Krack Attack: Security Flaw Puts Every Wi-Fi Connection at Risk

@mflassy

I suspect the joke is on us all.

/giphy joker

Not sure what you can do to protect yourself? It’s not that difficult (unless you own an IoT device).

In that case, run outside screaming.

@rockblossom or tinfoil?

@djslack Stupid Bank of America website will not work with my VPN running, so I have to close it to pay their bill. I pay everyone else first, turn off the VPN, pay them and shut down the laptop.

@djslack That is why we need to throw him back in jail for 5 more years, I hear he has a pretty scary whistle.

@caffeine_dude lol. The bad thing is there’s only a slight variation in tone between launching all the nukes and just downloading candy crush on all the NORAD computers. You have to be careful with that whistle.

@medz I understand that’s not a good solution. As Microsoft says, “Choosing not to broadcast the SSID of a wireless network does not make it undetectable. The SSID is still advertised in the probe requests sent out by wireless clients and in the responses to the probe requests sent by wireless APs.”

@sligett Ok, so broadcast it. See if I care.
/giphy fine whatever

@medz @sligett Opting not to broadcast your SSID is essentially security through obscurity - that is to say, not security at all. If this was all you were doing to secure yourself, yeah, it would be a terrible plan. And if it gives you a false sense of security when vulnerabilities like KRACK are discovered, that’s probably not great either. But that’s not to say that there’s no value in being slightly-less-low-hanging fruit. Daniel Miessler has a good article on the subject.

Excerpted from the summary:

1. Security through obscurity is bad because it substitutes real security for secrecy in such a way that if someone learns the trick they compromise the system.
2. Obscurity can be extremely valuable when added to actual security as an additional way to lower the chances of a successful attack, e.g., camouflage, OPSEC, etc.

Food for thought, blahblah.

@brhfl Right. We call that sort of thing the “idiot firewall” or “ignorance firewall”. At least it stops people who are too dumb to know ways around it.

@medz Also from what I understand this increases power usage of wifi cards so you will kill your phone battery faster.

@darkzrobe ok. Do what you want.
/giphy be hatin

@Moose

Read this and then tell me if you feel the same way.

@Moose But wait! Without the internet, we wouldn’t have Twitter, or Amazon, or Faceboo… er. Yeah, I see what you mean.

@Moose The internet was pretty awesome between maybe 1997 and 2007. All downhill from there.

@Moose They call it the World Wide Web for a reason. Like flies in a spider web, we’ve all become entangled in the web and will soon be sucked dry of our virtual life juices.

@Moose

https://shirt.woot.com/offers/the-internet-is-never-wrong?ref=meh_com

@medz I don’t think that was the reason

@Moose There is literally no other possible explanation.

@awk If they’re close enough to hack your wifi, they’re close enough to tap into your physical network. Heck, they could just bug your whole house for that matter.

@medz
/giphy your risk assessment is flawed

@awk holy crap that is really dumb what that kid is doing.

@Kidsandliz
/youtube extreme parkour

@Kidsandliz That’s Spiderman!

@awk Right. Ugh. Can’t watch (I do realize it will end well or it wouldn’t be able to stay posted, but still…). Although I will admit to doing stupid things in my misspent youth… I did a lot of rock climbing, including some free climbing (eg without a rope), which in retrospect was incredibly stupid - but then again in your 20’s your frontal lobe is still developing (at least that is my excuse - grin).

@awk If yer spine don’t tingle watching that video, you’re already dead. One wonders how many didn’t make it attempting the same?

@Shrdlu So the attacker can clone the wifi on a 2nd channel using the same SSID and encryption type without knowing the password?
I listened to a podcast about a month ago and the hacker said he used this method of attack but I thought it was a bit of hyperbole for the audience. I even backed it up then said this part is BS (the hackee knew he was going to be hacked for the story). The user would need to reenter the password, and how would the attacker know the password to the SSID unless it was brute forced therefor a weak password.

@caffeine_dude Side point: This is trivial for open networks such as attwifi (which at&t iPhones will connect to automatically by default)

Without reading the linked article I believe your actual points are valid, though. Though many users will reinput the password without a second thought if prompted. It may even be possible to do a two stage attack by impersonating the valid SSID, capturing the password supplied, then reimplementing the SSID with the newly obtained password and then having access to all traffic. You could even pass your new SSID traffic back through the original network so traffic comes from the same IP with your malicious device as a nearly invisible hop in between.

@lumpthar It’s harder to effectively do security research on cell network hardware (although not impossible) because the equipment is costlier, less well documented, and generally countries & government bodies take dim views of people doing things to regulated spectrums (such as the frequencies cell phones use).
It’s a different kind of security, that’s probably only better if you’re using 4g or LTE- those were built with years of experience and hard-learned security lessons. 2g and 3g both had problems with security, but realistically it was only government funded groups who had the resources to take advantage of those problems until the last 5 years or so.
Wireless routers could be more secure, but I tend to think that security beyond the basics isn’t yet a selling point, and so unless the company decides to make security a selling point or someone is championing it, it just doesn’t happen.
The basics of secure systems are known, but it’s not a one and done thing- it’s a continuous process, and takes considerable time & effort to do well.

@medz From the warm clothing people are wearing they’ve gotta be feeling a cool breeze back there.

@nickx95 We should trust you why? Does @tHumperchick trust you?

@nickx95 In this case VPN on your router doesn’t do you any good, sorry to say.
The vulnerability is specifically affecting your wireless traffic between the router and your computer, so encryption that only starts and ends at the router won’t really help.

@candreasen Sketchy website the one day member posted as well.

This is link spam. I know you’ve already been tagged but cc @thumperchick

At least it tried to be topical and is not a necropost, but it’s just abusing the forums for seo results and a few potential clicks.

@therealjrn Not even a little bit.