Support NeoGAF

[Entroyp]

People need not to stress too much from this, your most sensitive PII is already out there thanks to equifax.

On a serious note, make sure you update all your devices and not think much about this for now.

 

[ty_hot]

Just to check if I understood:

with this breach someone can come and, with the right equipment and after finding a device that is not patched (easy), pretends that he is the router, so that he can read all infor that goes through tihs network (including the 'safe' devices, patched)?

And where does the router comes in the equation? Few pages back there was people saying that there are already update files for some routers (dd wrt). How does it change anything? In the other thread it was speculated that if your device or your router is patched you are safe. Is it?

I just updated my router to dd wrt (I was already going to do it, just stopped in the middle of the process a few months ago lol anyway, I dont think its a patched fw because its from 10/10).

 

[Hello? This is Hailun!]

the one fucking person on my network using an android device is my step dad........damn it

Can patching the router alone and at least leave all other devices and updated units safe if someone else connects with an un-updated device?

1> Your step dad's android being compromised (which isn't going to happen) wouldn't break it for you.

2> Patching your router isn't the fix, patching your device is. The exploit happens when your device tries to reassociate with an AP either due to roaming, time out, association drop, etc.

 

[Nelo Ice]

So I have a uverse router. Is there an update out for it yet?.

 

[Hello? This is Hailun!]

Just to check if I understood:

with this breach someone can come and, with the right equipment and after finding a device that is not patched (easy), pretends that he is the router, so that he can read all infor that goes through tihs network (including the 'safe' devices, patched)?

Can only read your transmissions. Has to basically be in the room with you. Has to wait for your device to reassociate with an AP.

 

[ViciousDS]

1> Your step dad's android being compromised (which isn't going to happen) wouldn't break it for you.

2> Patching your router isn't the fix, patching your device is. The exploit happens when your device tries to reassociate with an AP either due to roaming, time out, association drop, etc.

awesome.....time to patch a bunch of stuff in the next week.....this doesn't seem too bad, but I avoid public Wi-Fi's like the plague even when they have it anyways


So basically someone has to be literally right there when I'm establishing connection to the router......with my routers info.....yes, its definitely a problem but I can't see home networks unless you are in a massively rich area being effected and public wifis would be insanely easy to target

 

[Noema]

the one fucking person on my network using an android device is my step dad........damn it

Can patching the router alone and at least leave all other devices and updated units safe if someone else connects with an un-updated device?

Don't worry too much about it unless you live in a crowded condo filled with wanna be hackers. And your network is unlikely to be compromised by one vulnerable device. Feasible but super unlikely.

 

[Hello? This is Hailun!]

awesome.....time to patch a bunch of stuff in the next week.....this doesn't seem too bad, but I avoid public Wi-Fi's like the plague even when they have it anyways


So basically someone has to be literally right there when I'm establishing connection to the router......with my routers info.....yes, its definitely a problem but I can't see home networks unless you are in a massively rich area being effected and public wifis would be insanely easy to target

Some stuff was secretly patched over the past month, some stuff patches dropped today.




Android is a particular worry because if someone is *really* smart they could hack the actual wifi network, send deauths, force the exploit, and then sent apt-get or apt-put to android phones to install software.

 

[Transistor]

So the October Android Security Patch level should fix this?

 

[RoadHazard]

awesome.....time to patch a bunch of stuff in the next week.....this doesn't seem too bad, but I avoid public Wi-Fi's like the plague even when they have it anyways


So basically someone has to be literally right there when I'm establishing connection to the router......with my routers info.....yes, its definitely a problem but I can't see home networks unless you are in a massively rich area being effected and public wifis would be insanely easy to target

How do you figure that? I can see like 15 Wi-Fi networks on my phone from my living room.

 

[MikeHaggar]

Isn't it relatively easy to brute force someone's wifi password? Assuming it is, once you are on the network you can set up packet sniffer and catch everything. How is this worse than that scenario?

 

[Acorn]

Glad to see tech companies moving quickly on this.

WPA2 had a good run all in all.

 

[emag]

So the October Android Security Patch level should fix this?

Google says November 6.

How do you figure that? I can see like 20 Wi-Fi networks on my phone sitting in my living room.

I guess those of us in urban areas are hit harder than rural folks.

