Question on the WIFI security issue Key Reinstallation Attack ("krack" attack)

[Mark C. Allman]

I figure that this is being addressed but hopefully it doesn't hurt to ask.

https://www.krackattacks.com/

Thanks,
-- 

*Mark C. Allman, PMP, CSM*
Founder, See How You Ski, www.seehowyouski.com <http://www.seehowyouski.com>
Sr. Project Manager, Allman Professional Consulting, Inc.,
www.allmanpc.com <http://www.allmanpc.com>
617-947-4263, Twitter: @allmanpc

[George N. White III]

On 16 October 2017 at 08:32, Mark C. Allman <mcallman(a)allmanpc.com&gt; wrote:

>  I figure that this is being addressed but hopefully it doesn't
> hurt to ask.
>
>  https://www.krackattacks.com/
>
>  
Many organizations either don't allow (WPA2) wireless or require VPN when
not using the internal wired network.

Many of us have older WPA2 devices that are no longer being updated (ebook
readers, pads, smart phones).  It
will be interesting to see if vendors provide patches to older "no longer
supported" devices.

-- 
George N. White III <aa056(a)chebucto.ns.ca&gt;
Head of St. Margarets Bay, Nova Scotia

[Matthew Miller]

On Mon, Oct 16, 2017 at 07:32:32AM -0400, Mark C. Allman wrote:
>  I figure that this is being addressed but hopefully it doesn't
> hurt to ask.
>  https://www.krackattacks.com/ 
https://bodhi.fedoraproject.org/updates/FEDORA-2017-60bfb576b7

-- 
Matthew Miller
<mattdm(a)fedoraproject.org&gt;
Fedora Project Leader

[Mark C. Allman]

On 10/16/2017 09:30 AM, Matthew Miller wrote:
>  On Mon, Oct 16, 2017 at 07:32:32AM -0400, Mark C. Allman wrote:
> > I figure that this is being addressed but hopefully it doesn't hurt to ask.
> > https://www.krackattacks.com/
>  https://bodhi.fedoraproject.org/updates/FEDORA-2017-60bfb576b7
>  
Perfect.  I figured as much.  That's exactly what I, and I'd expect lots
of us, wanted to know.

Thanks!


*Mark C. Allman, PMP, CSM*
Founder, See How You Ski, www.seehowyouski.com <http://www.seehowyouski.com>
Sr. Project Manager, Allman Professional Consulting, Inc.,
www.allmanpc.com <http://www.allmanpc.com>
617-947-4263, Twitter: @allmanpc

[Michael Cronenworth]

On 10/16/2017 08:30 AM, Matthew Miller wrote:
>  On Mon, Oct 16, 2017 at 07:32:32AM -0400, Mark C. Allman wrote:
> > I figure that this is being addressed but hopefully it doesn't hurt to ask.
> > https://www.krackattacks.com/
>  https://bodhi.fedoraproject.org/updates/FEDORA-2017-60bfb576b7
>  
Which is for Fedora 26.

F25: https://bodhi.fedoraproject.org/updates/FEDORA-2017-12e76e8364
F27: https://bodhi.fedoraproject.org/updates/FEDORA-2017-f45e844a85
Rawhide: (just run a dnf update)

[Ron Leach]

On 16/10/2017 15:21, Michael Cronenworth wrote:

>  F25: https://bodhi.fedoraproject.org/updates/FEDORA-2017-12e76e8364
>  F27: https://bodhi.fedoraproject.org/updates/FEDORA-2017-f45e844a85
>  Rawhide: (just run a dnf update)
>  _______________________________________________ 
Is there any longer-term security support for earlier versions?  We've 
a few devices still running F24 or F23.

If there is not a security release, is it even likely that the source 
for the revised versions of the affected packages might compile on 
F24, and might the objects even run on F24 or F23?  (I imagine it is 
fairly unlikely, but I'd like to ask.)

(We hadn't updated these devices to F25 because there had seemed to be 
some difficulties reported on the lists, but that would be option we 
still have.  I've downloaded the paper to understand better the risks 
at (i) coffee shops etc, and (ii) whether the 'trick' can be used to 
gain access to a password-protected AP - such as here at our premises 
- in the first place.  I'm concerned about both those scenarios.)

Thanks for the expanded update list,

regards, Ron

[Patrick O'Callaghan]

On Mon, 2017-10-16 at 16:00 +0100, Ron Leach wrote:
>  On 16/10/2017 15:21, Michael Cronenworth wrote:
>  
>  > F25: https://bodhi.fedoraproject.org/updates/FEDORA-2017-12e76e8364
>  > F27: https://bodhi.fedoraproject.org/updates/FEDORA-2017-f45e844a85
>  > Rawhide: (just run a dnf update)
>  > _______________________________________________
>  
>  Is there any longer-term security support for earlier versions?  We've 
>  a few devices still running F24 or F23. 
As has been reiterated innumerable times, Fedora does NOT provide
security updates for EOLed versions, i.e. currently anything earlier
than F25. If you aren't prepared to update at least every other
release, you should consider using a different distro.

poc

[stan]

On Mon, 16 Oct 2017 16:15:26 +0100
Patrick O'Callaghan <pocallaghan(a)gmail.com&gt; wrote:

