KRACK: On Monday morning IT around the world had a great time. The public release of an error allowing WPA2 wireless security breach has made many people run and fail.
WPA2's flaw compromises almost every device Wi-Fi, και ειδικοί security reported that its public release was the total destruction of the WPA2 security protocol.
Such as I mentioned in SecNews the error was named “KRACK” by Key Reinstallation Attack και αποτελεί ένα βασικό ελάττωμα στον τρόπο modeof Wi-Fi protected Access II (WPA2).
The security protocol, which is essentially an upgrade of WEP, is used to protect and secure communications between routers and devices using Wi-Fi (mobile and Internet of Things devices).
According to security researcher and academic Mathy Vanhoef, who discovered the flaw, attackers can exploit vulnerabilities to decrypt traffic, seize connections, execute attacks and monitor communications sent from a capable device. WPA2.
US-CERT has been aware of the error for several months and has informed the construction companies before the error was publicly disclosed to the public.
Who is affected:
Windows and later versions of iOS are generally unaffected, but the bug can have a serious impact on Android 6.0 Marshmallow and later.
The attack could also be catastrophic for IoT devices, as companies often fail to implement acceptable security standards or information systems in the supply chain, which has already led to the exposure of millions of vulnerable IoT devices to botnets.
Apple: for iPhone and iPad will release an update that is currently in beta. It will fix iOS, macOS, watchOS and tvOS and is expected to be released in a few weeks.
Arris: a spokesman said the company was "committed to the security of our devices and ensuring the millions of subscribers who use them" but did not say when updates would be released.
Aruba: The company moved quickly and disposed of immediately safety tips and patches directly for ArubaOS, Aruba Instant, Clarity Engine and any other software affected by the error.
AVM: the company states that due to the "limited attack agent", it will not issue security patches "unless necessary".
Cisco: The company is currently investigating exactly which products are affected by KRACK, but said that "many Cisco wireless products are affected by these vulnerabilities."
"Fixes are already available for selected Cisco products and we will continue to post additional software fixes for affected products when they become available"
In other words, there are some updates, but there are also vulnerable products waiting for a patch.
Espressif Systems: The Chinese company has started to update its chipsets. Specifically the ESP-IDF and ESP8266 versions, with Arduino ESP32 are on the cards to be repaired.
Fortinet: In accordance with Fortinet support forum, FortiAP 5.6.1 is no longer vulnerable to most CVE-enabled attacks, but version 5.4.3 may be affected. Firmware updates are expected.
FreeBSD: There is no official announcement.
Google: Google said it was "aware of the issue and will update any affected devices in the coming weeks."
HostAP: The driver provider for Linux has issued several updates.
Intel: Intel has been released a security advisory proposal with updates to the affected chipsets, but also for Intel Active Management Technology, used by system manufacturers.
Linux: There are already updates. Debian and Fedora were updated immediately, so all forks will be updated soon.
OpenBSD repaired in July but there are and new patches.
Netgear: Netgear has published updates for some routers.
Microsoft: Windows systems are considered secure. Redmond has already released a fix fix via automatic updates.
MikroTik: has been released already security updates
Ubiquiti Networks: A new version firmware, version 3.9.3.7537, protects users from attack.
Wi-Fi Alliance: The team offers a tool to detect KRACK in its members and requires testing by its new members.
Wi-Fi standard: There is an update concerning only suppliers and not end users.
So far neither Toshiba nor Samsung have mentioned anything….
In case you notice any information, in others, or for the companies listed above, you can add it to the comments of the post and we will include it in our list.
