Wi-Fi has been hacked

[Newsfeed]

Wi-Fi has been hacked

Security researchers will release a proof-of-concept attack on the Wi-Fi Protected Access II (WPA2) protocol today, which lets attackers eavesdrop on traffic between devices and access points, reported Ars Technica.

 

[supersunbird]

Oh damn!

 

[Wall]

Not Good

 

[greg0205]

This disturbs me... A lot.

 

[Gtx Gaming]

Time for WPA3

 

[Geoff.D]

Another reason why one should use wi-fi only for mobility and not in any situation where good old fashioned wired connections are possible.

 

[backstreetboy]

Can they (how?) get the password?

 

[greg0205]

Can they (how?) get the password?

Not specified in the article. They can eavesdrop on traffic 'tho... Waiting on the krackattacks disclosure for the whole picture.

 

[Swa]

So is this all devices that allow it or only some?

 

[Thor]

Oh gosh! This is not good.

Luckily my entire infrastructure is Ubiquity so they should be on top of it once it is announced.

 

[FaSMaN]

Hmm, how can they get past the AES encryption, or does the keys get exchanged during the handshake, in that case this is a huge exploit....

 

[Dark Agent]

Hmm, how can they get past the AES encryption, or does the keys get exchanged during the handshake, in that case this is a huge exploit....

You will not get the actual password, but easily hijack a Wi-Fi connection and be connected to the Wi-Fi. A lot more can be done.
Lot will put MAC Address filtering but that can be spoof/faked. So yes most are doomed.

My Home Wifi Is fully secured, uses private/public key manually with AES Encryption. Pain in the ass to setup but I expected this day to come. Time to send emails 'I TOLD YOU SO'.

 

[access]

this has been around for a while, but making things public usually takes some time

 

[b1nary]

Oh gosh! This is not good.

Luckily my entire infrastructure is Ubiquity so they should be on top of it once it is announced.

+1 love them

 

[Jacques]

More information, and speculation, over at Reddit:
https://www.reddit.com/r/sysadmin/comments/76lj5q/this_is_a_core_protocollevel_flaw_in_wpa2_wifi/

Any news from Telkom, Rain, Mweb about updates to their devices?

Vendors (overseas) were informed in August.
https://twitter.com/kennwhite/status/919654056137756672

patches have already been released by some vendors, but they're workarounds at best. This is a protocol design flaw.

https://twitter.com/kennwhite/status/919745625729708032

Lovely quote :-/

flaw in the 4-way handshake. As I understand it, in many cases, this will be: "Throw your router away and buy a new one."

https://twitter.com/kennwhite/status/919525719927087104

 

[cpu.]

Will device isolation at least stop LAN attacks on connected devices? Hope so.

 

[Rickster]

Doesnt bother me at all.

 

[Jacques]

What if there are no security updates for my router?

Our main attack is against the 4-way handshake, and does not exploit access points, but instead targets clients. So it might be that your router does not require security updates. We strongly advise you to contact your vendor for more details. In general though, you can try to mitigate attacks against routers and access points by disabling client functionality (which is for example used in repeater modes) and disabling 802.11r (fast roaming). For ordinary home users, your priority should be updating clients such as laptops and smartphones.

Because Android uses wpa_supplicant, Android 6.0 and above also contains this vulnerability. This makes it trivial to intercept and manipulate traffic sent by these Linux and Android devices. Note that currently 41% of Android devices are vulnerable to this exceptionally devastating variant of our attack.

https://www.krackattacks.com/

 

[gregmcc]

Wow - this is a nasty one. Vendors need to release fixes asap.

 

[Vice]

Shoot, can we ever be safe