2

Today, there was disclosure about Krack Attacks that affect WPA2. The attacks are primarily executed against end-point devices (phones, laptops).

In many cases, you can patch your router. The way the vulnerability works, according to the website author:

This means a patched client can still communicate with an unpatched access point, and vice versa.

In cases where the router is patched, we're cool. But sometimes, I have access to WiFi networks outside of my control, and I can't guarantee they're patched.

For these cases, it makes sense to patch my device -- but (based on the Linux driver source), for my specific phone (and I'm sure many others), I don't forsee updates ever becoming available -- we just don't get updates.

In these cases, what can I do to minimize or mitigate the risk of this attack?

Someone recommended using HTTPS Everywhere, which is (unfortunately) only available in Firefox on Android.

  • 2
    You can't... Unless you are very adept at building custom kernels, although I don't know know for sure where the core of WPA2 is, if it is in the drivers (in which case you can't do anything with it) or in the kernel. If it is in the kernel, AND Google releases a patch that is kernel based, AND you have access to kernel source, AND have an unlocked device, and know how to compile and flash a custom kernel, you could do it. Although if that level of security is important to you, unlocking the bootloader shouldn't be an option. Basically, you have until your phone's manufacturer does it. – acejavelin Oct 16 '17 at 22:25
  • acejavelin is right. You can wait for manufacturer to push patch if they do. Which device you have? – Једноруки Крстивоје Oct 17 '17 at 1:02
  • I've owned several phones, and only one of my previous ones (OnePlus X) had any sort of updates. I know we can't fix the core kernel issue ourselves; but surely there must be something we can do to mitigate or minimize. There are thousands or millions of phones in the same situation (no regular vendor updates). – nightblade9 Oct 17 '17 at 11:09
  • 1
    I think this falls in the same category as Bluebourne... Yes, it's real, but not very likely to occur. One significant difference here is there is no working exploit if this vulnerability, meaning we know it exists, but we don't know how to actually use it (unless that changed from yesterday morning) except a handful of researchers in a lab environment. – acejavelin Oct 17 '17 at 11:54
  • We also made a proof-of-concept script that exploits the all-zero key (re)installation present in certain Android and Linux devices. It will be released once everyone has had a reasonable chance to update their devices - Official Source. So there's no way as of now by which you could be immediately affected. || @nightblade9 there must be something we can do to mitigate or minimize. Make sure you're on HTTPS always. – Gokul NC Oct 17 '17 at 14:06
1

If your phone manufacturer or service provider will not push updates there are a few things you can do (some already mentioned in comments.) From easiest to hardest, these would be:

  • turn off wifi and only use mobile data (easy but possibly expensive, depending on your plan)
  • update your own wifi router, and only use wifi on your network and others that are confirmed patched
  • buy a new phone (They will have updates - could this be an excuse to get a new one?)
  • use a different kernel. LineageOS is generally leading edge, as Једноруки mentioned, so it will have an update very soon
  • write your own kernel. Tools exist to help you work on Android kernels, and the update required is publicly documented.

The thing to remember is that currently it is unlikely to happen. Yes, once the exploit is out there and spreading, you'll want to be on a patched phone, but don't panic about it today. And the attack is mitigated by VPN's, https etc.

For technical analysis and up to date security commentary on this, look at the Krack tag on Security Stack Exchange.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.