Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #187924 > unrolled thread

[OT] Breaking WPA2 by forcing nonce reuse

Started byCurt <curty@free.fr>
First post2017-10-16 17:50 +0200
Last post2017-10-17 17:30 +0200
Articles 8 on this page of 28 — 13 participants

Back to article view | Back to linux.debian.user

Contents

  [OT] Breaking WPA2 by forcing nonce reuse Curt <curty@free.fr> - 2017-10-16 17:50 +0200
    Re: [OT] Breaking WPA2 by forcing nonce reuse "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2017-10-16 18:00 +0200
      Re: [OT] Breaking WPA2 by forcing nonce reuse "Alexander V. Makartsev" <avbetev@gmail.com> - 2017-10-16 19:00 +0200
        Re: [OT] Breaking WPA2 by forcing nonce reuse Henrique de Moraes Holschuh <hmh@debian.org> - 2017-10-18 15:40 +0200
          Re: [OT] Breaking WPA2 by forcing nonce reuse "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2017-10-18 19:10 +0200
      Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-16 21:20 +0200
        Re: [OT] Breaking WPA2 by forcing nonce reuse "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2017-10-17 05:20 +0200
          Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-17 17:00 +0200
            Re: [OT] Breaking WPA2 by forcing nonce reuse Brian <ad44@cityscape.co.uk> - 2017-10-17 20:30 +0200
              Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-19 03:40 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Brian <ad44@cityscape.co.uk> - 2017-10-19 13:10 +0200
                  Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-19 17:10 +0200
                    Re: [OT] Breaking WPA2 by forcing nonce reuse Brian <ad44@cityscape.co.uk> - 2017-10-19 17:40 +0200
                      Re: [OT] Breaking WPA2 by forcing nonce reuse Dan Purgert <dan@djph.net> - 2017-10-19 18:10 +0200
                        Re: [OT] Breaking WPA2 by forcing nonce reuse Ron Leach <ronleach@tesco.net> - 2017-10-19 18:20 +0200
                          Re: [OT] Breaking WPA2 by forcing nonce reuse Brian <ad44@cityscape.co.uk> - 2017-10-20 15:00 +0200
                          Re: [OT] Breaking WPA2 by forcing nonce reuse Dan Purgert <dan@djph.net> - 2017-10-20 19:30 +0200
                      Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-19 18:20 +0200
                        Re: [OT] Breaking WPA2 by forcing nonce reuse "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2017-10-20 06:40 +0200
                          Re: [OT] Breaking WPA2 by forcing nonce reuse rhkramer@gmail.com - 2017-10-20 17:30 +0200
                          Re: [OT] Breaking WPA2 by forcing nonce reuse Brad Rogers <brad@fineby.me.uk> - 2017-10-20 17:40 +0200
                            Re: [OT] Breaking WPA2 by forcing nonce reuse "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2017-10-20 18:50 +0200
                    Re: [OT] Breaking WPA2 by forcing nonce reuse <tomas@tuxteam.de> - 2017-10-19 18:10 +0200
                      Re: [OT] Breaking WPA2 by forcing nonce reuse David Wright <deblis@lionunicorn.co.uk> - 2017-10-19 20:50 +0200
                        Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-20 03:00 +0200
                          Re: [OT] Breaking WPA2 by forcing nonce reuse David Wright <deblis@lionunicorn.co.uk> - 2017-10-21 21:30 +0200
    Re: [OT] Breaking WPA2 by forcing nonce reuse Brian <ad44@cityscape.co.uk> - 2017-10-16 22:00 +0200
    Re: [OT] Breaking WPA2 by forcing nonce reuse Larry Dighera <LDighera@att.net> - 2017-10-17 17:30 +0200

Page 2 of 2 — ← Prev page 1 [2]

#188125

FromBrad Rogers <brad@fineby.me.uk>
Date2017-10-20 17:40 +0200
Message-ID<uCHyV-5tE-5@gated-at.bofh.it>
In reply to#188112

[Multipart message — attachments visible in raw view] — view raw

On Fri, 20 Oct 2017 10:05:34 +0530
"tv.debian@googlemail.com" <tv.debian@googlemail.com> wrote:

Hello tv.debian@googlemail.com,

>I sent that a day ago, but for some reason it didn't make it to the
>list:

You're using google.  It's well known that they don't send your own list
posts back to you.

-- 
 Regards  _
         / )           "The blindingly obvious is
        / _)rad        never immediately apparent"
What the hell has this place done for me?
Selfish Rubbish - Public Image Ltd

[toc] | [prev] | [next] | [standalone]

#188129

From"tv.debian@googlemail.com" <tv.debian@googlemail.com>
Date2017-10-20 18:50 +0200
Message-ID<uCIEF-65j-5@gated-at.bofh.it>
In reply to#188125
On 20/10/2017 21:09, Brad Rogers wrote:
> On Fri, 20 Oct 2017 10:05:34 +0530
> "tv.debian@googlemail.com" <tv.debian@googlemail.com> wrote:
> 
> Hello tv.debian@googlemail.com,
> 
>> I sent that a day ago, but for some reason it didn't make it to the
>> list:
> 
> You're using google.  It's well known that they don't send your own list
> posts back to you.
> 

Sometime do, sometime don't, hard to know when a message doesn't show 
up, next time I'll try digging it from the archives.
Sorry for the noise then.

