Questions tagged [krack]

KRACK is a vulnerability in the four way handshake of WPA, allowing an attacker to decrypt Wi-Fi traffic.

253
votes
5answers
29k views

Consequences of the WPA2 KRACK attack

Today new research was published on vulnerabilities in wireless network security called Krack. What are the real-world consequences of these attacks for users and owners of wireless networks, what ...
143
votes
9answers
18k views

To sufficiently protect against KRACK is patching the client, the AP, or both, required?

Following on from this question, I am unclear on which of the following steps are sufficient to protect a WPA2-based wifi connection from the KRACK flaw: Patching the AP (e.g. router) Patching the ...
118
votes
3answers
18k views

Why wasn't the KRACK exploit discovered sooner? [closed]

From what I've read, the issue is as simple as performing step 3 of a 4-step handshake and the consequences of performing that step more than once. Considering the complexity of these kinds of ...
63
votes
1answer
18k views

Does KRACK mean that wifi cafes will never be safe again?

The more I read about KRACK, the more granular my questions become, and the harder it is to find answers. My understanding is that both wireless clients and WAPs need to be patched to obviate the ...
35
votes
1answer
4k views

How does a nonce reset allow for decryption?

I'm sure that by now most InfoSec-lovers have heard about KRACK. If you haven't, check out this great explaination by a fellow StackExchanger. It's a new attack on WPA2 which allows for decryption ...
33
votes
4answers
7k views

Does KRACK break TLS?

Apologies if this is already answered in the whitepaper, I'm not going to get chance to read it for a few days due to a hectic schedule, but I am already fielding questions from non-techies reading ...
17
votes
6answers
6k views

How can I protect myself from KRACK when I can't afford a VPN?

I'm always using Wi-Fi networks, since I move a lot. But I don't think I can afford a VPN for the moment (I know they're cheap) to protect myself against KRACK when connecting to those Wi-Fi networks. ...
17
votes
3answers
8k views

Is WPA2-Enterprise affected by the KRACK attack?

From my reading of the whitepaper it is the 4-way handshake that is vulnerable, but WPA2-Enterprise uses a RADIUS server for authentication, so is it also exploitable? And if so, how?
17
votes
3answers
2k views

Does using a VPN protect against KRACK?

Does using a VPN protect against KRACK? How does this work? How can it be bypassed? I use a commercial VPN on my laptop and on Android. Is an OpenVPN connection to your home a good way to protect ...
12
votes
2answers
4k views

Is there a test for KRACK (devices and routers)?

After Heartbleed was announced, a number of tests popped up that let me test if a server I was connecting to was patched, unpatched or unknown. For example, https://filippo.io/Heartbleed/ Is such a ...
10
votes
2answers
1k views

Krack attack(er) sees which traffic?

I am trying understand one thing about the KRACK attack. I see explanations like this everywhere: The hacker interferes with the initial handshake between your device and the WiFi router in ...
10
votes
1answer
561 views

Consequences of the WPA2 KRACK attack on older Windows and iOS clients

What are the real-world consequences of the WPA2 KRACK attacks on older Windows systems (XP/Vista) and iOS devices (10 and older) that will not be patched? I am aware of another question on this site ...
8
votes
1answer
123 views

Is it possible to determine router firmware version as a Wi-Fi client?

Let's say that I'm connected to some random Wi-Fi network and from that point I want to check the version of currently installed firmware, but let's exclude possibility of logging in with default ...
7
votes
1answer
1k views

Did iOS 11.1 fix KRACK for only iPhone 7 and newer?

This security article from Apple says that 11.1 fixes the KRACK vulnerability for iPhone 7 and newer devices. But what about the older devices? Has Apple not fixed them or does the vulnerability not ...
6
votes
3answers
318 views

KRACK and Keystream

I'm a little bit confused regarding the keystream. When installing the same session key again the nonce will be reset and start again. Session Key + Nonce = Keystream? The Keystream is now the part ...
5
votes
1answer
1k views

Would MAC filtering protect against KRACK?

Thinking of interim solutions to lower the chance of attack while waiting for patches for routers. Would setting a MAC filter, i.e. limiting WIFI access to only known devices, reduce or protect ...
5
votes
1answer
980 views

Has Ubuntu been patched for KRACKs?

