KRACK Vulnerability and DD-WRT - Revision history http://wiki.dd-wrt.com/wiki/index.php?title=KRACK_Vulnerability_and_DD-WRT&action=history Revision history for this page on the wiki en MediaWiki 1.10.1 Fri, 29 Mar 2024 08:56:58 GMT Jeremywh7: various cleanup http://wiki.dd-wrt.com/wiki/index.php?title=KRACK_Vulnerability_and_DD-WRT&diff=54885&oldid=prev <p>various cleanup</p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 01:06, 12 September 2019</td> </tr> <tr><td colspan="2" align="left"><strong>Line 1:</strong></td> <td colspan="2" align="left"><strong>Line 1:</strong></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">== Overview ==</td><td>+</td><td style="background: #cfc; font-size: smaller;">==Overview==</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">The KRACK vulnerability was announced on 10/17/2017 and it is the most significant networking vulnerability since Heartbleed. It is documented here [https://www.krackattacks.com/] by it's finder. The vulnerability allows an attacker that is within wifi range of the Access Point and the wifi client to tap into a connection made with WPA2 and see the unencrypted data going over it.</td><td> </td><td style="background: #eee; font-size: smaller;">The KRACK vulnerability was announced on 10/17/2017 and it is the most significant networking vulnerability since Heartbleed. It is documented here [https://www.krackattacks.com/] by it's finder. The vulnerability allows an attacker that is within wifi range of the Access Point and the wifi client to tap into a connection made with WPA2 and see the unencrypted data going over it.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">This attack is primarily a client attack. dd-wrt contains client wireless code that is used for certain operations (repeating, etc) and is thus vulnerable. dd-wrt does NOT support 802.11r-2008 Fast Roaming which means it's server code is not vulnerable. (many commercial AP's do, however)</td><td> </td><td style="background: #eee; font-size: smaller;">This attack is primarily a client attack. dd-wrt contains client wireless code that is used for certain operations (repeating, etc) and is thus vulnerable. dd-wrt does NOT support 802.11r-2008 Fast Roaming which means it's server code is not vulnerable. (many commercial AP's do, however)</td></tr> <tr><td colspan="2" align="left"><strong>Line 8:</strong></td> <td colspan="2" align="left"><strong>Line 7:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">While it is true that these same issues exist on WiFi networks that do not have encryption turned on, the user does get a warning message from their operating system when connecting to one of those networks.</td><td> </td><td style="background: #eee; font-size: smaller;">While it is true that these same issues exist on WiFi networks that do not have encryption turned on, the user does get a warning message from their operating system when connecting to one of those networks.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">== <del style="color: red; font-weight: bold; text-decoration: none;">Location of vulnerability in </del>DD-WRT ==</td><td>+</td><td style="background: #cfc; font-size: smaller;">==DD-WRT <ins style="color: red; font-weight: bold; text-decoration: none;">firmware KRACK fix</ins>==</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">DD-WRT vulnerability depends on the chipset in the router model/version.</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*For any Brainslayer or Kong build:</ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">*<del style="color: red; font-weight: bold; text-decoration: none;">Non-</del>Broadcom <del style="color: red; font-weight: bold; text-decoration: none;">routers use hostapd, with fixes applied in the wpa_supplicant and hostapd code. Initial fixes were in build 33525, but completely in 33555. See [http</del>:<del style="color: red; font-weight: bold; text-decoration: none;">//svn.dd</del>-<del style="color: red; font-weight: bold; text-decoration: none;">wrt.com/timeline?from=Oct+19%2C+</del>2017<del style="color: red; font-weight: bold; text-decoration: none;">&amp;daysback=2&amp;changeset=on here]</del></td><td>+</td><td style="background: #cfc; font-size: smaller;">*<ins style="color: red; font-weight: bold; text-decoration: none;">*</ins>Broadcom: <ins style="color: red; font-weight: bold; text-decoration: none;">11-16</ins>-2017<ins style="color: red; font-weight: bold; text-decoration: none;">-r33772 </ins>or <ins style="color: red; font-weight: bold; text-decoration: none;">later</ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">*Broadcom routers were affected in the proprietary nas module, so driver releases from Broadcom were required. Initial fixes were in build 33607, but had widely reported wireless problems. The Broadom fixes were completed in ​SVN 33678, including for k26 (33655) &amp; k24 (33656). However, build 33679 is missing many files, so it is recommended to use 33772 </del>or <del style="color: red; font-weight: bold; text-decoration: none;">newer.