'Krack' Wi-Fi Breach

[mitchell4you]

Any news...
On how to patch your Android devices against the " Krack Wifi vulnerability" ?
Seeing that most of my devices are rooted...men should able to fix this?? (I hope )

I noticed.. News reporting 41% of all Android devices being vulnerable..
A serious vulnerability impacts a Billion devices!!

explain found in tp-link forum

The Krack Attack method is not really a hardware / software issue completely. The hardware / software will be patched to fix the real issue. WPA / WPA2 encryption uses a key for the devices to communicate anytime and sometimes randomly, when the devices communicate there is what is called a "handshake" between the devices. 4 messages are sent between the devices. At some point in these messages (usually the 3rd message) the devices "agree" on a key that allows them to know they are talking to each other to "secure" the connection the key travels with each transmission between the devices. Currently the key is not randomized enough or regularly enough to prevent the hacker from determining your key. Once they have the key they can tell the devices to not change the key, then do what they want with the info they can see, and even "insert" their own info into your devices (on both the access point i.e. wifi router, and client i.e. smartphone, computer,...etc). Both the access point and the client will need a patch. If the access point only was fixed the hacker can still use access the client. That is why both need the fix. Additionally, Android / Linux devices are susceptible to a "All zero's key hack" where the hacker can change the encryption key to all 0's and not have to use the software to figure out the key each time. That is why just fixing the access point will not completely protect you.

You can watch this if I did not make it clear enough: https://youtu.be/VI89hpI5pos

cheers

[bluesmanuk]

Realistically I think that the chance of the Chinese vendors patching all of their models is about the same as you have of winning the lottery.

Luckily, it requires somebody to be in range of your WiFi to execute and anybody wanting to do so is more likely to target those that they can make big bucks from, like business's.

[mitchell4you]

I agree...
I would never imagine any Chinese tvbox maker to patch it
*Nor.. Minix or rikomagic ( i hope to be proven wrong offcourse )

**update: xiaomi has released there first phone patches..

http://rootmygalaxy.net/download-miui-9-global-beta-rom-7-10-19-for-all-xiaomi-devices/

But my hopes are that someone at freaktab or XDA does have the knowledge
like
On XDA forum... There is talk about using "magisk" to patch the vulnerability

[mitchell4you]

Hmm.. Something wierd had happened... AVM ( fritzbox)
first stated.. there units are un-effected.. Due to not supporting 802.11r (17okt)
but today...the released updates.. for repeaters and powerline-adapters (20okt)

So, powerline adaptors with wifi are effected too...

The Wi-Fi Alliance has made a fix to the Wi-Fi Standards and is available for vendors but not directly for end users.

https://www.wi-fi.org/news-events/ne...ecurity-update

The Wi-Fi Alliance has also made a vulnerability detection tool available to members.

https://www.wi-fi.org/security-update-october-2017

List of known android devices effected

https://github.com/kristate/krackinfo/blob/master/ANDROID.md

nice big list with big names..and sites, where to find patches

https://github.com/kristate/krackinfo