I updated my Ubuntu 14.04 LTS. My /var/log/apt/history.log says that linux-signed-image-3.13.0-134-generic:amd64 has been installed. The changelog page says linux (3.13.0-134.183) trusty; ...
5
votes
1answer
127 views

Why is Android/Linux able to communicate with the wireless access point after the encryption key is set to zero?

As I understand it, when exploited against Linux and Android the KRACK attack results in the encryption key for the session being zeroed out on the device, so an eavesdropper can easily decrypt the ...
4
votes
1answer
473 views

KRACK: will there be an exploit soon?

Given that the probability is high that there are unpatched devices left even years from now (android devices, IoT-Things, etc.): Is it likely that there will be an exploit available soon? I think of ...
4
votes
1answer
230 views

Is this the correct flow of the KRACK attack?

I am not cryptography expert so please forgive this basic question. I am trying to understand how the flow of the KRACK attack takes place in order to better understand why the encryption protocol ...
4
votes
1answer
395 views

Will wireless isolation/AP isolation protect from KRACK?

Will using AP isolation on an Access Point protect connected clients from the KRACK vulnerability on that network?
4
votes
1answer
102 views

What difference does the attacker’s proximity to target / access point make to KRACK susceptibility?

In the Tools section of www.krackattacks.com it states: We remark that the reliability of our proof-of-concept script may depend on how close the victim is to the real network. If the victim is ...
4
votes
0answers
1k views

Are there any detection scripts available for WPA2 Key Reinstallation Attacks (KRACKs)? [duplicate]

I have just read about a new weaknesses in the WPA2 protocol called KRACKs. The authors of the paper says that they will release scripts that can be used to test if a network is exploitable when they ...
3
votes
2answers
631 views

How can Draytek products not be affected by KRACK as they claim?

According to Draytek on their website, When DrayTek wireless products, such as wireless routers and access points, are used as wireless base stations, they are not affected by the KRACK (Key ...
3
votes
1answer
212 views

Why is KRACK a protocol error and not implementation error?

I don't quite understand how KRACK is considered a protocol weakness rather than an implementation error. From reading about KRACK, I found following facts: There are more vulnerable implementation ...
3
votes
1answer
2k views

Does EAP-(T)TLS mitigate against KRACK?

It is my understanding that EAP-TLS and EAP-TTLS do not trust in WPA2 4-Way handshake, essentially establishing an authenticated tunnel between client and server independant on the WPA2 protocol. In ...
3
votes
2answers
374 views

How do I secure my home Wi-Fi network in light of KRACK? [duplicate]

Now that KRACK has been discovered to exploit WPA2, is it still possible to secure my home Wi-Fi network? If so, what steps should I take to secure it against KRACK attacks? Will there now be a need ...
2
votes
3answers
364 views

What are some best practices for WiFi security, in light of recently discovered vulnerabilities?

In the past few months, we've seen the revelation of several WiFi vulnerabilities (eg KRACK). It doesn't look like NIST has updated any of its best practices. How should we configure our enterprise ...
2
votes
1answer
165 views

Should I wait for Apple to fix the recent WPA2 KRACK exploit before downloading new apps over Wi-Fi?

Monday of this week: researchers announced the WPA2 KRACK exploit that effectively voids the protection of WPA2. Supposedly Microsoft already fixed it, Apple's working on patching it for Mac OS and ...
2
votes
1answer
194 views

Does only having one end of a wifi connection patched reduce the risks from KRACK?

From the official FAQ on the vulnerability (emphasis mine): So again, update all your devices once security updates are available. Finally, although an unpatched client can still connect to a ...
2
votes
2answers
355 views

Can enforcing a website to serve SSL requests only prevent SSLstrip from working?

I understand running a website with HSTS can help prevent an attacker using KRACK to downgrade the website to serve HTTP requests. What if our web server does not support HSTS? IIS has a setting ...
2
votes
1answer
111 views

Krack prevention by channel lock?

Is there a way for most of the field clients to lock their channel to the one they know their secured AP is handling? If I look at my channel can I tell immediately if there is an attack AP on me?
2
votes
1answer
2k views

Command Syntax for KRACK pentesting [duplicate]

I have been trying to pen test my router with a variety of ways, long story short, it locks out indefinitely with pixie wps until I go to the router admin page and click unlock. I tried DDOS with MDK, ...
2
votes
0answers
89 views

Apple iOS and KRACK

KRACK consist of several vulnerabilities (https://www.kb.cert.org/vuls/id/228519). Apple released patches against CVE-2017-13077, CVE-2017-13078 and CVE-2017-13080 from what I could find in their ...
2
votes
1answer
353 views

Can the client communicate with the AP after a KRACK attack?

