be patched to fix the real issue. WPA / WPA2 encryption uses a key for the devices to communicate anytime and sometimes randomly, when the devices communicate there is what is called a "handshake" between the devices. 4 messages are sent between the devices. At some point in these messages (usually the 3rd message) the devices "agree" on a key that allows them to know they are talking to each other to "secure" the connection the key travels with each transmission between the devices. Currently the key is not randomized enough or regularly enough to prevent the hacker from determining your key. Once they have the key they can tell the devices to not change the key, then do what they want with the info they can see, and even "insert" their own info into your devices (on both the access point i.e. wifi router, and client i.e. smartphone, computer,...etc). Both the access point and the client will need a patch. If the access point only was fixed the hacker can still use access the client. That is why both need the fix. Additionally, Android / Linux devices are susceptible to a "All zero's key hack" where the hacker can change the encryption key to all 0's and not have to use the software to figure out the key each time. That is why just fixing the access point will not completely protect you.

You can watch this if I did not make it clear enough: https://youtu.be/VI89hpI5pos

Hope this helps.



That's the best simple explanation of the KRACK vulnerability I've seen so far. Thanks, flairmedic.
  0  
  0  
#92
Options
Re:[Security Flaws] Severe flaws called "KRACK" are discovered in the WPA2 protocol
2017-10-21 02:20:24
FlairMedic, would you mind providing a source to this. I was under the same understanding but I'm having trouble finding the appropriate information to back it up to others and this paragraph covers it perfectly, except that I thought I read somewhere that having the AP patched can protect the client.

flairmedic wrote

I'm sure this has been stated on the forum already but I hope people will read and understand this explanation of the current situation:

The Krack Attack method is not really a hardware / software issue completely. The hardware / software will be patched to fix the real issue. WPA / WPA2 encryption uses a key for the devices to communicate anytime and sometimes randomly, when the devices communicate there is what is called a "handshake" between the devices. 4 messages are sent between the devices. At some point in these messages (usually the 3rd message) the devices "agree" on a key that allows them to know they are talking to each other to "secure" the connection the key travels with each transmission between the devices. Currently the key is not randomized enough or regularly enough to prevent the hacker from determining your key. Once they have the key they can tell the devices to not change the key, then do what they want with the info they can see, and even "insert" their own info into your devices (on both the access point i.e. wifi router, and client i.e. smartphone, computer,...etc). Both the access point and the client will need a patch. If the access point only was fixed the hacker can still use access the client. That is why both need the fix. Additionally, Android / Linux devices are susceptible to a "All zero's key hack" where the hacker can change the encryption key to all 0's and not have to use the software to figure out the key each time. That is why just fixing the access point will not completely protect you.

You can watch this if I did not make it clear enough: https://youtu.be/VI89hpI5pos

Hope this helps.
  0  
  0  
#93
Options
Re:[Security Flaws] Severe flaws called "KRACK" are discovered in the WPA2 protocol
2017-10-21 05:29:29

DaveTheNerd wrote

In it, they explain that the code they use in their routers (a) doesn't use 802.11r and (b) also doesn't accept retried Replay Counter values in the handshake, thereby blocking this type of attack.

This also means – and they explicitly state this – that TP-Link's code has never fully-adhered to the WPA-2 spec. Today that makes them look like prescient wizards, though they are not claiming that at all. ;)


Technically, not entirely true. The WPA-2 spec doesn't have any indicator of what should be done in the case of a replayed packet as part of the 4-part handshake. The spec itself is rather silent on how that should be handled. Some systems (Linux's wpa-suplicant, for example) accepts the packet, and either reapplies the key, or clears the key (bug), depending on the version of the software. So TP-Link isn't "out of spec", they just chose to do something different in a place where the spec was undefined.


Android devices which are not vanilla(Pixels or Nexuses) will have to wait a very long time for a patch.


That may not be true as well. Apparently in the vanilla systems (and most Android platforms), the WPA handler is actually part of the Google Play package. Google has a slated release with this patch on November 9th, which should update nearly all devices that have auto-update turned on (which it is on most devices by default). If you turned it off, I strongly suggest you look for a Google Play package update on the 9th or 10th and manually update it when you see it.

Thanks again TPLink for the quick updates, and for verifying that most of your products were never vulnerable to this to start with (or were only in specific modes). I'll strongly consider that factor when buying hardware in the future.
  0  
  0  
#94
Options
I disagree, AP are affected as well
2017-10-21 06:33:59

tplink wrote

Just as what I said, TP-Link will patch the routers as well in weeks. And routers are only affected in WDS bridging mode.
The vulnerability mainly targets the Wi-Fi clients, thus if you don't get the router (in default router mode or AP mode) patched through the router, you won't be attacked. If you get the router patched, but Wi-Fi clients not patched, you are likely to be attacked.


