October 18, 2017
For Immediate Release:
On Monday October 16th, 2017, researchers disclosed major weaknesses in WPA2. This link is a full website that has both layman’s details and technical details regarding the vulnerability. US ProTech has learned that “Krack” has been known by key industry players since June of 2017 despite having just been disclosed to the public this week.
Called a KRACK attack (which stands for key reinstallation attacks), this software vulnerability permits an attacker to decrypt WPA2 traffic. In some cases, it goes further by permitting injection or data modification before traffic reaches its intended destination. The attack targets the 4-way handshake that establishes encryption between a client device and the access point. As a result, virtually all Wi-Fi client devices were impacted upon the release of KRACK. The following CVE identifiers are associated with this vulnerability:
| CVE-2017-13077:
Reinstallation of the pairwise encryption key (PTK-TK) in the 4-way handshake. |
CVE-2017-13078:
Reinstallation of the group key (GTK) in the 4-way handshake. |
| CVE-2017-13079:
Reinstallation of the integrity group key (IGTK) in the 4-way handshake. |
CVE-2017-13080:
Reinstallation of the group key (GTK) in the group key handshake. |
| CVE-2017-13081:
Reinstallation of the integrity group key (IGTK) in the group key handshake. |
CVE-2017-13084:
Reinstallation of the STK key in the PeerKey handshake. |
| CVE-2017-13082:
Accepting a retransmitted Fast BSS Transition (FT) Reassociation Request and reinstalling the pairwise encryption key (PTK-TK) while processing it. |
CVE-2017-13086:
Reinstallation of the Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) key in the TDLS handshake. |
| CVE-2017-13087:
Reinstallation of the group key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame. |
CVE-2017-13088:
Reinstallation of the integrity group key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame. |
Note: Information on ROCA can be found below
Impacted Companies
However, a regularly-updated list from CERT (part of the U.S. Department of Homeland Security) provides a comprehensive list of affected vendors. Notable updates include:
| Company | Versions Patched | More Information |
| Microsoft | Windows 7, 8, 8.1, 10 | https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-13080 |
| Apple | iOS 11 and MacOS High Sierra developer and public betas | https://www.imore.com/krack-wpa2-wi-fi-exploit-already-fixed-ios-macos-tvos-watchos-betas |
| https://www.cnet.com/news/google-to-patch-krack-impacted-devices-in-the-next-few-weeks/ | ||
| Ubuntu | 14.01 | https://usn.ubuntu.com/usn/usn-3455-1/ |
| Arch Linux | (see Git master branch) | https://git.archlinux.org/svntogit/packages.git/com/ trunkh=packages/wpa_supplicant&id=9c1bda00a84 b60e7c4b4f60b28ff4a8f7768 |
| Linux Upstream | (see link) | https://w1.fi/security/2017-1/ |
How Does This Impact You?
First, and most obviously, data sent over encrypted channels may potentially be visible to malicious parties between an intended source and destination. In the case of Linux and Android devices, attackers can force the device to install an all 0-encryption key, putting all the device’s traffic in the clear. Devices using TKIP and GCMP are additionally susceptible to having the traffic they send modified or code injected into their transmissions. In the case FT handshakes, traffic can be potentially forged and injected going to the client.
In summary:
- Applications can potentially be attacked by affected clients by injecting malicious traffic from the client side.
- By injecting traffic into the client, man-in-the-middle attacks will be the common compromise vector.
- Data is at risk for all devices.
Krack Attack – Patching and Going Back to the Future
The good news is that unlike WEP, which was fundamentally broken, WPA2 devices simply need a patch to protect against Krack attacks. However, since the weakness primarily exists on the client side, essentially every wireless device will need to be updated.
Advice For US ProTech Customers
Technology teams will likely face months of work updating affected devices. Since malicious actors will doubtless exploit KRACK, especially as some vendors are slow to release updates, attacks will occur even as patches are being applied. US ProTech can help, both in researching legitimate fixes for impacted devices and in actually implementing those solutions.
US ProTech already senses and alerts on this kind of behavior. Customers receive notifications of any such High-Risk Activity of this kind – even prior to the discovery of KRACK. Moving forward, US ProTech will include a specific warning of “KRACK attack attempt detected.” Customers can investigate these alerts or set a policy to actively block and mitigate.
Other recommendations include:
- Know Your Wireless Attack Surface: Before you can patch all your wireless devices, you have to know about them all. Use US ProTech to provide a full inventory of all wireless devices including unmanaged and IoT devices in your environment even if they aren’t yet connected to your enterprise network.
- Monitor for Abnormal Client Behavior: KRACK attacks can allow an attacker to act similarly to a WiFi “pineapple” and to man-in-the-middle an affected client. US ProTech identifies and alerts this device behavior. When devices are trying to connect to other devices or malicious devices acting as a pineapple, US ProTech will alert in our console under Alerts.
- Monitor for Exposed Traffic: When possible, it is much easier for an attacker to use an all 0-encryption key to see traffic. Set US ProTech policies to alert on exposed data.
- Disable and Monitor for FT (Fast Transmission): The use of FT opens clients where means traffic can be forged to the client and opens up a variety of client side attacks.
- Closely Monitor for Repeated Disconnects and Initial Associations: Since the attack targets the initial handshake, attackers may attempt to disassociate clients in order to trigger a new handshake to attack. Use US ProTech to track abnormal amounts of associations and disassociations.
- Block Suspicious Connections and Isolate Suspicious Devices: Since attackers can lure vulnerable devices into malicious connections, it is not enough to simply deny access to the corporate network. Use US ProTech to break malicious WiFi connections and to isolate potentially compromised devices.
- Switch to AES-CCMP: Given the exposure of TKIP and GCMP, consider switching to using AES-CCMP as your encryption scheme for WiFi if you are not already on it.
What’s Next?
Arguably worse than KRACK is the ROCA vulnerability (CVE-2017-15361), which was disclosed on October 17, 2017. US ProTech is analyzing that attack’s technical disclosures, and will have an update for our customers regarding this new vulnerability shortly.
For additional information, please contact US ProTech ASAP.