</del></td><td>+</td><td style="background: #cfc; font-size: smaller;">*<ins style="color: red; font-weight: bold; text-decoration: none;">*All others</ins>: <ins style="color: red; font-weight: bold; text-decoration: none;">10</ins>-<ins style="color: red; font-weight: bold; text-decoration: none;">25</ins>-<ins style="color: red; font-weight: bold; text-decoration: none;">2017</ins>-<ins style="color: red; font-weight: bold; text-decoration: none;">r33607 </ins>or <ins style="color: red; font-weight: bold; text-decoration: none;">later</ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">*<del style="color: red; font-weight: bold; text-decoration: none;">Look up your router in [https</del>:<del style="color: red; font-weight: bold; text-decoration: none;">//www.dd</del>-<del style="color: red; font-weight: bold; text-decoration: none;">wrt.com/wiki/index.php/Supported_Devices Supported Devcies] and at wikidevi.com</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">*Another way to tell the difference is in the DD</del>-<del style="color: red; font-weight: bold; text-decoration: none;">WRT GUI, click ''Administration</del>-<del style="color: red; font-weight: bold; text-decoration: none;">&gt;Commands'' and put in the command &quot;ps&quot; then click Run Commands, if the output has &quot;nas&quot; </del>or <del style="color: red; font-weight: bold; text-decoration: none;">&quot;nasmodern&quot; in it the router is a non-hostapd router.</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">Note that there is no fix </del>for <del style="color: red; font-weight: bold; text-decoration: none;">VINT builds </del>(<del style="color: red; font-weight: bold; text-decoration: none;">primarily </del>the &quot;<del style="color: red; font-weight: bold; text-decoration: none;">original</del>&quot; <del style="color: red; font-weight: bold; text-decoration: none;">Linksys WRT54G v1 and v2 devices)</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">==Location of vulnerability in DD-WRT==</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">DD-WRT vulnerability depends on the router model version's chipset.</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*Non-Broadcom routers use hostapd, with fixes applied </ins>for <ins style="color: red; font-weight: bold; text-decoration: none;">wpa_supplicant and [hostapd https://w1.fi/]. Initial fixes were in build 33525, but completely in 33555. See [http://svn.dd-wrt.com/timeline?from=Oct+19%2C+2017&amp;daysback=2&amp;changeset=on here]</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*Broadcom routers were affected in the proprietary nas module, so driver releases from Broadcom were required. Initial fixes were in build 33607, but had widely reported wireless problems. The Broadcom fixes were completed in ​SVN 33678, including for k26 </ins>(<ins style="color: red; font-weight: bold; text-decoration: none;">33655) &amp; k24 (33656). However, build 33679 is missing many files, so it is recommended to use 33772 or newer.</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*For chipset details, see [[Supported_Devices]] and search at wikidevi.com</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*To check directly from </ins>the <ins style="color: red; font-weight: bold; text-decoration: none;">DD-WRT GUI, click ''Administration-&gt;Commands'' and put in the command </ins>&quot;<ins style="color: red; font-weight: bold; text-decoration: none;">ps</ins>&quot; <ins style="color: red; font-weight: bold; text-decoration: none;">then click Run Commands, if the output has &quot;nas&quot; or &quot;nasmodern&quot; it is a Broadcom router.</ins></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">The hostapd fix is detailed here [https</del>:<del style="color: red; font-weight: bold; text-decoration: none;">//w1</del>.<del style="color: red; font-weight: bold; text-decoration: none;">fi/]</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Note</ins>: <ins style="color: red; font-weight: bold; text-decoration: none;">there is no fix for VINT builds (e.g</ins>. <ins style="color: red; font-weight: bold; text-decoration: none;">Linksys WRT54G v1 and v2 devices) but BS builds support VINT devices anyway</ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">== Build recommendations ==</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">==Build recommendations==</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Note that Repeater Bridge has been broken in the K2.6 builds after build 26125 for Broadcom devices (it works in K3.x builds) due to wireless driver issues. Client Bridge works. So if you need that you must move to K3.x builds to have the vulnerability fixed or downgrade to K2.4 builds (if your device supports it)</td><td> </td><td style="background: #eee; font-size: smaller;">Note that Repeater Bridge has been broken in the K2.6 builds after build 26125 for Broadcom devices (it works in K3.x builds) due to wireless driver issues. Client Bridge works. So if you need that you must move to K3.x builds to have the vulnerability fixed or downgrade to K2.4 builds (if your device supports it)</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">A number of people </del>have reported that <del style="color: red; font-weight: bold; text-decoration: none;">builds </del>post 33525 are significantly faster. Build 33555 and 33607 are also slightly smaller than 33525 and their builds fit on certain routers that have slightly smaller main partitions (<del style="color: red; font-weight: bold; text-decoration: none;">ie: </del>Netgear)</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Some </ins>have reported that post<ins style="color: red; font-weight: bold; text-decoration: none;">-</ins>33525 <ins style="color: red; font-weight: bold; text-decoration: none;">builds </ins>are significantly faster. Build 33555 and 33607 are also slightly smaller than 33525 and their builds fit on certain routers that have slightly smaller main partitions (<ins style="color: red; font-weight: bold; text-decoration: none;">e.g. </ins>Netgear)<ins style="color: red; font-weight: bold; text-decoration: none;">.