Would MAC filtering protect against KRACK?

Question

Thinking of interim solutions to lower the chance of attack while waiting for patches for routers. Would setting a MAC filter, i.e. limiting WIFI access to only known devices, reduce or protect against the attacker hijacking the WIFI network?

Answer 1

In general, MAC filters (both whitelisting and blacklisting) are completely ineffective against a determined attacker, as MAC addresses can be easily changed and forged using standard system networking utilities.

Additionally, MAC filters do not apply here since this vulnerability allows exploitation from an attacker who is not associated with the network (side note- on a network secured with WPA2-Personal, anyone (associated or not) who knows the network's pre-shared key (PSK) can already decrypt traffic between the access point and stations, assuming the attacker has captured the relevant 4-way handshakes). The KRACK vulnerability allows an attacker to decrypt encrypted frames without knowing the PSK because they can force the client to use a key that is known (a key of all 0's). This is done by sending forged management frames, which are not protected under 802.11i, allowing attackers to effectively impersonate any function of an access point.

So in short, MAC filtering and KRACK are in completely different realms and MAC filtering is not a valid mitigation for this issue. A better solution is to patch clients, as these patches may be available before the router patches. Additionally, there are some settings that may further increase the possible damage from the attack. I suggest you read more about the vulnerability in order to understand what features may be affected.