Isn't it relatively easy to brute force someone's wifi password?

No.

 

[GodofWine]

So a black van with some Wifi antennas on the roof outside my house is an issue...

This sounds like a nightmare for hospitals and major industries, and not so much for a typical person.

 

[Hello? This is Hailun!]

Isn't it relatively easy to brute force someone's wifi password? Assuming it is, once you are on the network you can set up packet sniffer and catch everything. How is this worse than that scenario?

It's easy in that you basically setup the software to do it.

But that requires deauth, capturing the handshake, and then running decrypt on the key, which can take *years*.

 

[ViciousDS]

How do you figure that? I can see like 15 Wi-Fi networks on my phone from my living room.

I can limit the power output on my router to only work within my house if need be

It's easy in that you basically setup the software to do it.

But that requires deauth, capturing the handshake, and then running decrypt on the key, which can take *years*.

Yes, this sounds like its more of a nightmare for hospitals, banks and major corps which will obviously be the bigger targets....if not THE targets they want data from

 

[RoadHazard]

Isn't it relatively easy to brute force someone's wifi password? Assuming it is, once you are on the network you can set up packet sniffer and catch everything. How is this worse than that scenario?

If it's a very weak password, I guess? Not if it's strong. Would take a very long time, and wouldn't be worth the effort I'd think.

 

[Hello? This is Hailun!]

So a black van with some Wifi antennas on the roof outside my house is an issue...

This sounds like a nightmare for hospitals and major industries, and not so much for a typical person.

1> Not really, because if you're associated with your AP and it doesn't completely dump your client when your device goes to sleep, you won't reassociate for the black van to potentially see the exploit.


2> Most important info like CC, health records, etc are often transmitted on hardwire systems anyway.

 

[Sesha]

Oh wow. Crazy.

Shame my Windows laptop screen is broken and needs fixing, I don't have the money to have it fixed rn, and the only other convenient access I have is Mac devices.

 

[Hello? This is Hailun!]

How do you figure that? I can see like 15 Wi-Fi networks on my phone from my living room.

I can limit the power output on my router to only work within my house if need be

You tha real MVP.


However, in MDU and suburbs over the next 5 years or so? Yeah, my job is working to fix the "help I'm surrounded by 73 SSIDs" problem.

 

[ViciousDS]

You tha real MVP.


However, in MDU and suburbs over the next 5 years or so? Yeah, my job is working to fix the "help I'm surrounded by 73 SSIDs" problem.

ooooooo,

sound like fun lol


I already can see 15 networks.....only 3 are actual routers though lol


for those who want a short term solution that i think might work


Opera has a VPN built right into their browser for easy use.....maybe use that for the time being if you wish to browse and don't want to pay

 

[McStickenstein]

So my old Dell tablet stuck on Android 5.0 is out of luck with an update? Dell already officially announced that they dropped support for it a while back.

 

[CreepingFear]

.

 

[LoveCake]

I just had an update on my Linux Mint.

WPA and WPA2 are methods for securing wireless networks, the former using IEEE 802.1X, and the latter using IEEE 802.11i. This software provides key negotiation with the WPA Authenticator, and controls association with IEEE 802.11i networks.

This site seems to explain it pretty well for the non-technically minded people.
KRACK Wi-Fi attack threatens all networks: How to stay safe and what you need to know
https://www.pcworld.com/article/3233308/security/krack-wi-fi-security-flaw-faq-tips.html?

 

[Hello? This is Hailun!]

So my old Dell tablet stuck on Android 5.0 is out of luck with an update? Dell already officially announced that they dropped support for it a while back.

Yes but no telling how many security flaws are on that thing so no sense in getting worked up over it now.

 

[RoadHazard]

ooooooo,

sound like fun lol


I already can see 15 networks.....only 3 are actual routers though lol


for those who want a short term solution that i think might work


Opera has a VPN built right into their browser for easy use.....maybe use that for the time being if you wish to browse and don't want to pay

Opera is also owned by a Chinese company since some time back, so... I dunno?

 

[Koren]

Problem is bad, but OP is going a little too far. Attacker still cannot see https encrypted data (which honestly in this day and age covers pretty much everything important

Well, I discover this summer that you can't even create a website that ask login/password on non https that won't make Firefox go mad.

