Home Network Community > All Threads > [Security Flaws] Severe flaws called "KRACK" are discovered in the WPA2 protocol
< All Threads

[Security Flaws] Severe flaws called "KRACK" are discovered in the WPA2 protocol

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
1456...

[Security Flaws] Severe flaws called "KRACK" are discovered in the WPA2 protocol

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
149 Reply
Re:[Security Flaws] Severe flaws called "KRACK" are discovered in the WPA2 protocol
2017-10-18 11:29:19
saying that wifi routers are not effected is wrong and not correct!

- both the client and wifi router need to be fixed
- it is true that if a client OR wifi router is patched then the vulnerability cant be exploited

is tplink saying that since apple, MS, etc. have fixed the client side that tplink doesn't need to fix the wifi router end of the issue? maybe i am not understanding but this sounds like what is being said and is wrong. therefore any wifi router supporting WPA2 should be patched.

"So again, update all your devices once security updates are available. Finally, although an unpatched client can still connect to a patched AP, and vice versa, both the client and AP must be patched to defend against all attacks!"
https://www.krackattacks.com/#faq
  0  
  0  
#42
Options
Re:[Security Flaws] Severe flaws called "KRACK" are discovered in the WPA2 protocol
2017-10-18 11:41:37

is2017 wrote

it is true that if a client OR wifi router is patched then the vulnerability cant be exploited


This is wrong. The attack primarily focuses on the client and so if only the router/access point is patched, the client is still vulnerable. All clients MUST be patched.

Ideally all routers and access-points would be patched as well. However, even the krack attacks website acknowledges that not all access points will need to be, as the vulnerability exists when they make a connection to an upstream device (i.e. wireless repeaters). I think this is what TP-Link are attempting to point out when they say not to enable wireless bridging on the devices that feature it.
  0  
  0  
#43
Options
Re:[Security Flaws] Severe flaws called "KRACK" are discovered in the WPA2 protocol
2017-10-18 11:54:18

is2017 wrote

saying that wifi routers are not effected is wrong and not correct!

- both the client and wifi router need to be fixed
- it is true that if a client OR wifi router is patched then the vulnerability cant be exploited

is tplink saying that since apple, MS, etc. have fixed the client side that tplink doesn't need to fix the wifi router end of the issue? maybe i am not understanding but this sounds like what is being said and is wrong. therefore any wifi router supporting WPA2 should be patched.

"So again, update all your devices once security updates are available. Finally, although an unpatched client can still connect to a patched AP, and vice versa, both the client and AP must be patched to defend against all attacks!"
https://www.krackattacks.com/#faq


Just as what I said, TP-Link will patch the routers as well in weeks. And routers are only affected in WDS bridging mode.
The vulnerability mainly targets the Wi-Fi clients, thus if you don't get the router (in default router mode or AP mode) patched through the router, you won't be attacked. If you get the router patched, but Wi-Fi clients not patched, you are likely to be attacked.
  0  
  0  
#44
Options
It's not really true the AP are not affected if not used in client or repeater mode
2017-10-18 16:50:25
Hi TP-Link,
I would kindly ask to review your statement about AP/Router are not affected if not used in client or repeater mode for below reason:
If you check the dedicated KRACK research paper at https://papers.mathyvanhoef.com/ccs2017.pdf you can understand that the problem why a client can be "attacked" from KRACK is also due to AP/Router implementation as follow:

In the research paper you can read:


" In practice, we found that several APs indeed accept an older replay
counter. More precisely, some APs accept replay counters that were
used in a message to the client, but were not yet used in a reply
from the client (see column 2 in Table 2 on page 8). These APs
will accept the older unencrypted message 4, which has the replay counter r+1 in Figure 4."

So maybe you should check if your router/AP is accepting older replay counter.


and in addition it seems also below technique can be used against AP as per the research paper:
" it is still possible to indirectly attack them by performing a key reinstallation attack against the AP during an FT handshake" (see Section 5 - A Key Reinstallation Attack against the AP):

"This attack technique requires us to wait until a rekey of the
session key occurs. Several APs do this every hour [66], some examples
being [24, 26]. In practice, clients can also request a rekey by
sending an EAPOL frame to the AP with the Request and Pairwise
bits set. Coincidently, Broadcom routers do not verify the authenticity
(MIC) of this frame, meaning an adversary can force Broadcom
APs into starting a rekey handshake. All combined, we can assume
a rekey will eventually occur, meaning an adversary can carry out
the key reinstallation attack."


