mage (Azril): Krack Attack Setup
Azril, however, believes that a Krack attack "is quite difficult and not as easy as shown in the YouTube video demo by the two Belgium researchers."
"First, the attacker needs to apply Man-In-The-Middle (MiTM) attack techniques between the Wi-Fi Access Point (AP) and the Wi-Fi Client," he explained. Secondly, setting a rouge AP with different MAC address for forwarding the packets between real AP and its Client is not possible. The attacker will have to employ a channel-based MiTM attack by cloning the real AP on a different channel with same MAC address and SSID. The following paper describe in detail on how to established Wi-Fi MiTM Channel Attack
"Thirdly, by default both Windows & MacOS (including iOS) do not accept retransmission of Message3 in the 4WH," Azril continued. "This is because it violates the 802.11 standards. As such, Windows, MacOS (iOS) are not vulnerable against Wi-Fi Client WPA2 4WH but still vulnerable on the Group-Key Handshake. These operating systems are also vulnerable to Krack is the attacker decided to target the AP for the 802.11R Fast BSS Transition (FT) Handshake."
Guidelines from security experts
When alerting Computerworld Malaysia about the exploit, former white hat hacker turned financial security consultant LGMS director, Fong Choong Fook (pic below), summed it up as: "If you are using Wi-Fi in office or home, you are vulnerable."
"Researchers will be presented more detail in the coming Black Hat Europe hacking conference," said Fong. "The attack, in particular is targeting the weakness in the WPA2 protocol. WPA2 is widely use in the Wi-Fi access points today. Most, if not all Wi-Fi networks today are using WPA2 one way or another. Wi-Fi users are advised to update their wireless access points and their computer immediately."
"Microsoft Windows have released the patches; however popular network device manufacturers such as D-link and TP-link have yet [at the time of this interview] to release any firmware update at this moment of writing," he said. "The fixes need to apply in both ways, the Wi-Fi client (e.g. Microsoft Windows) and the Wireless Access Point (e.g. D-link Wi-Fi router)."
According to a statement by the Wi-Fi Alliance: "This issue can be resolved through straightforward software updates, and the Wi-Fi industry, including major platform providers, has already started deploying patches to Wi-Fi users."
As of 17th October, Microsoft revealed it quietly patched Windows last week against vulnerabilities in the Wi-Fi Protected Access II (WPA2) protocol used to secure wireless networks. All supported versions of Windows received the update, according to the catalogue listing, including Windows 7, Windows 8.1, Windows 10, Windows Server 2008, Windows Server 2012 and Windows Server 2016. On the same day, Apple also announced a patch for MacOS, iOS and WatchOS.
However, as other firmware updates (such as to actual routers) may take a little while to appear, local digital security specialists have offered some guidelines to IT admins and internet users to combat this latest vulnerability.
Azril, and Fong agree on the main advice from CyberSecurity Malaysia. Their advice has been collected and summarised below.
Sign up for Computerworld eNewsletters.