bk99.de entertain the web since 1997

bk99.de
Mathy Vanhoef · Radio & mobile networksCurated

KRACK: WPA2 becomes vulnerable

Summary

On 16 October 2017 Mathy Vanhoef of KU Leuven published the Key Reinstallation Attacks, KRACK for short, against the four-way handshake of WPA2. An attacker within radio range can make victims reinstall an already used key and thus read and partly manipulate encrypted traffic. The weakness lay in the standard itself, so practically all Wi-Fi devices were affected, most severely Linux and Android from version 6.0.

How the attack works

In the four-way handshake, client and access point confirm that both know the correct password and negotiate a fresh session key. Vanhoef showed that by replaying messages the client can be made to reinstall the key and reset counters in the process. If nonces are reused, the encryption can be broken.

Linux and Android from 6.0 were hit particularly hard: wpa_supplicant could be tricked into installing an all-zero key. HTTPS adds protection, but according to Vanhoef could be bypassed in a worrying number of cases. The attack does not reveal the Wi-Fi password, so changing it does not help.

Ideas

  • Errors in the standard hit every correct implementation.
  • Changing passwords does not help against protocol errors; only updates help.
  • Additional encryption such as HTTPS remains important, even on your own Wi-Fi.
  • Clients are often harder to update than routers.

Insights

  • KRACK showed that even formally analysed protocols are vulnerable if the analysis does not cover when a key is installed. The flaw had been in the standard since 2004.
  • The attack accelerated WPA3, which in turn showed weaknesses of its own two years later.

Facts

  • Published on 16 October 2017 by Mathy Vanhoef, imec-DistriNet, KU Leuven.
  • The main attack targets the four-way handshake of WPA2.
  • Linux and Android from 6.0 could be tricked into installing an all-zero key.

References

Remarks

  • In 2018 Vanhoef added a follow-up paper to the page that generalises the attacks.

Recommendations

  • Update clients and access points; with KRACK, updating the clients was what mattered most.
  • Remove devices without updates from the main network.
  • Additionally encrypt confidential connections, for example via HTTPS or VPN.

Read the original page

Search the Web Archive

Mathy Vanhoef · 2019

Dragonblood: weaknesses in WPA3

In April 2019 Mathy Vanhoef and Eyal Ronen published attacks under the name Dragonblood against WPA3’s Dragonfly handshake, which was supposed to make password guessing impossible. Through downgrade attacks and timing and cache side channels, attackers within radio range could still recover the Wi-Fi password. The Wi-Fi Alliance responded with recommendations, which according to Vanhoef themselves proved hard to implement securely.

CCC · 2024

Building your own LoRa mesh network

WillCrash leads from LoRa and ESP nodes through antenna choice and site planning to a robust mesh network that communicates independently of conventional infrastructure. Independent communication comes more from a good topology than from particularly expensive hardware.

HN · 2019

Linux-based 4G phones for seven dollars

TuxPhones describes KaiOS devices that combine web technologies on cheap hardware with keypad operation, mobile connectivity and long battery life. KaiOS is based on Linux and Gecko components.