5

Thinking of interim solutions to lower the chance of attack while waiting for patches for routers. Would setting a MAC filter, i.e. limiting WIFI access to only known devices, reduce or protect against the attacker hijacking the WIFI network?

  • 3
    The answer to "Would MAC filtering protect against...?" is always "no". – Mark Oct 18 '17 at 1:51
9

In general, MAC filters (both whitelisting and blacklisting) are completely ineffective against a determined attacker, as MAC addresses can be easily changed and forged using standard system networking utilities.

Additionally, MAC filters do not apply here since this vulnerability allows exploitation from an attacker who is not associated with the network (side note- on a network secured with WPA2-Personal, anyone (associated or not) who knows the network's pre-shared key (PSK) can already decrypt traffic between the access point and stations, assuming the attacker has captured the relevant 4-way handshakes). The KRACK vulnerability allows an attacker to decrypt encrypted frames without knowing the PSK because they can force the client to use a key that is known (a key of all 0's). This is done by sending forged management frames, which are not protected under 802.11i, allowing attackers to effectively impersonate any function of an access point.

So in short, MAC filtering and KRACK are in completely different realms and MAC filtering is not a valid mitigation for this issue. A better solution is to patch clients, as these patches may be available before the router patches. Additionally, there are some settings that may further increase the possible damage from the attack. I suggest you read more about the vulnerability in order to understand what features may be affected.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.