Support NeoGAF

[Plum]

So, for a private home network, the potential hacker has to physically be nearby for anything to happen? I'm confused as to that, tbh.

 

[darkwing]

No, it just sits on my coffee table. It's literally like a remote for the TV.

unless there is a hacker in your neighborhood, then it is safe, the hacker has to literally be in the range of your wifi at home

 

[Fulminator]

Can someone explain like I'm five on how this can affect me

 

[close to the edge]

So, for a private home network, the potential hacker has to physically be nearby for anything to happen? I'm confused as to that, tbh.

Yes. Otherwise, how would they get access to your wifi?

The thread title is sensationalist. There's going to be patches for most devices (with an asterisk, if you have an Android phone that's no longer receiving updates or some obscure IoT device, you might be SOL). Currently, there's no easy way to use the exploit, since the security researcher didn't publish his proof-of-concept code yet (he wants to wait until all the big vendors have released patches). As we speak, there's probably black hats (criminal hackers) scrambling to make a piece of software to exploit this vulnerability, depending on how easy it is to implement, it might be done, might not be done for a while. Most importantly, a lot of your traffic will still be safe, since it's already encrypted.

 

[darkwing]

So, for a private home network, the potential hacker has to physically be nearby for anything to happen? I'm confused as to that, tbh.

yes

 

[low-G]

So, for a private home network, the potential hacker has to physically be nearby for anything to happen? I'm confused as to that, tbh.

Ever hear of wardriving? People drive around looking for vulnerable WiFi.

 

[Hari Seldon]

unless there is a hacker in your neighborhood, then it is safe, the hacker has to literally be in the range of your wifi at home

Well someone outside of your neighborhood can park near your house and do it I would assume.

 

[fertygo]

So.. we can just never use public wifi for un updated device right?

 

[Plum]

Yes. Otherwise, how would they get access to your wifi?

yes

Thanks. That's somewhat reassuring!

 

[mullet2000]

So.. we can just never use public wifi for un updated device right?

Right. You would be putting the device at risk.

 

[xKilltheMx]

Wait so limiting my router to only connect to specific Mac Addresses won't help or will help?

 

[The_Dama]

Just make your your SSID invisible for now.

 

[low-G]

Wait so limiting my router to only connect to specific Mac Addresses won't help or will help?

You can sample MAC addresses with trivial snooping even without this exploit, then spoof the MAC. Completely useless.

Just make your your SSID invisible for now.

Similarly, that does nothing at all.

 

[Paganmoon]

unless there is a hacker in your neighborhood, then it is safe, the hacker has to literally be in the range of your wifi at home

They have to be on site so to speak for the attack it seems.

Don't worry so much about your home as WiFi stuff for business especially small business.

Things like WiFi security cameras or point of sale systems or whatever even beyond just public networks.

Technically, this could be used away from your home network, if the attacker knows your homenetwork's SSID. Most devices are set to autoconnect to known networks, no matter where they are.

So an attacker could be in a well visited and crowded place and use this hack on a common/well known SSID name, and potentially get many phones and laptops to connect to it.

Edit: come to think of, you'd probably still need the homenetwork to send the initial handshake that you hijack, so yeah, probably not possible

 

[Somnid]

So.. we can just never use public wifi for un updated device right?

You would never communicate unsecure data over a public wireless access point because other people also have access to that access point by virtue of it being public, so it doesn't matter.

 

[moustascheman]

So my phone uses android 5.1. How screwed am I?

 

[StarCreator]

You would never communicate unsecure data over a public wireless access point because other people also have access to that access point by virtue of it being public, so it doesn't matter.

A lot of public places actually use WPA2 instead of leaving their network open. - mostly to make sure only customers are using it, I'm sure. Even then, people tend to think of those networks as more secure, but this exploit basically makes a WPA2 network as secure as an unsecured one.

 

[low-G]

Technically, this could be used away from your home network, if the attacker knows your homenetwork's SSID. Most devices are set to autoconnect to known networks, no matter where they are.

So an attacker could be in a well visited and crowded place and use this hack on a common/well known SSID name, and potentially get many phones and laptops to connect to it.

A hacker wouldn’t need this exploit to hack devices this way. But he would need some good antennas.

 

[Mechanized]

Just make your your SSID invisible for now.

I haven't kept up with the concept at all, but can't people just wardrive to get on your network even if the SSID isn't broadcasted?

 

[itwasTuesday]

Aww great.

 

[velociraptor]

I haven't kept up with the concept at all, but can't people just wardrive to get on your network even if the SSID isn't broadcasted?

What does 'wardrive' mean?

 

[darkwing]

So my phone uses android 5.1. How screwed am I?

screwed unless the phone manufacturer releases a security update

 

[esmith08734]

Hiding SSID is like, the most basic first step in protection. It really does nothing and won't work here.

 

[esmith08734]

What does 'wardrive' mean?

People will drive-by and identify potential vulnerabilities in someone's network.

 

[Htown]

so would a windows update be enough to fix this?

 

[low-G]

I haven't kept up with the concept at all, but can't people just wardrive to get on your network even if the SSID isn't broadcasted?

They don’t need the SSID, they use the MAC, which is always broadcast no matter what (it is on a lower level than this attack)

 

[esmith08734]

so would a windows update be enough to fix this?

MS claims to have a patch.

 

[epmode]

so would a windows update be enough to fix this?

Yes. MS says they’ve already patched the vulnerability so it sounds like W7/8/10 are safe.

 

[Naked Snake]

I use dd-WRT on an old Linksys router as a repeater... Need to start looking for a new one, right?

 

[ZOONAMI]

What?

So if I have a fiber line going into an Asus router what do I need to do? I don’t have any android devices other than a hardwired Sony android tv.

