Using WPA2 wireless? Patch up ASAP!

[IronWing]

lol, why wouldnt I, is someone gonna guess my super hard password?

ChangeMe123!

 

[ch33zw1z]

ChangeMe123!

Password.com

 

[sdifox]

lol, why wouldnt I, is someone gonna guess my super hard password?

1,2,3,4,5

 

[ch33zw1z]

Seriously though, when I show people my password method they be like

So yea, try to get on my SSID

 

[Red Squirrel]

It'll expose traffic between the unsecured client (unpatched phone) and the router/AP/VLAN. Technically this could expose unencrypted traffic between the unpatched device and a patched device, just between the unpatched device and the AP, rather than the patched device and the AP. Think of a scenario involving telnet between hostA and hostB, hostB is patched, hostA isn't, and AP between them is patched. HostA to AP traffic can be sniffed, and telnet cleartext can be extracted.

Since most phones don't get patches beyond, oh, 3 months or so, it's probably safe to assume any unencrypted/non-broken encryption (see various implementations of SSL/TLS) is potentially cleartext'd by this in a public environment.

Wow that blows. So basically can't allow any unpatched clients to connect to your wifi then. That's going to be a nightmare for anyone that runs a public wifi hotspot.

 

[Red Squirrel]

lol, why wouldnt I, is someone gonna guess my super hard password?

No need to guess when it's just being sent around in clear text if an unpatched client connects to you.

 

[John Connor]

I actually find it amusing people broadcast their SSID. But they must be blissful.

Good forbid someone should see your SSID name. But I'll let you in on a little secret. Careful not to tell anyone. Use a third party router firmware and use a non-US WIFI channel. This will cut down on the hackers in no time!

 

[John Connor]

That's going to be a nightmare for anyone that runs a public wifi hotspot.

Why? public WIFI hotspots generally don't use any encryption at all. Meaning your WIFI traffic has always been subject to capture. Come to think of it. Even if they did use encryption your traffic would still be subject to capture sense everyone knows the password.

 

[John Connor]

No need to guess when it's just being sent around in clear text if an unpatched client connects to you.

It is my understanding the password isn't known in the hack. Only that you can see the packets between router and client.

 

[John Connor]

And folks. Thus far this hack hasn't been published. So I wouldn't run around like a chicken with its head cut off until that happens. Once it does you can bet it will be included in the next release of Kali.

 

[John Connor]

lol, why wouldnt I, is someone gonna guess my super hard password?

Does it have any combination of leet in it or the word love?

 

[ch33zw1z]

No need to guess when it's just being sent around in clear text if an unpatched client connects to you.

https://www.krackattacks.com

I already patch my Ubiquiti WAP.

its up to manufacturers to push it to devices. More to come, but read the page, watch the video, and hide yo babies.

 

[John Connor]

Seriously though, when I show people my password method they be like

So yea, try to get on my SSID

You wouldn't believe my password system. All of my computers are encrypted and the password consists of upper and lower case letters, numbers and symbols all over 15 characters long and strictly committed to memory. I really don't have to fear not remembering it sense I type the password everyday.

 

[ch33zw1z]

Does it have any combination of leet in it or the word love?

yes, both. its actually leetlove

 

[lxskllr]

I actually find it amusing people broadcast their SSID. But they must be blissful.

It makes life easier, and hiding it doesn't do anything. Someone looking to crack a network can see it, and everyone else who doesn't matter, doesn't matter.

 

[John Connor]

yes, both. its actually leetlove

HAHA. I have wordlists and the most common passwords have the word love or leet-type schemes.

 

[VirtualLarry]

Use a third party router firmware and use a non-US WIFI channel. This will cut down on the hackers in no time!

Until you see nondescript white vans going up and down your street. Too risky, IMHO.

 

[John Connor]

Until you see nondescript white vans going up and down your street. Too risky, IMHO.

Already thought of it. I've got Amcrest cams all over the place. As soon as I get a mouse fart clue I'm being spooked, I flip a switch that sets fire to the house and explodes in a Michael Bay way.

 

[John Connor]

Point I was making was that hiding a SSID, changing channels and using the MAC address clone feature is all snake oil.