[toc] | [prev] | [next] | [standalone]

#188063

From<tomas@tuxteam.de>
Date2017-10-19 18:10 +0200
Message-ID<uClyp-sh-9@gated-at.bofh.it>
In reply to#188059
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, Oct 19, 2017 at 11:07:01AM -0400, Celejar wrote:
> On Thu, 19 Oct 2017 12:05:23 +0100
> Brian <ad44@cityscape.co.uk> wrote:
> 
> > On Wed 18 Oct 2017 at 21:30:48 -0400, Celejar wrote:

[...]

> Yes, what I'm probably going to do is use the printer's ethernet
> connection along with a Powerline adapter into a nearby power outlet.

And how secure are the powerline adapters? Most probably they're
broadcasting their stuff over your and your neighbour's AC net on
top of some unspecified proprietary modulation. Just sayin'...

;-)

Cheers
- -- tomás
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlnozbgACgkQBcgs9XrR2kbWgQCfQwm+ERBa9UL9HY38Z+YPuDOY
L9kAn3oJDwo3eNnFWZB2k3nA+skrytHm
=rld1
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#188076

FromDavid Wright <deblis@lionunicorn.co.uk>
Date2017-10-19 20:50 +0200
Message-ID<uCo3f-1MQ-17@gated-at.bofh.it>
In reply to#188063
On Thu 19 Oct 2017 at 18:07:20 (+0200), tomas@tuxteam.de wrote:
> On Thu, Oct 19, 2017 at 11:07:01AM -0400, Celejar wrote:
> > On Thu, 19 Oct 2017 12:05:23 +0100
> > Brian <ad44@cityscape.co.uk> wrote:
> > 
> > > On Wed 18 Oct 2017 at 21:30:48 -0400, Celejar wrote:
> 
> [...]
> 
> > Yes, what I'm probably going to do is use the printer's ethernet
> > connection along with a Powerline adapter into a nearby power outlet.
> 
> And how secure are the powerline adapters? Most probably they're
> broadcasting their stuff over your and your neighbour's AC net on
> top of some unspecified proprietary modulation. Just sayin'...

AIUI 128-bit AES on non-ancient ones. For your neighbour to eavesdrop,
they need to press their device's authenticate button when you press
yours. You can probably minimise the chances of the authentication
negotiation being picked up by plugging the devices into a filtered
power strip so that they can only see each other and not radiate into
the home wiring. We have two independent pairs running here, one on
the WAN side and one on the LAN. It looks odd as two units share the
same mains socket by using their pass-through power outlet.

How many neighbours you have depends on where you live. In Britain
you're likely to have a large number scattered randomly down the
street (sharing your phase). Here we have a pole-mount service
transformer that happens to serve just two houses and two street
lamps.

When we had the pole in our garden moved, they discovered that
the whole street's needed replacing, along with the transformers,
so we were lucky and didn't have to pay them anything for the move.
We just said stick it there please.

Cheers,
David.

[toc] | [prev] | [next] | [standalone]

#188101

FromCelejar <celejar@gmail.com>
Date2017-10-20 03:00 +0200
Message-ID<uCtPj-5o6-1@gated-at.bofh.it>
In reply to#188076
On Thu, 19 Oct 2017 13:46:08 -0500
David Wright <deblis@lionunicorn.co.uk> wrote:

> On Thu 19 Oct 2017 at 18:07:20 (+0200), tomas@tuxteam.de wrote:
> > On Thu, Oct 19, 2017 at 11:07:01AM -0400, Celejar wrote:
> > > On Thu, 19 Oct 2017 12:05:23 +0100
> > > Brian <ad44@cityscape.co.uk> wrote:
> > > 
> > > > On Wed 18 Oct 2017 at 21:30:48 -0400, Celejar wrote:
> > 
> > [...]
> > 
> > > Yes, what I'm probably going to do is use the printer's ethernet
> > > connection along with a Powerline adapter into a nearby power outlet.
> > 
> > And how secure are the powerline adapters? Most probably they're
> > broadcasting their stuff over your and your neighbour's AC net on
> > top of some unspecified proprietary modulation. Just sayin'...
> 
> AIUI 128-bit AES on non-ancient ones. For your neighbour to eavesdrop,
> they need to press their device's authenticate button when you press
> yours. You can probably minimise the chances of the authentication

See this thread:

https://security.stackexchange.com/questions/9725/are-powerline-ethernet-adapters-inherently-secure

and this post in particular:

https://security.stackexchange.com/a/76266

Celejar

[toc] | [prev] | [next] | [standalone]