</ins></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">IPv6 was broken in build 33555 and only K2.4 and Mini (both lack IPv6) should be used in that build. Build 33607 had some issues with wireless radios particularly on dual radio devices and should be avoided. IPv6 was fixed in build 33679 however that build is larger than 33555 and Mega and std_nokaid_small versions of that build MAY NOT LOAD on a number of devices (primarily certain Netgear devices which reserve some of the flash in a separate partition) both 4MB and 8MB flash devices are affected.</td><td> </td><td style="background: #eee; font-size: smaller;">IPv6 was broken in build 33555 and only K2.4 and Mini (both lack IPv6) should be used in that build. Build 33607 had some issues with wireless radios particularly on dual radio devices and should be avoided. IPv6 was fixed in build 33679 however that build is larger than 33555 and Mega and std_nokaid_small versions of that build MAY NOT LOAD on a number of devices (primarily certain Netgear devices which reserve some of the flash in a separate partition) both 4MB and 8MB flash devices are affected.</td></tr> <tr><td colspan="2" align="left"><strong>Line 30:</strong></td> <td colspan="2" align="left"><strong>Line 31:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==Extent of vulnerability==</td><td> </td><td style="background: #eee; font-size: smaller;">==Extent of vulnerability==</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"></td><td colspan="2">&nbsp;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Some of the locations that are affected:</td><td> </td><td style="background: #eee; font-size: smaller;">Some of the locations that are affected:</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;">* <ins style="color: red; font-weight: bold; text-decoration: none;">Closely spaced </ins>residential homes<ins style="color: red; font-weight: bold; text-decoration: none;">: in </ins>many cities the average home can see dozens of SSID advertisements from neighbor's <ins style="color: red; font-weight: bold; text-decoration: none;">wireless </ins>routers.</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">* <del style="color: red; font-weight: bold; text-decoration: none;">Inner city housing with </del>residential homes <del style="color: red; font-weight: bold; text-decoration: none;">close together. In </del>many cities the average home can see dozens of SSID advertisements from neighbor's <del style="color: red; font-weight: bold; text-decoration: none;">wifi </del>routers.</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">* Apartment buildings, multiplexes, duplexes and other shared housing situations</td><td> </td><td style="background: #eee; font-size: smaller;">* Apartment buildings, multiplexes, duplexes and other shared housing situations</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">* Multi-tenant commercial buildings</td><td>+</td><td style="background: #cfc; font-size: smaller;">* Multi-tenant commercial buildings<ins style="color: red; font-weight: bold; text-decoration: none;">, coffee </ins>shops, airport waiting rooms, hotels</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">* Coffee </del>shops, airport waiting rooms, hotels</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">* Hospitals and medical wifi networks</td><td> </td><td style="background: #eee; font-size: smaller;">* Hospitals and medical wifi networks</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Examples of types of WiFi access points and routers potentially affected:</td><td> </td><td style="background: #eee; font-size: smaller;">Examples of types of WiFi access points and routers potentially affected:</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"></td><td colspan="2">&nbsp;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">* Any dd-wrt router running Brainslayer builds older than build 33525 (10/17/2017) or any obsolete builds (old Kong builds, Eko builds, and one-off builds such as the CrushedHat IPv6-in-4MB build as well as personal builds created by users from source before 10/17/2017. Some devices require older and specialty builds due to bugs in newer builds (ie: wl1 failing to work in the Linksys WRT 610N v1 in newer builds)</td><td> </td><td style="background: #eee; font-size: smaller;">* Any dd-wrt router running Brainslayer builds older than build 33525 (10/17/2017) or any obsolete builds (old Kong builds, Eko builds, and one-off builds such as the CrushedHat IPv6-in-4MB build as well as personal builds created by users from source before 10/17/2017. Some devices require older and specialty builds due to bugs in newer builds (ie: wl1 failing to work in the Linksys WRT 610N v1 in newer builds)</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">* Any AP or router running any firmware released before 10/17/2017 that supports client bridging, or 802.11r AKA fast roaming, this includes ISP-supplied cable modems, DSL