 

[John Connor]

I would actually never use a hotel's WIFI, and if you do change your DNS in your NIC to Google's or OpenDNS. But then again you're using a good VPN, right?

 

[Elixer]

On the wireless side we have two phones - both on Android, a laptop, printer, PS4 & Switch. So patch up Android and the laptop and I guess wait for the PS4 and Switch to be updated?

Maybe I will just bite the bullet and put DD-WRT on the router. It's already patched I believe, or it is coming shortly. I read something of the sort on reddit.

I think people are getting confused here.
If you are running the router as a router, and NOT a client (repeater or a bridge), you do NOT have to worry about this flaw. (again, assuming you are NOT using WPKA2/TKIP or GCMP, or 802.11r)

This is a CLIENT vulnerability, those phones, laptop, printer, and consoles will still need the patch.
Switching to DD-WRT will NOT fix anything for the clients, those remain vulnerable.

Note from the krackattacks.com site:

Our main attack is against the 4-way handshake, and does not exploit access points, but instead targets clients. So it might be that your router does not require security updates. We strongly advise you to contact your vendor for more details. In general though, you can try to mitigate attacks against routers and access points by disabling client functionality (which is for example used in repeater modes) and disabling 802.11r (fast roaming). For ordinary home users, your priority should be updating clients such as laptops and smartphones.

 

[Red Squirrel]

https://www.krackattacks.com

I already patch my Ubiquiti WAP.

its up to manufacturers to push it to devices. More to come, but read the page, watch the video, and hide yo babies.

Good to know the unifis got a patch out, I was waiting a bit just to be safe. Going to update now. I hope my AP is still supported though... Going to update the controller while I'm at it too, I think I don't have a choice anyway, I know last time when I updated just an AP it would not play nice until I updated the controller too. I'm at work so hopefully I don't end up having to do a hard power cycle as that is hard to do from here.

Is there by chance a way to set it up so it will not allow unpatched clients to even connect? Ex: before the SSID password is sent.

 

[Red Squirrel]

Is this the right place to get the firmware and controller?

https://www.ubnt.com/download/unifi/unifi-ap/default/unifi-5419-controller-debianubuntu-linux

I downloaded the controller for Linux but it only comes in a .deb, my server is not Debian but I extracted the package since I'm pretty sure that's what I did last time, but I only get a few files/folders: etc usr and lib, it is not even remotely close to the structure of what I have now, which is java based and has a .jar file and other stuff. I was hoping I could just replace the files and it would run but it's completely different. Did I download the wrong thing?

I may just try to upgrade the firmware without upgrading the controller but that did not go over so well last time. It basically lost contact and I could not readopt it. Given I only have one AP I don't really NEED the controller but still nice to have.

 

[Red Squirrel]

I typed the wrong command when I tried to upgrade but it apparently worked anyway lol.

ssh admin@wap01.n.loc
admin@wap01.n.loc's password: 


BusyBox v1.11.2 (2017-10-13 10:45:54 PDT) built-in shell (ash)
Enter 'help' for a list of built-in commands.


  ___ ___      .__________.__
 |   |   |____ |__\_  ____/__|
 |   |   /    \|  ||  __) |  |   (c) 2010-2017
 |   |  |   |  \  ||  \   |  |   Ubiquiti Networks, Inc.
 |______|___|  /__||__/   |__|
            |_/                  http://www.ubnt.com

      Welcome to UniFi UAP!

BZ.v3.9.3#

3.9.3 is the latest version so I presume it has the patch, but I'll have to test with that krackattack script when I'm home as I presume I need to test through wifi.

Controller is not adopting it anymore though, so it is what I feared. Have to update that too. Can't seem to find much info on how to upgrade it so I'll have to do more searching. Last time I ended up just setting it up from scratch so might have to do the same. There has to be some kind of way to upgrade it though, I can't imagine having to do it from scratch each time for an organization running 100's of APs.

 

[Red Squirrel]

Yay got the controller upgrade and AP to adopt properly in it now. That was kind of painful and required lot of brute force, but I'm fully upgraded. I'll have to run that test script when I'm at home. Is there any way to check if my phone is also patched? I doubt it... I saw a couple android upgrades come through but it was just apps.