So maybe you should check if your AP/Router are affected about " not verify the authenticity (MIC) of this frame"

So I would really kindly ask you to re-check your product if they are affected and support us as your customers with a fix on AP/Router side (in my case W8970)

Thanks in advance for your understanding!
  0  
  0  
#45
Options
Re:[Security Flaws] Severe flaws called "KRACK" are discovered in the WPA2 protocol
2017-10-18 20:01:28
The DecoM5 ist listed to be vulnerable in post #1.
Since the mesh design is a bit more complex and does not transparently allow for deactivation of WDS, bridgeing an Co. (at least not for the backhaul) I am wondering under which cicumstances the DecoM5 is vulnerable - and of course when a fix will be availible fo this top of e line product.
  0  
  0  
#46
Options
Re:[Security Flaws] Severe flaws called "KRACK" are discovered in the WPA2 protocol
2017-10-18 20:20:08
I've read TP-Link's latest updates, and some of them are hard to reconcile with the information on the linked krack info page. It explicitly states that most wifi-using devices are vulnerable, not just clients (even though clients are the main focus of the attack):

The weaknesses are in the Wi-Fi standard itself, and not in individual products or implementations. Therefore, any correct implementation of WPA2 is likely affected. To prevent the attack, users must update affected products as soon as security updates become available. Note that if your device supports Wi-Fi, it is most likely affected .


Most other mainstream router vendors have already either released patches or announced plans to patch this. It may be that TP-Link's devices don't need to be updated, but as every device using the WPA2 protocol is affected, that would be a little surprising. Could you please explain what's different about TP-Link's implementation of the WPA2 protocol that would eliminate the need to address it? And are there any other non-standard protocol implementations we should be aware of?
  0  
  0  
#47
Options
Switched to DD-WRT Firmware ...
2017-10-18 22:05:43
.. because DD-WRT has immediatly fixed the KRACK vulnarability and I can't wait for weeks until TP-Link doing the same.
  0  
  0  
#48
Options
Re:[Security Flaws] Severe flaws called "KRACK" are discovered in the WPA2 protocol
2017-10-18 23:38:48
I suppose we are all speculating and tplink are the only ones that know for sure what the impact is to their products (for now). as with any public vulnrability,many people are developing exploit kits.

when those are tested against tplink patched devices and devices deemed not to require a patch, we will know for sure. at that time if it is discovered that tplink did not patch a device it should have, it will look far worse then this poor response.

I will reserve judgment until then and assume tplink will do the right thing.

  0  
  0  
#49
Options
Re:[Security Flaws] Severe flaws called "KRACK" are discovered in the WPA2 protocol
2017-10-19 00:17:01
So, today we have learnt that:

1. TP-Link do not have the technical competency to understand the KRACK vulnerability paper. If they did, they would understand that patching clients AND APs is required to fully mitigate risk.
2. TP-Link do not care about the network security of their customers - they are content to leave unpatched TP-Link APs and state that network security is the responsibility of the client only
3. TP-Link do not understand the nature of the technological landscape in which they operate. If they did, they would understand that many client devices won't get patched in a timely fashion, or at all (old Android devices, IoT devices etc), and they would understand that the best thing they could do for their customers would be to ensure all APs are patched.

I'm literally done with TP-Link after this. I will be recommending all businesses, friends and family members replace any TP-Link devices ASAP.
  0  
  0  
#50
Options
Re:[Security Flaws] Severe flaws called "KRACK" are discovered in the WPA2 protocol
2017-10-19 01:28:23

jgu wrote

So, today we have learnt that:

1. TP-Link do not have the technical competency to understand the KRACK vulnerability paper. If they did, they would understand that patching clients AND APs is required to fully mitigate risk.
2. TP-Link do not care about the network security of their customers - they are content to leave unpatched TP-Link APs and state that network security is the responsibility of the client only
3. TP-Link do not understand the nature of the technological landscape in which they operate. If they did, they would understand that many client devices won't get patched in a timely fashion, or at all (old Android devices, IoT devices etc), and they would understand that the best thing they could do for their customers would be to ensure all APs are patched.

I'm literally done with TP-Link after this. I will be recommending all businesses, friends and family members replace any TP-Link devices ASAP.



I think the biggest failing is lack of a security incident response process to address this issue in a timely manner and proper communication to customers. I posted similar points and received responses saying it's only a client side issue. As I mentioned, I will reserve judgment until I can test with an exploit kit. Now that they have released the list of effected devices, we can test on the other products that are not effected.

Security is a shared responsibility between end users and all of the manufactures of various devices. If there is a security issue, it needs to be addressed by everyone. This is my last post on this issue until I can test exploit kits against my tplink router.

Just published:

https://github.com/vanhoefm/krackattacks-test-ap-ft


  0  
  0  
#51
Options
1456...
Related Articles
Critical KRACK Flaws in WPA2 WiFi Security in all routers.
701 0
Archer D(
509 0
'Krack' patches?
418 0
Severe packet loss
46 0
Deco red “D”
269 0
Security
943 0
About Us
Press
Copyright © TP-Link Systems Inc. All rights reserved.