5

Given that the probability is high that there are unpatched devices left even years from now (android devices, IoT-Things, etc.):

Is it likely that there will be an exploit available soon? I think of the consequences, especially with packet forgery and still not widely used HSTS, would warrant development of an exploit and foresee a second big wardriving instance.

While it is easy for tech-savvy users to set up a VPN, for the regular user it isn’t.

Are there good reasons (for example high computational complexity of a successful attack) to make it not worthwhile to widely deploy Notebooks or pi‘s carrying out the attack with a generalized exploit?

How about botnets/Trojans with WiFi capabilities? Could they easily deploy an exploit to a wide range of (private) targets, making it less of a local attack?

  • Here, He said he'll eventually release his "exploit" (code) shown in the demo video. – Azteca Oct 18 '17 at 22:18
9

The question is not whether there will be an exploit but what will be the range of upcoming exploits.

This vulnerability receives so much attention precisely because of its impacts. Would it be a theoretical weakness reserved to potential state agency or a thing easily fixable as part of automatic update processes, nearly no one would have ever heard of it outside of the IT-Sec world.

But the real question in such situation is: what's next?

Once a security flaw is published, it attracts a worldwide attention to a specific piece of code, usually resulting with other flaws being found or other ways to use the discovered flaw with more impact or efficiency.

Simply look at the flaw discoverer, Mathy Vanhoef: between the time he wrote his paper and the time he publishes it he himself discovered new techniques making some attacks significantly easier than what he initially thought.

So bring this to a worldwide scale, and you understand why Mathy chose to end his KRACK Attack page as follow:

So you expect to find other Wi-Fi vulnerabilities?

“I think we're just getting started.” Master Chief, Halo 1

If you remind of the WEP total failure, the issue was not to be found in a single security issue but in a series of several flaws:

  • It is possible to replay some packets.
  • Some cryptographic initialization may be reused.
  • The encryption strength is limited.

Taken alone, they are not very powerful. But associate them, using the replay attack to force initialization vector to be reused and allow to break the encryption key, and WEP becomes fully broken with war-drivers roaming across streets.

Here we have one flaw affecting the WPA2 protocol. It is already very impacting and, as you said, a large proportion of devices will never get patched. But will this stop at this (WPA2 being better engineered than WEP we might hope so), or is it the first discovery of a dark series affecting the WPA2 protocol? No one knows for now, and a lot of people are working on this.

So:

KRACK: will there be an exploit soon?

Yes, and yes it will have the impact you describe, and not only that new discoveries may potentially make the situation even worse.

  • I'd argue it's an implementation problem, largely solved by testing nonce numbers for obvious values and uniqueness (though different implementations fail in different additional ways.) Most home routers are hopelessly poor. The bigger problem is "ask a typical home user when they last updated their router firmware", that's assuming one is even available. – James Snell Oct 19 '17 at 14:46
  • 1
    @JamesSnell: Some ISPs have the possibility to remotely update their end-users routers without users intervention, but AFAIK this is uncommon in practice and doesn't fix users own devices which usually stack CVE over CVE. That and previous generation cellphones: Google must write a fix for an older Android version and provide it to the manufacturers who must port it to devices not sold anymore and provide the result to carrier so they can push it to people who don't have paid for the very last cellphone: every entity involved have commercial incentive to not provide fixes. – WhiteWinterWolf Oct 19 '17 at 15:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.