Isn't it the part of the AP to distribute the keys in a typical AP-STA setup? The Krack attack works by suppression of the initiation of that key handshake. The attacker then reuses the key within the following resend. Hence, an unpatched AP will surely play it's role in this vector. hostapd and wpa_supplicant, which many of your products use, have both been patched, already. There will be a reason, that not only wpa_supplicant has been patched. Furthermore: what does the chipset manufacturer have to do with compiling hostapd and wpa_supplicant against the SDK and to republish that firmware?
  0  
  0  
#95
Options
Re:[Security Flaws] Severe flaws called "KRACK" are discovered in the WPA2 protocol
2017-10-21 13:23:16
Wondering if the Archer C7 series in a wired bridge mode would be susceptible. I have not seen anything on wired bridge mode. I would suspect if the router and the bridge are essentially standard router mode it may be OK. Still need to fix all my clients! I must have a 20 little Wifi devices sprinkled throughout the place.
  0  
  0  
#96
Options
Re:[Security Flaws] Severe flaws called "KRACK" are discovered in the WPA2 protocol
2017-10-21 17:12:56
[FONT=verdana]TL-WA850RE v1.23 - what's the status here? The leading post seems to refer to rev5 or later...[/FONT]
  0  
  0  
#97
Options
Re:[Security Flaws] Severe flaws called "KRACK" are discovered in the WPA2 protocol
2017-10-22 03:38:50

Sitedrifter wrote

Do you realize how obscure LineageOS is in regards to the 100s of millions of Android users? I would bet < .01 percent of the Android users do anything but use the OEM OS. My point being LineageOS is not a good comparison to make TP-Link look like they are sitting on their asses.


Well, the same would apply to LEDE, DD-WRT and others. You are just arguing against closed source and proprietary solutions. LEDE exists for many TP-Link labelled devices, but installing that firmware isn't advisable for the majority of consumers. As is self-compiling the published GPL-licensed code ...

Regarding TP-Link's firmware management: All they'd have to do, was compiling the firmwares against the original SDK with a more recent version of wpa_supplicant and hostapd. Updating the driver shouldn't really be necessary in most cases.
  0  
  0  
#98
Options
Re:[Security Flaws] Severe flaws called "KRACK" are discovered in the WPA2 protocol
2017-10-22 07:43:28

Artifiring wrote

FlairMedic, would you mind providing a source to this. I was under the same understanding but I'm having trouble finding the appropriate information to back it up to others and this paragraph covers it perfectly, except that I thought I read somewhere that having the AP patched can protect the client.
So without sending through a long technical document; think of it this way. What happens if you go somewhere that the AP isn't patched and you haven't patched your client device. Then you would be vulnerable to an attack. Also if the client is not patched and to the best of my understanding is that the client could be attacked and information pulled just from it's side. Just remember it is a protocol issue if the protocol is vulnerable it is vulnerable on either side that is not patched. You cannot have two different protocols securing the information. I would watch the video for a more visual description.
  0  
  0  
#99
Options
Re:[Security Flaws] Severe flaws called "KRACK" are discovered in the WPA2 protocol
2017-10-22 14:17:28
The page needs to be updated with all router models, including EOL.
My WR340G v3 is EOL and not included in the list but that probably due to EOL and still vulnerable.
Is it time to now dump EOL devices? (Already checked and it does not support dd-wrt which has been patched :(
  0  
  0  
#100
Options
Re:[Security Flaws] Severe flaws called "KRACK" are discovered in the WPA2 protocol
2017-10-23 07:21:40

tplink wrote

(...)
(Unaffected Devices)
(...)
# All mobile Wi-Fi products
(...)

Devices affected by the vulnerability
 Routers working in Repeater Mode/WISP Mode/Client Mode：
(...)
[COLOR=#333333][FONT=AktivGrotesk-Regular][FONT=verdana]TL-WR802N with firmware version 0.9.1 3.16 v0188.0 Build 170705 Rel.34179n or earlier[/FONT]
(...)[/FONT]
Sounds contradictory. The TL-WR802N, a mobile WiFi product, is vulnerable.

If that is the case, then how is the TL-WR702N - basically the same but with N150 WiFi - not vulnerable? It supports client mode and is frequently used as such (in Poland as an accessory for Cyfrowy Polsat STBs). 3rd party firmware is unavailable due to low flash size.

Then we have the TL-MR3020 - also a mobile WiFi product - which supports WISP mode. Not vulnerable either? 3rd party firmware is available, but it's still your product, still sold and still popular.

Not using client/WISP functionality is not a long term remedy. WISP mode is part of the reason I chose to buy a TL-MR3020. Client mode is the purpose for which I bought 3 (three) TL-WR702Ns.

KRACK testing tools will be released soon to reveal devices still vulnerable. We should expect the tools to be reverse-engineered for malicious purposes not long after. The situation will get ugly then.

TL;DR: Are you certain the TL-MR3020 and TL-WR702N are not vulnerable?
  0  
  0  
#101
Options
191011...
Related Articles
Critical KRACK Flaws in WPA2 WiFi Security in all routers.
701 0
Archer D(
509 0
'Krack' patches?
418 0
Severe packet loss
46 0
Deco red “D”
269 0
Security
943 0
About Us
Press
Copyright © TP-Link Systems Inc. All rights reserved.