modems, etc. </td><td> </td><td style="background: #eee; font-size: smaller;">* Any AP or router running any firmware released before 10/17/2017 that supports client bridging, or 802.11r AKA fast roaming, this includes ISP-supplied cable modems, DSL modems, etc. </td></tr> <tr><td colspan="2" align="left"><strong>Line 50:</strong></td> <td colspan="2" align="left"><strong>Line 47:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Types of WiFi clients affected:</td><td> </td><td style="background: #eee; font-size: smaller;">Types of WiFi clients affected:</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"></td><td colspan="2">&nbsp;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">* All cellular phones running Android or iOS or Windows Phone that have not been patched. Apple issued patches for KRACK on 10/31/17 in iOS 11.1 and macOS 11.13.1. Google released KRACK patches in it's 11/6/17 security update [https://source.android.com/security/bulletin/2017-11-01] but as most phones Android OS is supplied by phone vendors, individual phones may take months to be patched (or may never be patched if the manufacturer doesn't want to support them). Microsoft released a patch for Windows.</td><td> </td><td style="background: #eee; font-size: smaller;">* All cellular phones running Android or iOS or Windows Phone that have not been patched. Apple issued patches for KRACK on 10/31/17 in iOS 11.1 and macOS 11.13.1. Google released KRACK patches in it's 11/6/17 security update [https://source.android.com/security/bulletin/2017-11-01] but as most phones Android OS is supplied by phone vendors, individual phones may take months to be patched (or may never be patched if the manufacturer doesn't want to support them). Microsoft released a patch for Windows.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">* Industrial scanning guns that use WiFi (handheld barcode scanners, etc.)</td><td> </td><td style="background: #eee; font-size: smaller;">* Industrial scanning guns that use WiFi (handheld barcode scanners, etc.)</td></tr> <tr><td colspan="2" align="left"><strong>Line 59:</strong></td> <td colspan="2" align="left"><strong>Line 55:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">In theory it should be possible to design a virus that would hijack a user system and allow it to attack other systems on it's wifi network using this vulnerability.</td><td> </td><td style="background: #eee; font-size: smaller;">In theory it should be possible to design a virus that would hijack a user system and allow it to attack other systems on it's wifi network using this vulnerability.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">== Impact to DD-WRT ==</td><td>+</td><td style="background: #cfc; font-size: smaller;">==Impact to DD-WRT==</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">There are dozens if not hundreds of models of WiFi routers that will NEVER be patched by their manufacturers, either due to the manufacturer no longer existing, or the manufacturer refusing to release updates. For example the purchase of Linksys by Cisco then the selling of Linksys to Belkin created tens of orphaned models. There are MANY wifi vendors who refuse to devote programmer time to rebuild firmware for models that they have stopped selling. Some, such as Cisco, have formal End Of Life processes where the company unequivocally states that after EoL date, NO further firmware updates will be provided.</td><td> </td><td style="background: #eee; font-size: smaller;">There are dozens if not hundreds of models of WiFi routers that will NEVER be patched by their manufacturers, either due to the manufacturer no longer existing, or the manufacturer refusing to release updates. For example the purchase of Linksys by Cisco then the selling of Linksys to Belkin created tens of orphaned models. There are MANY wifi vendors who refuse to devote programmer time to rebuild firmware for models that they have stopped selling. Some, such as Cisco, have formal End Of Life processes where the company unequivocally states that after EoL date, NO further firmware updates will be provided.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td colspan="2" align="left"><strong>Line 67:</strong></td> <td colspan="2" align="left"><strong>Line 62:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">It may be that this will see increased use of dd-wrt in businesses. It may also be that there will be a flood of used WiFi gear that comes on to the market as a result of accelerated gear retirement. Certainly there will be increased interest in dd-wrt as a way of prolonging gear service life.</td><td> </td><td style="background: #eee; font-size: smaller;">It may be that this will see increased use of dd-wrt in businesses. It may also be that there will be a flood of used WiFi gear that comes on to the market as a result of accelerated gear retirement. Certainly there will be increased interest in dd-wrt as a way of prolonging gear service life.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">== Mitigation steps other than patching clients and routers ==</td><td>+</td><td style="background: #cfc; font-size: smaller;">==Mitigation steps other than patching clients and routers==</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Encrypting the data from the application to the server by the PC or phone operating system before transfer over the wifi network is one other way to protect against a KRACK attack. https, SSL IMAP and POP3, and VPN clients running in the client operating system are some examples of how this can be done.