Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #187978

Re: [OT] Breaking WPA2 by forcing nonce reuse

From Celejar <celejar@gmail.com>
Newsgroups linux.debian.user
Subject Re: [OT] Breaking WPA2 by forcing nonce reuse
Date 2017-10-17 17:00 +0200
Message-ID <uBBvA-3HQ-9@gated-at.bofh.it> (permalink)
References <uBfOq-5GB-17@gated-at.bofh.it> <uBfY6-5Lw-7@gated-at.bofh.it> <uBj5E-84R-9@gated-at.bofh.it> <uBqA9-4Km-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

On Tue, 17 Oct 2017 08:43:00 +0530
"tv.debian@googlemail.com" <tv.debian@googlemail.com> wrote:

> On 17/10/2017 00:49, Celejar wrote:
> > On Mon, 16 Oct 2017 21:27:30 +0530
> > "tv.debian@googlemail.com" <tv.debian@googlemail.com> wrote:

...

> >> the world. After Bluetooth a few weeks ago, now wpa2 wifi, most of the
> >> wireless consumer electronic have it's base covered and ripe for cracking...
> > 
> > It's crucial to understand that there's a huge difference in severity
> > between BlueBorne and and KRACK: the former "allows attackers to take
> > control of devices", and "does not require the targeted device to be
> > paired to the attacker’s device, or even to be set on discoverable
> > mode" (!) [https://www.armis.com/blueborne/], whereas the latter
> > 'simply' breaks WPA2, and can't really hurt you insofar as you're using
> > secure higher level protocols (ssh, SSL/TSL, HTTPS).
> > 
> > I don't mean to say that KRACK isn't nevertheless a huge problem,
> > but it doesn't seem to be nearly as serious as BlueBorne, and it isn't
> > going to be catastrophic to anyone not treating WiFi as a really secure
> > protocol. E.g., on my home network, I do use WPA, but I still require
> > SSH and so on for internal communication between my local hosts.
> > 
> > Celejar
> > 
> 
> Agreed, my post was just a quick reaction to an 'OT' labeled thread, not 
> a lecture on the respective merits of those vulnerabilities, or an 
> attempt to spread F.U.D.. Sorry if it came out this way (not a native 
> speaker).

I actually do agree with what you wrote, I was just trying to add a bit
of detail.

> That being said, for a lot of the common use cases having an attacker 
> sit on the assumed-to-be secured wifi and able to intercept traffic for 
> days, weeks, months maybe since the patching will be as usual "patchy", 
> is bad enough. It is not the same as the "bombing the dhcp server and 

...

> So using https or better for communications on the local network is a 
> good idea, but is it the norm? Many router firmwares or built-in 
> webservers from cameras to printers default to http, sometime don't even 
> offer https as an option.

Yes, after I sent my mail I realized that my wirelessly networked
printer is going to be a problem. Some printers apparently support
access via SSL/TLS (IPPS), but it looks like mine (Brother
HL-2280DW) does not. And what are the odds that Brother will do a
firmware update to patch WPA for this some 6 years old model ;)

> This isn't as bad as blueborne but it is nonetheless another of the most 
> widely used wireless standard being broken in a short time.

Certainly.

> It's patched in most distributions, and in router firmwares like LEDE 
> already, was patched in some BSD even before publication, but how long 
> before we see a patches for all affected devices?

Never - for many / most Android devices, my printer (probably), etc.

> By the way, since we are security OT'ing, check your RSA keys if you 
> used Infineon products to generate it.[1]
> 
> [1] https://lwn.net/Articles/736520/rss

Yeah, just saw that on Ars this morning:

https://arstechnica.com/information-technology/2017/10/crypto-failure-cripples-millions-of-high-security-keys-750k-estonian-ids/

Another day, another critical vulnerability ...

Celejar

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[OT] Breaking WPA2 by forcing nonce reuse Curt <curty@free.fr> - 2017-10-16 17:50 +0200
  Re: [OT] Breaking WPA2 by forcing nonce reuse "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2017-10-16 18:00 +0200
    Re: [OT] Breaking WPA2 by forcing nonce reuse "Alexander V. Makartsev" <avbetev@gmail.com> - 2017-10-16 19:00 +0200
      Re: [OT] Breaking WPA2 by forcing nonce reuse Henrique de Moraes Holschuh <hmh@debian.org> - 2017-10-18 15:40 +0200
        Re: [OT] Breaking WPA2 by forcing nonce reuse "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2017-10-18 19:10 +0200
    Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-16 21:20 +0200
      Re: [OT] Breaking WPA2 by forcing nonce reuse "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2017-10-17 05:20 +0200
        Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-17 17:00 +0200
          Re: [OT] Breaking WPA2 by forcing nonce reuse Brian <ad44@cityscape.co.uk> - 2017-10-17 20:30 +0200
            Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-19 03:40 +0200
              Re: [OT] Breaking WPA2 by forcing nonce reuse Brian <ad44@cityscape.co.uk> - 2017-10-19 13:10 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-19 17:10 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Brian <ad44@cityscape.co.uk> - 2017-10-19 17:40 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Dan Purgert <dan@djph.net> - 2017-10-19 18:10 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Ron Leach <ronleach@tesco.net> - 2017-10-19 18:20 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Brian <ad44@cityscape.co.uk> - 2017-10-20 15:00 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Dan Purgert <dan@djph.net> - 2017-10-20 19:30 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-19 18:20 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2017-10-20 06:40 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse rhkramer@gmail.com - 2017-10-20 17:30 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Brad Rogers <brad@fineby.me.uk> - 2017-10-20 17:40 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2017-10-20 18:50 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse <tomas@tuxteam.de> - 2017-10-19 18:10 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse David Wright <deblis@lionunicorn.co.uk> - 2017-10-19 20:50 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-20 03:00 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse David Wright <deblis@lionunicorn.co.uk> - 2017-10-21 21:30 +0200
  Re: [OT] Breaking WPA2 by forcing nonce reuse Brian <ad44@cityscape.co.uk> - 2017-10-16 22:00 +0200
  Re: [OT] Breaking WPA2 by forcing nonce reuse Larry Dighera <LDighera@att.net> - 2017-10-17 17:30 +0200

csiph-web