I’m honestly not sure if I’m running wep wpa or wpa2 but it’s the one that lets you use pretty much any password you want.

Pretty sure that’s just WEP, which I’ve always just stuck with because I like to set my own password. Always something with characters and caps and numbers etc, but it’s just nice to have something I can actually remember vs a bunch of random garbage.

 

[Fulminator]

So is this more of a concern about privacy, or like uploading viruses or whatever on to ones device?

Or both?

 

[Mortemis]

Damn, this is crazy.

So Apple hasn't said anything about this yet?

 

[The Pet of the Month]

Ah jeez, now I have to wait and see what Netgear's patched. They released a security update not too long ago, but it seems in their usual fashion they didn't bother telling us what they fixed -_-

 

[TripleBee]

When I first read it - it sounded like you had to have access to the network to deploy the exploit, meaning that a secure home network was safe.

Only public networks, or shared company networks were in danger.

This new explanation no longer seems to back that up ?

 

[low-G]

Problem is bad, but OP is going a little too far. Attacker still cannot see https encrypted data (which honestly in this day and age covers pretty much everything important

But then they can poison your DNS, so you think you’re connecting to a secure site but you’re connecting to the hacker’s laptop. Also a lot of sites don’t do HTTPS perfectly.

When I first read it - it sounded like you had to have access to the network to deploy the exploit, meaning that a secure home network was safe.

Only public networks, or shared company networks were in danger.

This new explanation no longer seems to back that up ?

Where did you assume they have to be connected already? Which phrase?

 

[TripleBee]

But then they can poison your DNS, so you think you’re connecting to a secure site but you’re connecting to the hacker’s laptop. Also a lot of sites don’t do HTTPS perfectly.



Where did you assume they have to be connected already? Which phrase?

"As Hudson notes, the attacker would have to be on the same base station as the victim, which restricts any attack's impact somewhat."

But I clearly misunderstood what that meant

 

[low-G]

"As Hudson notes, the attacker would have to be on the same base station as the victim, which restricts any attack's impact somewhat."

But I clearly misunderstood what that meant

No, I am serious. Where is this 'Hudson' thing from? I asked another person in another thread and they never replied.

 

[Future]

What’s funny about is all those hacker shows where you see people get into people’s phones in seconds of being on the same network as them.... that shit is true haha

 

[valinthyne]

So does this essentially mean POS systems are compromised and credit card data is there for the taking till they're patched?

 

[Kinokou]

So with HTTPS still ensuring a layer of safety, I'm assuming two step verification and encrypted messaging apps are a-okay to protect account data and messages/images?

 

[sssstententen]

So does this essentially mean POS systems are compromised and credit card data is there for the taking till they're patched?

Essentially, yes, any that are on Wireless networks. So especially newer stores with mobile POS systems.

 

[texhnolyze]

It's CLIENT SIDE.

What we need is every WiFi device to get patched ie phones, laptops, servers, tablets, iot, pos systems... basically fuckin anything and everything

Client = your device ie your phone (not your router)

I still don't get it.

If my PC use a wifi from a router, will it be safe?

Also, is it worldwide?

 

[j0hnny_385]

DD-WRT patch already in the works:

http://svn.dd-wrt.com/changeset/33525

Based brainslayer. <3

 

[sssstententen]

I still don't get it.

If my PC use a wifi from a router, will it be safe?

Also, is it worldwide?

Yes it’s worldwide, yes you need to update, and no using WiFi is not safe.

Anyone who can’t or doesn’t know how to patch their network/devices who can get hardwired should do so.

 

[Transistor]

So does this essentially mean POS systems are compromised and credit card data is there for the taking till they're patched?

If those POS machines use wifi, yes

 

[epmode]

I still don't get it.

If my PC use a wifi from a router, will it be safe?

Also, is it worldwide?

The router you’re using doesn’t have much to do with whether or not you’re vulnerable to this attack.

Your PC is the client. If the client is patched, then it’s OK. Microsoft said they’ve already pached the problem so you should be OK if you’re running a fully updated Windows 7, 8, or 10.

I’d like some confirmation on MS’ fix though.

And yes, this affects virtually all wifi devices worldwide.

 

[Deleted member 465307]

I have a lot of old devices. I don't really care if people spy on which YouTube videos I watch or which NeoGAF pages I visit. However, I obviously do care about banking information and similar content.

Can I continue to use my standard WiFi for most things and then switch to Ethernet for all financials? Or would that approach still make me unsafe?

 

[TripleBee]

No, I am serious. Where is this 'Hudson' thing from? I asked another person in another thread and they never replied.

I took it from the other thread, but a quick google shows that it was Alex Hudson, Iron Group CTO

https://www.theregister.co.uk/2017/10/16/wpa2_inscure_krackattack/

Not sure if reliable at all...

 

[Vanillalite]

Essentially, yes, any that are on Wireless networks. So especially newer stores with mobile POS systems.

Yes.

It's these types of instances that are of a bigger worry than people's home WiFi.

 

[epmode]

I have a lot of old devices. I don't really care if people spy on which YouTube videos I watch or which NeoGAF pages I visit. However, I obviously do care about banking information and similar content.

Can I continue to use my standard WiFi for most things and then switch to Ethernet for all financials? Or would that approach still make me unsafe?

Technically, you might be OK to use those financial sites on a compromised device. So long as the site has a proper implementation of HTTPS, the most an attacker would be able to see are data packets filled with encrypted text (gibberish).

I wouldn’t rely on this, however. All you can be certain of is whether or not a site is using HTTPS. It’s effectively impossible for you to know if it’s implemented perfectly and it’s best to be on a secure device just in case there’s a problem.