Ethernet cable is my simple solution to these problems. Faster, too.
I didn’t see if disabling WIFI administrator affected it. I always leave that off.
My router cannot be seen outside my house due to the fact I have stone walls. I can’t even use it in the garage. I can see my neighbor’s router(they live through the woods) but not mine.
A WPA2 WiFi access point can be configured with a hidden SSID instead of a public one to make it harder to hijack.
From the comments on the article at engadget:
“Windows 10 isn’t vulnerable (because Windows breaks the spec in exactly the proposed way to avoid the attack), and iOS isn’t vulnerable either (for the same reason), and AFAIK it shares its networking stack with macOS so macOS is likely not vulnerable either.”
This means if you use Windows 10 or a Mac as a WiFi client you should be safe.
Linux clients are still vulnerable (Android).
And of course, the attack won't work unless the attacker is nearby and can physically access your network.
It’s an Android thing and someone has to be close by to Krack you ,LOL
Bkmrk.
What if there are no security updates for my router?
Our main attack is against the 4-way handshake, and does not exploit access points, but instead targets clients. So it might be that your router does not require security updates. We strongly advise you to contact your vendor for more details. In general though, you can try to mitigate attacks against routers and access points by disabling client functionality (which is for example used in repeater modes) and disabling 802.11r (fast roaming). For ordinary home users, your priority should be updating clients such as laptops and smartphones.
The only thing I know how to do... is turn on the modem/router and enter the password on my laptop.
Is there a higher standard than WPA2 that is more secure? My hardware is 2-3 years old. Maybe I should consider buying a new one.
Heard about this?
Users are urged to continue using WPA2 pending the availability of a fix, experts have said, as a security researcher went public with more information about a serious flaw in the security protocol.
Key Reinstallation Attacks work against all modern protected Wi-Fi networks. Depending on the network configuration, it is also possible to inject and manipulate data as well as eavesdropping on communications over the air. The only main limitation is that an attacker needs to be within range of a victim to exploit these weaknesses.
It affects WPA2 Personal and Enterprise, regardless of the encryption ciphers used by a network.
Android, Linux, Apple, Windows, OpenBSD, MediaTek, Linksys, and others, are all affected by some variant of the attacks. Mathy Vanhoef of KU Leuven, the Belgian security researcher who discovered the flaw, warned that the security hole stems from a fundamental cryptographic weakness in the latest generation of wireless networking rather than a programming blunder.
Simply changing Wi-Fi network passwords is not going to help – software and firmware will need to be updated to workaround this deep design flaw:
The weaknesses are in the Wi-Fi standard itself, and not in individual products or implementations. Therefore, any correct implementation of WPA2 is likely affected. To prevent the attack, users must update affected products as soon as security updates become available.
The key reinstallation attack (KRACK) targets the four-way handshake of the WPA2 protocol and relies on tricking a victim's device into reusing an already-in-use key. This sleight of hand is achieved by manipulating and replaying cryptographic handshake messages.
“When the victim reinstalls the key, associated parameters such as the incremental transmit packet number (i.e. nonce) and receive packet number (i.e. replay counter) are reset to their initial value,” Vanhoef explained today on a microsite about the attack. “Essentially, to guarantee security, a key should only be installed and used once. Unfortunately, we found this is not guaranteed by the WPA2 protocol. By manipulating cryptographic handshakes, we can abuse this weakness in practice.”
An attacker can force these nonce resets by collecting and replaying retransmissions of message three of the four-way handshake.
A nonce is a number that is not necessarily a secret but is meant only to be used once and never repeated. The flaw in WPA2 allows a nonce to be – or forced to be – repeated, thus allowing an attacker to extract the WPA2 session key and decrypt and compromise all wireless traffic for that session.
As a proof-of-concept, Vanhoef has published a demonstration of how a key reinstallation attack might be carried out against an Android smartphone. Android and Linux are particularly susceptible to the WPA2 flaw because a bug in the platform's widely used wpa_supplicant tool zeroes the key during the eavesdropping, thus the Wi-Fi traffic can be trivially decrypted.
In short, the vulnerability can be exploited on various operating systems, computers and devices to decrypt any information transferred over the air that isn't already encrypted with HTTPS, TLS, a VPN tunnel, or similar.
Worse, there's a bug in wpa_supplicant that causes the key to be set to all zeroes when you do this attack, so all traffic is trivially decrypted when attacking Linux and Android clients. — Graham Spookyland 🎃 (@gsuberland) October 16, 2017
Users are urged to continue using WPA2 pending the availability of a fix. VPN and other security technologies can offer protection to connections pending the availability of software update, according to preliminary analysis by one security researcher.
Crypto expert Arnold KL Yau told El Reg: “This sounds bad. However, a significant amount of the risk would be mitigated for services that use strong encryption at the transport or application layer (such as TLS, HTTPS, SSH, PGP) as well as applications secured by encrypted VPN protocols.
"Despite this, however, the ability to decrypt Wi-Fi traffic could still reveal unique device identifiers (MAC addresses) and massive amounts of metadata (websites visited, traffic timing, patterns, amount of data exchanged etc.) which may well violate the privacy of the users on the network and provide valuable intelligence to whoever's sitting in the black van.”
Research behind the attack will be presented at the Computer and Communications Security (CCS) conference in November, and at the Black Hat Europe conference in December. a research paper research paper entitled Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2 (PDF here). Frank Piessens of imec-DistriNet, who supervised his research, is credited as joint author of the paper.
Previous research by Vanhoef in related areas of HTTPS and Wi-Fi security can be found here and here.
Resolving the security problem is likely to involve applying security update to routers, something history shows is a problematic process.
Mark James, a security specialist at ESET, said: “One of the biggest concerns here of course is getting routers patched - firstly getting the average user to check and apply any firmware updates and secondly, some older routers may not even have a patch available - the average household would acquire an auto-configured router, install it and forget about it, until possibly they change their internet provider. Here, they may go through the same procedure; too many people never check or implement router updates as it’s something often too complicated for the home user to be involved in.”
Below is a video by Vanhoef demonstrating the wireless security weakness. ®
The latest Apple/Mac/iOS Pings can be found by searching Keyword "ApplePingList" on FreeRepublic's Search.
If you want on or off the Mac Ping List, Freepmail me
My take away from this is to have a very hard WIFI password. Since you do not access it often, it can be really complex, and can include special characters and both upper and lower case alphabetic characters as well as numbers and symbols. Don’t use anything that’s in a dictionary. By doing this, you can create a password that would take geological ages to crack by brute force. So regardless if a malicious actor can clone your WPA2 protected Router, he still has to hack your passwords by brute force, trying every possible password until he hits the right one. . .