What's new

KRACK WPA2 Vulnerability Exposed

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

On Linux, `wpa_supplicant` is used to perform that handshake; it's been patched already on RHEL and CentOS at least. The drivers should not be vulnerable, as far as I understand it.

That first CVE I listed only affects Windows. No idea about the second one, but Intel does list it as having been fixed in their driver release.
 
On Linux, `wpa_supplicant` is used to perform that handshake; it's been patched already on RHEL and CentOS at least. The drivers should not be vulnerable, as far as I understand it.
Also on Ubuntu/Mint....I was offered the wpa update yesterday.
 
[sfx2000]
It's a client side vuln - linux and android are high at risk, OpenBSD released a patch for their wpa supplicant, and I expect other OS's to release as well.

AP's are not impacted - however, repeats (as they are clients) are vulnerable.

Yes, I heard that Microsoft has already released a patch for this...in their last cumulative.

On the other hand, routers and a IoT devices all commonly use embedded Linux kernels, so there's that.

Just the other day I had our solar panel installer turn off the wifi between the solar panel monitor and our router, and it's now using powerline networking. Still have a lot of unpatched clients, though *sigh*. Have to wait for Apple and Google to get on it.
 
ONE of the first Routers to get the WPA KRACK fix is the Dovado Routers

New Firmware containing fixes for WPA KRACK.
VERSION: 9.0.7
 
Seems like a lot of companies are confused about the flaw. Chamberlain claimed their products weren’t affected because all their traffic is encrypted. It’s my understanding is that doesn’t completely mitigate the flaw, it just means traffic can’t easily be sniffed.
 
Seems like a lot of companies are confused about the flaw. Chamberlain claimed their products weren’t affected because all their traffic is encrypted.
If all traffic is encrypted on top of the WPA2 WLAN communication (like having only https communication) you are fine. :cool:

Update: SSL can also be attacked... ...but this is a different attack!
Still you are not effected by the KRACK attack as the hacker might be able to hack WPA2, but not SSL to read your data... ...hopefully! :rolleyes:
 
Last edited:
Erm... not really - HTTPs can be attacked as well - sslstrip is but one example...

...and that's until the next Heartbleed occurs...
 
If all traffic is encrypted on top of the WPA2 WLAN communication (like having only https communication) you are fine. :cool:

Update: SSL can also be attacked... ...but this is a different attack!
Still you are not effected by the KRACK attack as the hacker might be able to hack WPA2, but not SSL to read your data... ...hopefully! :rolleyes:

Technically even if all client/server traffic is encrypted can't network traffic like broadcast messages, UPNP, etc still be intercepted?
 

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!
Top