KRACK vulnerability - What you need to know

[Jamie McKane]

KRACK vulnerability - What you need to know

This is a bad vulnerability in that it likely affects billions of devices.

 

[Thor]

Already patched. You guys are a bit late.

 

[C4Cat]

Already patched. You guys are a bit late.

I wish Thor would read before commenting. Making stupid comments because he's too lazy to read seems to becoming a habit

 

[ginggs]

Already patched. You guys are a bit late.

Have all those millions of Android devices already received updates?

 

[Thor]

I wish Thor would read before commenting. Making stupid comments because he's too lazy to read seems to becoming a habit

I don't read mybb articles.

 

[Hamish McPanji]

I don't read mybb articles.

Then doing a stfu would be a good option

 

[Suspect99]

I don't read mybb articles.

 

[biometrics]

I don't read mybb articles.

Dude, do you realise how stupid you sound now?

 

[Sinbad]

Dude, do you realise how stupid you sound now?

Nope. He's too stupid to realize how stupid he is

 

[RyanPCMR]

My wife and her Samsung has not been patched as well as my OnePlus 3 although our Windows 10 devices seems to have been.

 

[damian24]

Article says that HTTPS secures the traffic... problem is that you can strip the HTTPS with a (very practical) man-in-the-middle attack leaving joe blogs non-the-wiser that he's doing his banking in clear text.

D

 

[system32]

LEDE Project & LineageOS

Already patched. You guys are a bit late.

Have all those millions of Android devices already received updates?

LEDE on home router
LEDE 17.01.4 release includes fixes for the KRACK bugs in the WPA Protocol
https://lede-project.org/releases/17.01/notes-17.01.4

LineageOS on Smart Phone:
All Official LineageOS 14.1 Builds Post 17/10/2017 Are Safe From the KRACK Vulnerability
https://www.xda-developers.com/future-lineageos-14-1-builds-safe-krack/

I'm sorted.

 

[Swa]

I think this puts it in perspectively nicely. There has been all sorts of ridiculous claims even that WPA2 is fundamentally broken and unfixable. WPA hasn't been broken and it's only one aspect of how it's implemented that's the problem. This is easy to fix. The real problem is with device support and ease of patching however. WPA would only be fundamentally broken and unfixable if something like the cipher used is cracked.

Article says that HTTPS secures the traffic... problem is that you can strip the HTTPS with a (very practical) man-in-the-middle attack leaving joe blogs non-the-wiser that he's doing his banking in clear text.

D

Please elaborate. HTTPS was designed to resist man in the middle attacks and any tampering with a connection will immediately be flagged in any decent browser as an unsecure connection. I've gotten that with some bad access points.

 

[ginggs]

LEDE on home router
LEDE 17.01.4 release includes fixes for the KRACK bugs in the WPA Protocol
https://lede-project.org/releases/17.01/notes-17.01.4

From the release notes:

While the LEDE 17.01.4 release includes fixes for the KRACK bugs in the WPA Protocol disclosed earlier this week in the router firmware, these fixes do not fix the problem on the client-side.

 

[Mr Scratch]

Kinda obvious, a router side patch doesn’t magically patch the client

 

[gregmcc]

Time to patch all my IoT ESP8266 devices. Looking to get a new AP as my old Netgear will probably never receive an update.
At least dd-wrt have released patches.

 

[ginggs]

Kinda obvious, a router side patch doesn’t magically patch the client

Exactly, yet people keep posting about upgrading their routers and APs.

 

[system32]

Exactly, yet people keep posting about upgrading their routers and APs.

I'm sorted.

Using LineageOS [Android] on client.

All Official LineageOS 14.1 Builds Post 17/10/2017 Are Safe From the KRACK Vulnerability
https://www.xda-developers.com/future-lineageos-14-1-builds-safe-krack/

 

[ginggs]

Already patched. You guys are a bit late.

I'm sorted.

Well, I'm very happy for you and Thor.

Is everyone going to comment in this thread once they are patched?