</td><td> </td><td style="background: #eee; font-size: smaller;">Encrypting the data from the application to the server by the PC or phone operating system before transfer over the wifi network is one other way to protect against a KRACK attack. https, SSL IMAP and POP3, and VPN clients running in the client operating system are some examples of how this can be done.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td colspan="2" align="left"><strong>Line 77:</strong></td> <td colspan="2" align="left"><strong>Line 71:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Kong announced on 10/18 &quot;There will be an option in the webif in the next build, that allows to set an flag that will fix that issue even if the client does not have a patch, but it can cause interoperability issues and therefore is off by default.&quot; in this [http://www.dd-wrt.com/phpBB2/viewtopic.php?t=311689] thread. The option was set a day later here [https://w1.fi/cgit/hostap/commit/?id=6f234c1e2ee1ede29f2412b7012b3345ed8e52d3] into the build system.</td><td> </td><td style="background: #eee; font-size: smaller;">Kong announced on 10/18 &quot;There will be an option in the webif in the next build, that allows to set an flag that will fix that issue even if the client does not have a patch, but it can cause interoperability issues and therefore is off by default.&quot; in this [http://www.dd-wrt.com/phpBB2/viewtopic.php?t=311689] thread. The option was set a day later here [https://w1.fi/cgit/hostap/commit/?id=6f234c1e2ee1ede29f2412b7012b3345ed8e52d3] into the build system.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">Note <del style="color: red; font-weight: bold; text-decoration: none;">that </del>setting MAC Address filtering DOES NOT protect against this attack!<del style="color: red; font-weight: bold; text-decoration: none;">!</del></td><td>+</td><td style="background: #cfc; font-size: smaller;">Note<ins style="color: red; font-weight: bold; text-decoration: none;">: </ins>setting MAC Address filtering DOES NOT protect against this attack!</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">== dd-wrt device firmware not vulnerable ==</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">* Any Brainslayer or Kong build 10/25/2017 or later</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">[[Category: Documentation]]</td><td> </td><td style="background: #eee; font-size: smaller;">[[Category: Documentation]]</td></tr> </table> Thu, 12 Sep 2019 01:06:48 GMT Jeremywh7 http://wiki.dd-wrt.com/wiki/index.php/Talk:KRACK_Vulnerability_and_DD-WRT Jeremywh7 at 18:43, 5 February 2018 http://wiki.dd-wrt.com/wiki/index.php?title=KRACK_Vulnerability_and_DD-WRT&diff=53504&oldid=prev <p></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 18:43, 5 February 2018</td> </tr> <tr><td colspan="2" align="left"><strong>Line 4:</strong></td> <td colspan="2" align="left"><strong>Line 4:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">This attack is primarily a client attack. dd-wrt contains client wireless code that is used for certain operations (repeating, etc) and is thus vulnerable. dd-wrt does NOT support 802.11r-2008 Fast Roaming which means it's server code is not vulnerable. (many commercial AP's do, however)</td><td> </td><td style="background: #eee; font-size: smaller;">This attack is primarily a client attack. dd-wrt contains client wireless code that is used for certain operations (repeating, etc) and is thus vulnerable. dd-wrt does NOT support 802.11r-2008 Fast Roaming which means it's server code is not vulnerable. (many commercial AP's do, however)</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">NOTE <del style="color: red; font-weight: bold; text-decoration: none;">THAT </del>THIS ATTACK DOES NOT ALLOW THE ATTACKER TO OBTAIN THE PRE-SHARED KEY (<del style="color: red; font-weight: bold; text-decoration: none;">AKA </del>&quot;wifi password&quot;)</td><td>+</td><td style="background: #cfc; font-size: smaller;">NOTE<ins style="color: red; font-weight: bold; text-decoration: none;">: </ins>THIS ATTACK DOES NOT ALLOW THE ATTACKER TO OBTAIN THE PRE-SHARED KEY (&quot;wifi password&quot;)</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">Note that while </del>it is true that these same issues exist on WiFi networks that do not have encryption turned on, the user does get a warning message from their operating system when connecting to one of those networks.</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">While </ins>it is true that these same issues exist on WiFi networks that do not have encryption turned on, the user does get a warning message from their operating system when connecting to one of those networks.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">== Location of vulnerability in <del style="color: red; font-weight: bold; text-decoration: none;">dd</del>-<del style="color: red; font-weight: bold; text-decoration: none;">wrt </del>==</td><td>+</td><td style="background: #cfc; font-size: smaller;">== Location of vulnerability in <ins style="color: red; font-weight: bold; text-decoration: none;">DD</ins>-<ins style="color: red; font-weight: bold; text-decoration: none;">WRT </ins>==</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">DD-WRT vulnerability depends on the chipset in the router model/version.</ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">dd</del>-<del style="color: red; font-weight: bold; text-decoration: none;">wrt </del>routers <del style="color: red; font-weight: bold; text-decoration: none;">running </del>hostapd <del style="color: red; font-weight: bold; text-decoration: none;">were fixed </del>in the wpa_supplicant and hostapd code in build 33525. <del style="color: red; font-weight: bold; text-decoration: none;"> non-hostapd </del>dd-wrt routers were <del style="color: red; font-weight: bold; text-decoration: none;">fixed </del>in build 33607 (<del style="color: red; font-weight: bold; text-decoration: none;">the </del>so-<del style="color: red; font-weight: bold; text-decoration: none;">called Broadcom fix) A quick </del>way to tell the difference is in <del style="color: red; font-weight: bold; text-decoration: none;">dd</del>-<del style="color: red; font-weight: bold; text-decoration: none;">wrt </del>click Administration<del style="color: red; font-weight: bold; text-decoration: none;">, </del>Commands and put in the command &quot;ps&quot; then click Run Commands, if the output has &quot;nas&quot; or &quot;nasmodern&quot; in it the router is a non-hostapd router.</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*Non</ins>-<ins style="color: red; font-weight: bold; text-decoration: none;">Broadcom </ins>routers <ins style="color: red; font-weight: bold; text-decoration: none;">use </ins>hostapd<ins style="color: red; font-weight: bold; text-decoration: none;">, with fixes applied </ins>in the wpa_supplicant and hostapd code<ins style="color: red; font-weight: bold; text-decoration: none;">. Initial fixes were </ins>in build 33525<ins style="color: red; font-weight: bold; text-decoration: none;">, but completely in 33555. See [http://svn</ins>.dd-wrt<ins style="color: red; font-weight: bold; text-decoration: none;">.com/timeline?from=Oct+19%2C+2017&amp;daysback=2&amp;changeset=on here]</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*Broadcom </ins>routers were <ins style="color: red; font-weight: bold; text-decoration: none;">affected in the proprietary nas module, so driver releases from Broadcom were required. Initial fixes were </ins>in build 33607<ins style="color: red; font-weight: bold; text-decoration: none;">, but had widely reported wireless problems. The Broadom fixes were completed in ​SVN 33678, including for k26 </ins>(<ins style="color: red; font-weight: bold; text-decoration: none;">33655) &amp; k24 (33656). However, build 33679 is missing many files, </ins>so <ins style="color: red; font-weight: bold; text-decoration: none;">it is recommended to use 33772 or newer.</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*Look up your router in [https://www.dd</ins>-<ins style="color: red; font-weight: bold; text-decoration: none;">wrt.com/wiki/index.php/Supported_Devices Supported Devcies] and at wikidevi.com</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*Another </ins>way to tell the difference is in <ins style="color: red; font-weight: bold; text-decoration: none;">the DD</ins>-<ins style="color: red; font-weight: bold; text-decoration: none;">WRT GUI, </ins>click <ins style="color: red; font-weight: bold; text-decoration: none;">''</ins>Administration<ins style="color: red; font-weight: bold; text-decoration: none;">-&gt;</ins>Commands<ins style="color: red; font-weight: bold; text-decoration: none;">'' </ins>and put in the command &quot;ps&quot; then click Run Commands, if the output has &quot;nas&quot; or &quot;nasmodern&quot; in it the router is a non-hostapd router.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Note that there is no fix for VINT builds (primarily the &quot;original&quot; Linksys WRT54G v1 and v2 devices)</td><td> </td><td style="background: #eee; font-size: smaller;">Note that there is no fix for VINT builds (primarily the &quot;original&quot; Linksys WRT54G v1 and v2 devices)</td></tr> </table> Mon, 05 Feb 2018 18:43:37 GMT Jeremywh7 http://wiki.dd-wrt.com/wiki/index.php/Talk:KRACK_Vulnerability_and_DD-WRT Ian5142: /* dd-wrt device firmware not vulnerable */ http://wiki.dd-wrt.com/wiki/index.php?title=KRACK_Vulnerability_and_DD-WRT&diff=53142&oldid=prev <p><span class="autocomment">dd-wrt device firmware not vulnerable</span></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 16:55, 17 November 2017</td> </tr> <tr><td colspan="2" align="left"><strong>Line 80:</strong></td> <td colspan="2" align="left"><strong>Line 80:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">* Any Brainslayer or Kong build 10/25/2017 or later</td><td> </td><td style="background: #eee; font-size: smaller;">* Any Brainslayer or Kong build 10/25/2017 or later</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">[Category: Documentation]</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">[</ins>[Category: Documentation<ins style="color: red; font-weight: bold; text-decoration: none;">]</ins>]</td></tr> </table> Fri, 17 Nov 2017 16:55:27 GMT Ian5142 http://wiki.dd-wrt.com/wiki/index.php/Talk:KRACK_Vulnerability_and_DD-WRT Ian5142: /* dd-wrt device firmware not vulnerable */ http://wiki.dd-wrt.com/wiki/index.php?title=KRACK_Vulnerability_and_DD-WRT&diff=53141&oldid=prev <p><span class="autocomment">dd-wrt device