>  On Mon, 2017-10-16 at 16:00 +0100, Ron Leach wrote: 
 
>  > Is there any longer-term security support for earlier versions?
>  > We've a few devices still running F24 or F23.  
>  
>  As has been reiterated innumerable times, Fedora does NOT provide
>  security updates for EOLed versions, i.e. currently anything earlier
>  than F25. If you aren't prepared to update at least every other
>  release, you should consider using a different distro. 
In general, Patrick is right.  However, if you are desperate, you can
go to the link below and get the src.rpm, and build it on the obsolete
systems.  You might have to do some fiddling with requirements, and
there could be dependencies you will also have to install, but it will
give you a package for your earlier fedora distribution.

https://koji.fedoraproject.org/koji/buildinfo?buildID=984997

You are becoming a pseudo packager, and it can be a lot of work with a
significant learning curve if you haven't built packages from src.rpms
before. Upgrading is probably the better answer if at all possible.

[Matthew Miller]

On Mon, Oct 16, 2017 at 04:00:46PM +0100, Ron Leach wrote:
>  (We hadn't updated these devices to F25 because there had seemed
> to
>  be some difficulties reported on the lists, but that would be option
>  we still have.  I've downloaded the paper to understand better the
>  risks at (i) coffee shops etc, and (ii) whether the 'trick' can be
>  used to gain access to a password-protected AP - such as here at our
>  premises - in the first place.  I'm concerned about both those
>  scenarios.) 
I would recommend updating to Fedora 26, unless you have a specific problem
listed on https://fedoraproject.org/wiki/Common_F26_bugs. If you judge
by difficulties seen online, you get a biased view, because a lot
fewer people will comment "hey, this worked fine".

-- 
Matthew Miller
<mattdm(a)fedoraproject.org&gt;
Fedora Project Leader

[OT] Question on the WIFI security issue Key Reinstallation Attack ("krack" attack)

[Jonathan Ryshpan]

I am about 97% ignorant about encryption.  However...

It seems that these attacks are directed at clients rather than
servers.  Is this correct?  

If so, it's a good thing for me, since I use an old Belkin wireless
router whose firmware will surely never be upgraded.

jon

On Mon, 2017-10-16 at 07:32 -0400, Mark C. Allman wrote:
>  I figure that this is being addressed but hopefully it doesn't
> hurt to ask.
>  
>  https://www.krackattacks.com/

[OT] Question on the WIFI security issue Key Reinstallation Attack ("krack" attack)

[Patrick O'Callaghan]

On Mon, 2017-10-16 at 08:54 -0700, Jonathan Ryshpan wrote:
>  I am about 97% ignorant about encryption.  However...
>  
>  It seems that these attacks are directed at clients rather than
>  servers.  Is this correct?   
No.

>  If so, it's a good thing for me, since I use an old Belkin
> wireless
>  router whose firmware will surely never be upgraded. 
The attack is against *anything* using WPA2 encryption. The severity of
the vulnerability depends on implementation details. wpa_supplicant
(used in Linux and Android) is particularly bad. Ironically, recent
versions of Windows and IOS are less vulnerable because they implement
WPA2 incorrectly. Note that in all cases the problem is limited to
nodes sharing the same wireless access point, i.e. it's not going to
bite you over the Internet.

That said, a cursory reading of the actual paper (rather than the
rather sensational press release) shows that although there is a
problem with the protocol handshake allowing certain kinds of relay
attack, the potential issues depend on what actual (local) encryption
protocol is used after establishing the connection.

And of course using a higher-level secure protocol such as HTTPS or
OpenVPN makes all this irrelevant.

poc

[OT] Question on the WIFI security issue Key Reinstallation Attack ("krack" attack)

[Patrick O'Callaghan]

On Mon, 2017-10-16 at 17:51 +0100, Patrick O'Callaghan wrote:
>  wpa_supplicant (used in Linux and Android) is particularly bad.
Just in case this point isn't getting enough emphasis: the specific
vulnerability in wpa_supplicant allows the adversary to force the use
of an all-0's encryption key. That could legitimately be called
disastrous. Patched versions of wpa_supplicant should be installed as
soon as they are available.

poc

[OT] Question on the WIFI security issue Key Reinstallation Attack ("krack" attack)

[Tim]

Allegedly, on or about 16 October 2017, Patrick O'Callaghan sent:
>  Note that in all cases the problem is limited to nodes sharing the
>  same wireless access point, i.e. it's not going to bite you over the
>  Internet. 
Though that, rather obviously, means that using public WiFi is unsafe
(not that it ever really was), but I think the more likely problem for
the average home user will be neighbours (the houses next door, and
apartments above and below you, or drive-by hackers).

Going from what I read, it's not so much nodes sharing the same point
(i.e. what could be interpreted as people *already* on the same
network), but vulnerable to anybody who tries to access it.

-- 
[tim@localhost ~]$ uname -rsvp
Linux 4.13.5-200.fc26.x86_64 #1 SMP Thu Oct 5 16:53:13 UTC 2017 x86_64

Boilerplate:  All mail to my mailbox is automatically deleted.
There is no point trying to privately email me, I only get to see
the messages posted to the mailing list.

This email has been brought to you by beetwix.  Mmm, spewy!
Get some into you today.