Re: [OT] Breaking WPA2 by forcing nonce reuse

From	Celejar <celejar@gmail.com>
Newsgroups	linux.debian.user
Subject	Re: [OT] Breaking WPA2 by forcing nonce reuse
Date	2017-10-19 18:20 +0200
Message-ID	<uClI6-vv-7@gated-at.bofh.it> (permalink)
References	(5 earlier) <uBEMN-63U-3@gated-at.bofh.it> <uC7Yt-gE-1@gated-at.bofh.it> <uCgS6-5VF-31@gated-at.bofh.it> <uCkCm-8ki-25@gated-at.bofh.it> <uCl5o-8tQ-19@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Thu, 19 Oct 2017 16:39:34 +0100
Brian <ad44@cityscape.co.uk> wrote:

> On Thu 19 Oct 2017 at 11:07:01 -0400, Celejar wrote:
> 
> > On Thu, 19 Oct 2017 12:05:23 +0100
> > Brian <ad44@cityscape.co.uk> wrote:
> > 
> > > On Wed 18 Oct 2017 at 21:30:48 -0400, Celejar wrote:
> > 
> > ...
> > 
> > > > developers, etc., but why should I not be worried and upset about the
> > > > situation with my phone, printer, etc.?
> > > 
> > > Depends on the level of your concern. There are USB and ethernet
> > > connections to the printer. This might require physical relocation
> > > of the printer but it could be worth it to be worry-free. Or use a 
> > > Debian-based, wireless-enabled print server in close proximity to
> > > the printer.
> > 
> > Yes, what I'm probably going to do is use the printer's ethernet
> > connection along with a Powerline adapter into a nearby power outlet.
> 
> That's a good idea, but thinking on: there two ends to the connection,
> the printer and the sending device. Fixing printers is unlikely to be
> high on vendors' lists of priorities, but a fix is available when the
> sending device uses Debian. Isn't it sufficient to fix one end of the
> connection to dispose of the vulnerability?

As I understand it, when I print something from some device (say, my
Debian laptop), the device establishes a TCP/IP connection with the
printer to do the printing. In my (typical) setup, at the link level,
the device connects to the AP / switch / router wirelessly (via WPA2),
and so does the printer. Assuming the device and router are both
patched, the link between the device and the router is secure, but the
link between the router and printer is not, so any data I send between
the device and the printer will be secure as it traverses the first
link, but not the second. As I understand things, patching the router
doesn't really help secure the link between it and vulnerable devices
like the printer. Henrique recently noted that there is a setting
available on new OpenWRT and LEDE builds that can help, but it's
apparently not yet included in any release yet:

https://lists.debian.org/debian-user/2017/10/msg00593.html

Celejar

Thread

[OT] Breaking WPA2 by forcing nonce reuse Curt <curty@free.fr> - 2017-10-16 17:50 +0200
  Re: [OT] Breaking WPA2 by forcing nonce reuse "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2017-10-16 18:00 +0200
    Re: [OT] Breaking WPA2 by forcing nonce reuse "Alexander V. Makartsev" <avbetev@gmail.com> - 2017-10-16 19:00 +0200
      Re: [OT] Breaking WPA2 by forcing nonce reuse Henrique de Moraes Holschuh <hmh@debian.org> - 2017-10-18 15:40 +0200
        Re: [OT] Breaking WPA2 by forcing nonce reuse "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2017-10-18 19:10 +0200
    Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-16 21:20 +0200
      Re: [OT] Breaking WPA2 by forcing nonce reuse "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2017-10-17 05:20 +0200
        Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-17 17:00 +0200
          Re: [OT] Breaking WPA2 by forcing nonce reuse Brian <ad44@cityscape.co.uk> - 2017-10-17 20:30 +0200
            Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-19 03:40 +0200
              Re: [OT] Breaking WPA2 by forcing nonce reuse Brian <ad44@cityscape.co.uk> - 2017-10-19 13:10 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-19 17:10 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Brian <ad44@cityscape.co.uk> - 2017-10-19 17:40 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Dan Purgert <dan@djph.net> - 2017-10-19 18:10 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Ron Leach <ronleach@tesco.net> - 2017-10-19 18:20 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Brian <ad44@cityscape.co.uk> - 2017-10-20 15:00 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Dan Purgert <dan@djph.net> - 2017-10-20 19:30 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-19 18:20 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2017-10-20 06:40 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse rhkramer@gmail.com - 2017-10-20 17:30 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Brad Rogers <brad@fineby.me.uk> - 2017-10-20 17:40 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2017-10-20 18:50 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse <tomas@tuxteam.de> - 2017-10-19 18:10 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse David Wright <deblis@lionunicorn.co.uk> - 2017-10-19 20:50 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-20 03:00 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse David Wright <deblis@lionunicorn.co.uk> - 2017-10-21 21:30 +0200
  Re: [OT] Breaking WPA2 by forcing nonce reuse Brian <ad44@cityscape.co.uk> - 2017-10-16 22:00 +0200
  Re: [OT] Breaking WPA2 by forcing nonce reuse Larry Dighera <LDighera@att.net> - 2017-10-17 17:30 +0200

csiph-web