Re: [OT] Breaking WPA2 by forcing nonce reuse

From	Celejar <celejar@gmail.com>
Newsgroups	linux.debian.user
Subject	Re: [OT] Breaking WPA2 by forcing nonce reuse
Date	2017-10-16 21:20 +0200
Message-ID	<uBj5E-84R-9@gated-at.bofh.it> (permalink)
References	<uBfOq-5GB-17@gated-at.bofh.it> <uBfY6-5Lw-7@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Mon, 16 Oct 2017 21:27:30 +0530
"tv.debian@googlemail.com" <tv.debian@googlemail.com> wrote:

> On 16/10/2017 21:12, Curt wrote:
> > https://www.krackattacks.com/
> > 
> >   Our attack is especially catastrophic against version 2.4 and above of
> >   wpa_supplicant, a Wi-Fi client commonly used on Linux. Here, the client will
> >   install an all-zero encryption key instead of reinstalling the real key.
> > 
> > Uh-oh.
> > 
> > 
>   It was addressed in Debian by DSA-3999-1 I think, but will probably 
> linger for a long time on routers, phones, appliances and IoT all over 
> the world. After Bluetooth a few weeks ago, now wpa2 wifi, most of the 
> wireless consumer electronic have it's base covered and ripe for cracking...

It's crucial to understand that there's a huge difference in severity
between BlueBorne and and KRACK: the former "allows attackers to take
control of devices", and "does not require the targeted device to be
paired to the attacker’s device, or even to be set on discoverable
mode" (!) [https://www.armis.com/blueborne/], whereas the latter
'simply' breaks WPA2, and can't really hurt you insofar as you're using
secure higher level protocols (ssh, SSL/TSL, HTTPS).

I don't mean to say that KRACK isn't nevertheless a huge problem,
but it doesn't seem to be nearly as serious as BlueBorne, and it isn't
going to be catastrophic to anyone not treating WiFi as a really secure
protocol. E.g., on my home network, I do use WPA, but I still require
SSH and so on for internal communication between my local hosts.

Celejar

Thread

[OT] Breaking WPA2 by forcing nonce reuse Curt <curty@free.fr> - 2017-10-16 17:50 +0200
  Re: [OT] Breaking WPA2 by forcing nonce reuse "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2017-10-16 18:00 +0200
    Re: [OT] Breaking WPA2 by forcing nonce reuse "Alexander V. Makartsev" <avbetev@gmail.com> - 2017-10-16 19:00 +0200
      Re: [OT] Breaking WPA2 by forcing nonce reuse Henrique de Moraes Holschuh <hmh@debian.org> - 2017-10-18 15:40 +0200
        Re: [OT] Breaking WPA2 by forcing nonce reuse "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2017-10-18 19:10 +0200
    Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-16 21:20 +0200
      Re: [OT] Breaking WPA2 by forcing nonce reuse "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2017-10-17 05:20 +0200
        Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-17 17:00 +0200
          Re: [OT] Breaking WPA2 by forcing nonce reuse Brian <ad44@cityscape.co.uk> - 2017-10-17 20:30 +0200
            Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-19 03:40 +0200
              Re: [OT] Breaking WPA2 by forcing nonce reuse Brian <ad44@cityscape.co.uk> - 2017-10-19 13:10 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-19 17:10 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Brian <ad44@cityscape.co.uk> - 2017-10-19 17:40 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Dan Purgert <dan@djph.net> - 2017-10-19 18:10 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Ron Leach <ronleach@tesco.net> - 2017-10-19 18:20 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Brian <ad44@cityscape.co.uk> - 2017-10-20 15:00 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Dan Purgert <dan@djph.net> - 2017-10-20 19:30 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-19 18:20 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2017-10-20 06:40 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse rhkramer@gmail.com - 2017-10-20 17:30 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Brad Rogers <brad@fineby.me.uk> - 2017-10-20 17:40 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2017-10-20 18:50 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse <tomas@tuxteam.de> - 2017-10-19 18:10 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse David Wright <deblis@lionunicorn.co.uk> - 2017-10-19 20:50 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-20 03:00 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse David Wright <deblis@lionunicorn.co.uk> - 2017-10-21 21:30 +0200
  Re: [OT] Breaking WPA2 by forcing nonce reuse Brian <ad44@cityscape.co.uk> - 2017-10-16 22:00 +0200
  Re: [OT] Breaking WPA2 by forcing nonce reuse Larry Dighera <LDighera@att.net> - 2017-10-17 17:30 +0200

csiph-web