It was a hassle (I just wanted some documents not totally public) to get a cert just because of this (Firefox also refuse self-signed certs and some referees) but I guess that means there's not much non-https indeed.

But if they can inject packets, couldn't there be some elaborate DNS spoofing and man in the middle attacks?

 

[kendrid]

2> Most important info like CC, health records, etc are often transmitted on hardwire systems anyway.

Not around me. Every doctor office and hospital I have been to lately use tablets which have all your data on the screen.

 

[polyh3dron]

Something tells me the 3DS won't get a firmware update to address this...

 

[sixteen-bit]

Something tells me the 3DS won't get a firmware update to address this...

Stability tho

 

[Gaardus]

Something tells me the 3DS won't get a firmware update to address this...

It's still getting security updates, so I wouldn't rule it out entirely.

 

[shockdude]

Everyone's been saying that a bad guy can basically impersonate a router in the worst case.
Can a bad guy impersonate a client and access a router, and thus access the whole network? I don't think that's possible but I'd like to confirm anyway.

edit: only if you're using AES-GCMP, a Wireless-AC/WiGig feature that is probably not yet enabled in modern networking hardware. Probably.

 

[Blizzard]

I've read over this about 3 times and I'm still not sure I understand the limitations here.

1. Is this attack ONLY possible by faking router radio packets during the handshake?

2. Once the attack has been executed, since the wireless network key appears not to be revealed and they can't join the network, the hacker can still sniff the packets and possibly decrypt them if they guess some known content, even without THEMSELVES being allowed onto the network?


If both of the above are true that's bad but it seems to be that anyone should treat non HTTPS connections as insecure anyway. The possibility of this attack allowing a man in the middle attack on an HTTPS connection is more concerning to me.

 

[BolognaSoup]

awesome.....time to patch a bunch of stuff in the next week.....this doesn't seem too bad, but I avoid public Wi-Fi's like the plague even when they have it anyways


So basically someone has to be literally right there when I'm establishing connection to the router......with my routers info.....yes, its definitely a problem but I can't see home networks unless you are in a massively rich area being effected and public wifis would be insanely easy to target

So Furthermore if you don’t broadcast your network ID then you would be even harder to breach?

 

[Morrigan Stark]

My phone is pretty old (Samsung Galaxy S3). Am I already dead?

 

[Dominican Power]

Has verizon issued a response?

 

[BreezyLimbo]

So if I have a windows computer and use wifi through a linksys usb stick, what should I be updating? Windows or the stick?

 

[Kaako]

Fak.

 

[Dominican Power]

So if I have a windows computer and use wifi through a linksys usb stick, what should I be updating? Windows or the stick?

Windows already updated on the 10th.

 

[Krakatoa]

Are consoles at risk from this attack?

 

[Brandon F]

2017 stays winning.

So shit what do I do now? I have exactly 137 devices that connect to WiFi seemingly...

 

[NekoFever]

If anyone's waiting to hear from Apple, they've apparently said it's fixed in the latest iOS, macOs, etc betas. Based on past update schedules the x.1 releases come out in mid-late October so the public releases should be very soon.

 

[Primus]

If I'm reading this from MS properly, it looks like Windows 7, 8, 10, Server 2008, Server 2012, and Server 2016 were all patched last week as part of October's monthly patches.

 

[ViciousDS]

So Furthermore if you don't broadcast your network ID then you would be even harder to breach?

good question since they need to impersonate your router for the handshake don't they?

 

[Jazzy Network]

Using a VPN has a lesser chance of being exploited?

 

[AudioEppa]

Sooo, Is my Vita fucked?

 

[BreezyLimbo]

Windows already updated on the 10th.

Yeah but should I be worried because my linkys usb stick that gives my computer wifi isnt updated? Does that have to be updated seperately?

 

[mrkgoo]

I wonder if older devices will be patched, or if they will patch older operating systems without requiring updating. Speaking about Apple here, specifically, but it applies to everything.

 

[cyborg009]

Damn I have a DD wrt reapter but if the information is correct I should only need to patch my router only?

 

[Transistor]

Damn I have a DD wrt reapter but if the information is correct I should only need to patch my router only?

You need to patch your routers AND your devices