firmware not vulnerable</span></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 16:55, 17 November 2017</td> </tr> <tr><td colspan="2" align="left"><strong>Line 79:</strong></td> <td colspan="2" align="left"><strong>Line 79:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">* Any Brainslayer or Kong build 10/25/2017 or later</td><td> </td><td style="background: #eee; font-size: smaller;">* Any Brainslayer or Kong build 10/25/2017 or later</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">[Category: Documentation]</td></tr> </table> Fri, 17 Nov 2017 16:55:13 GMT Ian5142 http://wiki.dd-wrt.com/wiki/index.php/Talk:KRACK_Vulnerability_and_DD-WRT Tmittelstaedt: /* Location of vulnerability in dd-wrt */ http://wiki.dd-wrt.com/wiki/index.php?title=KRACK_Vulnerability_and_DD-WRT&diff=52965&oldid=prev <p><span class="autocomment">Location of vulnerability in dd-wrt</span></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 08:06, 13 November 2017</td> </tr> <tr><td colspan="2" align="left"><strong>Line 13:</strong></td> <td colspan="2" align="left"><strong>Line 13:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Note that there is no fix for VINT builds (primarily the &quot;original&quot; Linksys WRT54G v1 and v2 devices)</td><td> </td><td style="background: #eee; font-size: smaller;">Note that there is no fix for VINT builds (primarily the &quot;original&quot; Linksys WRT54G v1 and v2 devices)</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">The hostapd fix is detailed here [https://w1.fi/]</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">== Build recommendations ==</td><td> </td><td style="background: #eee; font-size: smaller;">== Build recommendations ==</td></tr> </table> Mon, 13 Nov 2017 08:06:12 GMT Tmittelstaedt http://wiki.dd-wrt.com/wiki/index.php/Talk:KRACK_Vulnerability_and_DD-WRT Ian5142: /* Mitigation steps other than patching clients and routers */ http://wiki.dd-wrt.com/wiki/index.php?title=KRACK_Vulnerability_and_DD-WRT&diff=52939&oldid=prev <p><span class="autocomment">Mitigation steps other than patching clients and routers</span></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 02:08, 13 November 2017</td> </tr> <tr><td colspan="2" align="left"><strong>Line 66:</strong></td> <td colspan="2" align="left"><strong>Line 66:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Encrypting the data from the application to the server by the PC or phone operating system before transfer over the wifi network is one other way to protect against a KRACK attack. https, SSL IMAP and POP3, and VPN clients running in the client operating system are some examples of how this can be done.</td><td> </td><td style="background: #eee; font-size: smaller;">Encrypting the data from the application to the server by the PC or phone operating system before transfer over the wifi network is one other way to protect against a KRACK attack. https, SSL IMAP and POP3, and VPN clients running in the client operating system are some examples of how this can be done.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">Atheros-based dd-wrt routers can disable EAPOL Key Retries to block these attack as discussed here [<del style="color: red; font-weight: bold; text-decoration: none;">http</del>://dd-wrt.com/wiki/index.php/QCA_wireless_settings]</td><td>+</td><td style="background: #cfc; font-size: smaller;">Atheros-based dd-wrt routers can disable EAPOL Key Retries to block these attack as discussed here<ins style="color: red; font-weight: bold; text-decoration: none;">: </ins>[<ins style="color: red; font-weight: bold; text-decoration: none;">https</ins>://<ins style="color: red; font-weight: bold; text-decoration: none;">www.</ins>dd-wrt.com/wiki/index.php/QCA_wireless_settings<ins style="color: red; font-weight: bold; text-decoration: none;">#Disable_EAPOL_Key_Retries Disable EAPOL Key Retries</ins>]</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Disable any client access in dd-wrt. Because dd-wrt does not have 802.11r support (fast roaming) it's AP server code is not vulnerable so if it is configured only as an AP (repeater functionality turned off) the vulnerability is not exploitable against the AP. (it IS still exploitable against the client if the client isn't patched)</td><td> </td><td style="background: #eee; font-size: smaller;">Disable any client access in dd-wrt. Because dd-wrt does not have 802.11r support (fast roaming) it's AP server code is not vulnerable so if it is configured only as an AP (repeater functionality turned off) the vulnerability is not exploitable against the AP. (it IS still exploitable against the client if the client isn't patched)</td></tr> </table> Mon, 13 Nov 2017 02:08:14 GMT Ian5142 http://wiki.dd-wrt.com/wiki/index.php/Talk:KRACK_Vulnerability_and_DD-WRT Tmittelstaedt: /* Extent of vulnerability */ http://wiki.dd-wrt.com/wiki/index.php?title=KRACK_Vulnerability_and_DD-WRT&diff=52873&oldid=prev <p><span class="autocomment">Extent of vulnerability</span></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 08:58, 9 November 2017</td> </tr> <tr><td colspan="2" align="left"><strong>Line 46:</strong></td> <td colspan="2" align="left"><strong>Line 46:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Types of WiFi clients affected:</td><td> </td><td style="background: #eee; font-size: smaller;">Types of WiFi clients affected:</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">* All cellular phones running Android or iOS or Windows Phone that have not been patched. Apple issued patches for KRACK on 10/31/17 in iOS 11.1 and macOS 11.13.1. Google <del style="color: red; font-weight: bold; text-decoration: none;">is releasing </del>KRACK patches in it's 11/6/17 security update but as most phones Android OS is supplied by phone vendors, individual phones may take months to be patched (or may never be patched if the manufacturer doesn't want to support them). Microsoft released a patch for Windows.