63

The more I read about KRACK, the more granular my questions become, and the harder it is to find answers.

My understanding is that both wireless clients and WAPs need to be patched to obviate the KRACK vulnerability in any particular wifi handshake. But there's some nuance to this (c.f. To sufficiently protect against KRACK is patching the client, the AP, or both, required?).

So if the client is patched, what if you don't know whether the WAP is or isn't? Doesn't this mean that one can never trust anonymous wifi cafes again, since there's no way to know whether they've patched their WAPs?

  • 142
    Wifi in Cafés never was safe in the first place. Mitm is the standard to happen there - it even has a nice name: captive portal. You can't (and never could) use a public WiFi without a VPN – Marcus Müller Oct 23 '17 at 21:51
  • Comments are not for extended discussion; this conversation has been moved to chat. – Rory Alsop Oct 27 '17 at 8:21
123

Does KRACK mean that wifi cafes will never be safe again?

This is based on the false assumption that Wi-Fi cafes were ever safe. That is simply a false assumption.

So if the client is patched, what if you don't know whether the WAP is or isn't? Doesn't this mean that one can never trust anonymous wifi cafes again, since there's no way to know whether they've patched their WAPs?

Public Wi-Fi is often open (i.e. no encryption) or use a PSK that is distributed to all customers. Not saying there aren't some using WPA2-Enterprise, but I personally haven't seen any.

KRACK creates an opportunity to determine the WPA/WPA2 PTK/GTK so traffic can be decrypted and possibly manipulated by an attacker. If your client is patched, this will significantly limit what the attacker can see or do.

With Open Wi-Fi you have no encryption. With PSK (where the attacker also knows the PSK and can capture the 4-way handshake), you don't have reliable encryption because anyone around has the capability to decrypt your traffic. Either case presents an easy opportunity for an attacker to create a MitM situation. In other words, you are already totally exposed and are not safe in any sense; all before KRACK was ever found or publicized.

The only way that KRACK might make such public Wi-Fi more vulnerable is if the site is using WPA2-Enterprise (i.e. setting up usernames/passwords for clients). But if a site is putting that much effort into providing secure access for customers, then odds are good they will put the effort into patching it as well.

End result though is still the same. Public Wi-Fi shouldn't be considered safe.

  • 2
    From what I can tell, KRACK's primary threat is that it lets you gain access to the network. Cafe wifi already lets anyone onto the network, so there's no loss of security on that end. Yes, KRACK can do more complicated attacks (like data injection), but that was already possible without KRACK if you could get on the wifi. It's just another way of doing something that was already possible. – cegfault Oct 24 '17 at 4:56
  • 13
    @cegfault, you are incorrect. KRACK does not give access to the network, compromise the 802.11 client, or recover the PSK or other credentials. KRACK makes it significantly easier to determine the PTK of a client connection. A successful KRACK exploit will allow the attacker to decrypt, replay, forge, and/or inject frames, in at least one direction if not both. The discoverer of this vulnerability has put together a nice site to detail what KRACK is and how it works. You can find it here. – YLearn Oct 24 '17 at 5:07
  • 1
    Naive clairification question: does krack make someone connected to cafe wifi with an encrypted VPN any less safe? – LangeHaare Oct 24 '17 at 7:09
  • 5
    @LangeHaare, since your typical cafe Wi-Fi is less secure than even KRACKed WPA2, it wouldn't be any less safe. – YLearn Oct 24 '17 at 8:37
  • 2
    What Krack made possible, was always possible in an cafe or any open wifi. There are even android apps that can sniff the wifi traffic, grab images and text, etc ... Last I used one such app was few years ago. – Иво Недев Oct 25 '17 at 9:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.