When a client is forced to reinstall the key and to reset the nonce and the replay counter, what does it imply for the future communication between the client and the AP? There's a adversary in the ...
1
vote
2answers
248 views

Can a KRACK attack force a reauthentication handshake?

Is there any way an attack AP can break into an existing connection where handshake has already completed? Can the AP somehow force reauth?
1
vote
2answers
146 views

KRACK interim guidance stopgap

As operator of an important AP, e.g. Stack Overflow developers' office building, can I: Disconnect everybody. Change the AP shared key through Ethernet media. Securely distribute new key to wifi ...
1
vote
2answers
644 views

KRACK Attack vs sniffing

Trying to learn.... The ultimate difference between the vulnerability outlined in the answer posted here and KRACK attack is that with KRACK attack, the attacker does not need the AP pass phrase?
1
vote
1answer
173 views

Are there any KRACK-proof Wi-Fi sticks [closed]

Are there any known models of wifi dongles that are immune to four way nonce replay? The point being to be able to forget patching Windows and Linux, but to protect in the networking hardware. Is ...
1
vote
1answer
753 views

How do I check if my router is patched against the KRACK exploit?

Numerous Google searches found little useful information. The most comprehensive list is at http://www.kb.cert.org/vuls/byvendor?searchview&Query=FIELD+Reference=228519&SearchOrder=4 and most ...
1
vote
1answer
432 views

are older wpa_supplicant versions vulnerable to KRACK?

Are wpa_supplicant versions prior to 2.x (e.g. 0.2.x, 0.4.x, 0.6.x, 0.7.3, etc.) also vulnerable to any of the KRACK CVEs? I've looked at the source code but it's different enough from the 2.x ...
1
vote
1answer
104 views

Key reinstallation attack how does it work without a pre-shared key?

The author of the key reinstallation attack released scripts on Github to test AP and clients. To test the clients, you have to connect to a fake AP but you still need to know the pre-shared key. Of ...
1
vote
1answer
128 views

Blocking EAPOL packets [closed]

Is it possible to block EAPOL packets? What I'm trying to do is block the 4th message of the 4-Way-Handshake in order to trigger retransmission of message 3. This is what I thought to do. I'd like ...
1
vote
0answers
98 views

Forward packages to Access Point in KRACK attack

I am investigating the KRACK attack based on the published paper and their youtube video. I largely understand the attacks proposed in the paper as they are except for the completion of the ...
1
vote
0answers
224 views

Why didn't anyone think “use zero nonce and continue handshake” was a problem or at least strange in wpa-supplicant before now? [duplicate]

If someone is coding a secure connection library, I'd have expected this to stick out like a red flag to them. Why on earth would someone code logic like this (anyone working on it must have ...
0
votes
1answer
253 views

Is TP-LINK TD-W8151N vulnerable to KRACK?

I have a TP-LINK TD-W8151N 150Mbps Wireless N ADSL2+ Modem Router. Is this model vulnerable to KRACK? It is not specified in the WPA2 Security (KRACKs) Vulnerability Statement. Will TP-Link publish ...
0
votes
1answer
215 views

Can KRACK be used to obtain wifi credentials that could be used to normally connect to an AP? [duplicate]

I have a pretty simple question about KRACK. From what I have read it would be very common to be able to forge, decrypt, delay and block client packets as well as AP packets using KRACK. Does this ...
0
votes
2answers
657 views

How to detect KRACK attack?

I want to create a honeypot that will detect KRACK attacks. Is there any way to detect that kind of attack, are there any traces, any information that is stored in log files (syslog for example) that ...
0
votes
1answer
376 views

How vulnerable is ADB (Android Debugging Bridge) over wifi now that WPA2 is cracked?

How vulnerable is ADB over wifi now that WPA2 is cracked? Could hackers MITM/inject commands I am sending from my pc to my phone? My Windows PC is patched but no official fix is available for Android ...
0
votes
1answer
103 views

KRACK - does the ability to replay broadcast and multicast frames affect all clients in a wireless network?

I apologise if this is a silly question, I just want to make sure I understand the impact of CVE-2017-13078 and CVE-2017-13080 correctly. Is the following assumption true? If there is just one ...