#188174

FromDavid Wright <deblis@lionunicorn.co.uk>
Date2017-10-21 21:30 +0200
Message-ID<uD7D4-556-41@gated-at.bofh.it>
In reply to#188101
On Thu 19 Oct 2017 at 20:53:50 (-0400), Celejar wrote:
> On Thu, 19 Oct 2017 13:46:08 -0500
> David Wright <deblis@lionunicorn.co.uk> wrote:
> 
> > On Thu 19 Oct 2017 at 18:07:20 (+0200), tomas@tuxteam.de wrote:
> > > On Thu, Oct 19, 2017 at 11:07:01AM -0400, Celejar wrote:
> > > > On Thu, 19 Oct 2017 12:05:23 +0100
> > > > Brian <ad44@cityscape.co.uk> wrote:
> > > > 
> > > > > On Wed 18 Oct 2017 at 21:30:48 -0400, Celejar wrote:
> > > 
> > > [...]
> > > 
> > > > Yes, what I'm probably going to do is use the printer's ethernet
> > > > connection along with a Powerline adapter into a nearby power outlet.
> > > 
> > > And how secure are the powerline adapters? Most probably they're
> > > broadcasting their stuff over your and your neighbour's AC net on
> > > top of some unspecified proprietary modulation. Just sayin'...
> > 
> > AIUI 128-bit AES on non-ancient ones. For your neighbour to eavesdrop,
> > they need to press their device's authenticate button when you press
> > yours. You can probably minimise the chances of the authentication
> 
> See this thread:
> 
> https://security.stackexchange.com/questions/9725/are-powerline-ethernet-adapters-inherently-secure
> 
> and this post in particular:
> 
> https://security.stackexchange.com/a/76266

Interesting that people posting to a technical site would run their
devices using the factory default settings.

I can't agree with Rory Alsop saying that sockets/outlets have to be
on the same phase. With a 220 volt supply, individual households are
going to be on the same phase anyway. In the US, where the voltage
splits at the main box, I've tested using opposite sides (and with
GFCI outlets) and found no problem. If there used to be a problem,
I think they solved it by using the neutral wire which is common.

I've read about using another device to "capture" the legitimate
network but I think you have to get a good connection to the power
circuit to achieve that. (We might be unusual in having interior
switches on all our external power outlets.)

I've tried measuring interference on the radio, and the devices
themselves do give off quite a bit within a metre or so (FM/MW/LW),
but I can only detect similar interference noises at distant outlets
by poking the telescopic aerial at the socket itself. None of this
affects the stations when you've tuned then in, even our preferred FM
station which transmits from 66 miles away.

I haven't tested DAB as my DAB radio only works on FM, but in that
role it works perfectly even though it's only three metres from the
main Powerline nexus and the router. If we had an HD radio (US's DAB)
I think it would be another source of analogue interference rather
than suffering from it. But thank goodness the days of CB radio
are long past.

Perhaps one day I'll climb a tree and see if we can get broadcast TV,
as the nearest local station we can Roku is 100 miles away. But
the amount of advertising they carry kills any motivation.

All in all, the Powerlines suit us perfectly and are quite secure
enough in our situation. Perhaps not so good in a condo.

Cheers,
David.

[toc] | [prev] | [next] | [standalone]

#187930

FromBrian <ad44@cityscape.co.uk>
Date2017-10-16 22:00 +0200
Message-ID<uBjIl-8k2-7@gated-at.bofh.it>
In reply to#187924
On Mon 16 Oct 2017 at 15:42:09 +0000, Curt wrote:

> https://www.krackattacks.com/
> 
>  Our attack is especially catastrophic against version 2.4 and above of
>  wpa_supplicant, a Wi-Fi client commonly used on Linux. Here, the client will
>  install an all-zero encryption key instead of reinstalling the real key. 
> 
> Uh-oh.

Not particularly off-topic but not particularly useful in itself
either. We suppose there is probably an intention to advise Debian
users on what to do about this and how to go about mitigating it.
That would be real, valuable information.

-- 
Brian.

[toc] | [prev] | [next] | [standalone]

#187980

FromLarry Dighera <LDighera@att.net>
Date2017-10-17 17:30 +0200
Message-ID<uBBYC-497-11@gated-at.bofh.it>
In reply to#187924
On Mon, 16 Oct 2017 15:42:09 +0000 (UTC), Curt <curty@free.fr> wrote:

>https://www.krackattacks.com/
>
> Our attack is especially catastrophic against version 2.4 and above of
> wpa_supplicant, a Wi-Fi client commonly used on Linux. Here, the client will
> install an all-zero encryption key instead of reinstalling the real key. 
>
>Uh-oh.

 Latest Intel drivers:
https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00101&languageid=en-fr
for M.2 devices.

NetGear firmware updates:
https://kb.netgear.com/000049498/Security-Advisory-for-WPA-2-Vulnerabilities-PSV-2017-2826-PSV-2017-2836-PSV-2017-2837

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | linux.debian.user

csiph-web