</td><td>+</td><td style="background: #cfc; font-size: smaller;">* All cellular phones running Android or iOS or Windows Phone that have not been patched. Apple issued patches for KRACK on 10/31/17 in iOS 11.1 and macOS 11.13.1. Google <ins style="color: red; font-weight: bold; text-decoration: none;">released </ins>KRACK patches in it's 11/6/17 security update <ins style="color: red; font-weight: bold; text-decoration: none;">[https://source.android.com/security/bulletin/2017-11-01] </ins>but as most phones Android OS is supplied by phone vendors, individual phones may take months to be patched (or may never be patched if the manufacturer doesn't want to support them). Microsoft released a patch for Windows.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">* Industrial scanning guns that use WiFi (handheld barcode scanners, etc.)</td><td> </td><td style="background: #eee; font-size: smaller;">* Industrial scanning guns that use WiFi (handheld barcode scanners, etc.)</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">* Mobile medical scanners and other medical systems that use WiFi networks</td><td> </td><td style="background: #eee; font-size: smaller;">* Mobile medical scanners and other medical systems that use WiFi networks</td></tr> </table> Thu, 09 Nov 2017 08:58:16 GMT Tmittelstaedt http://wiki.dd-wrt.com/wiki/index.php/Talk:KRACK_Vulnerability_and_DD-WRT Tmittelstaedt: /* Build recommendations */ http://wiki.dd-wrt.com/wiki/index.php?title=KRACK_Vulnerability_and_DD-WRT&diff=52872&oldid=prev <p><span class="autocomment">Build recommendations</span></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 08:47, 9 November 2017</td> </tr> <tr><td colspan="2" align="left"><strong>Line 22:</strong></td> <td colspan="2" align="left"><strong>Line 22:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">IPv6 was broken in build 33555 and only K2.4 and Mini (both lack IPv6) should be used in that build. Build 33607 had some issues with wireless radios particularly on dual radio devices and should be avoided. IPv6 was fixed in build 33679 however that build is larger than 33555 and Mega and std_nokaid_small versions of that build MAY NOT LOAD on a number of devices (primarily certain Netgear devices which reserve some of the flash in a separate partition) both 4MB and 8MB flash devices are affected.</td><td> </td><td style="background: #eee; font-size: smaller;">IPv6 was broken in build 33555 and only K2.4 and Mini (both lack IPv6) should be used in that build. Build 33607 had some issues with wireless radios particularly on dual radio devices and should be avoided. IPv6 was fixed in build 33679 however that build is larger than 33555 and Mega and std_nokaid_small versions of that build MAY NOT LOAD on a number of devices (primarily certain Netgear devices which reserve some of the flash in a separate partition) both 4MB and 8MB flash devices are affected.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">It is <del style="color: red; font-weight: bold; text-decoration: none;">NOT recommended </del>to upgrade production routers UNLESS they are vulnerable (ie: used as a client bridge or repeater) ALWAYS search the BUILD thread in the forum for your router to see if someone has tested on it.</td><td>+</td><td style="background: #cfc; font-size: smaller;">It is <ins style="color: red; font-weight: bold; text-decoration: none;">not necessary </ins>to upgrade production routers UNLESS they are vulnerable (ie: used as a client bridge or repeater) ALWAYS search the BUILD thread in the forum for your router to see if someone has tested on it.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==Extent of vulnerability==</td><td> </td><td style="background: #eee; font-size: smaller;">==Extent of vulnerability==</td></tr> </table> Thu, 09 Nov 2017 08:47:22 GMT Tmittelstaedt http://wiki.dd-wrt.com/wiki/index.php/Talk:KRACK_Vulnerability_and_DD-WRT Tmittelstaedt: /* Build recommendations */ http://wiki.dd-wrt.com/wiki/index.php?title=KRACK_Vulnerability_and_DD-WRT&diff=52871&oldid=prev <p><span class="autocomment">Build recommendations</span></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 08:40, 9 November 2017</td> </tr> <tr><td colspan="2" align="left"><strong>Line 18:</strong></td> <td colspan="2" align="left"><strong>Line 18:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Note that Repeater Bridge has been broken in the K2.6 builds after build 26125 for Broadcom devices (it works in K3.x builds) due to wireless driver issues. Client Bridge works. So if you need that you must move to K3.x builds to have the vulnerability fixed or downgrade to K2.4 builds (if your device supports it)</td><td> </td><td style="background: #eee; font-size: smaller;">Note that Repeater Bridge has been broken in the K2.6 builds after build 26125 for Broadcom devices (it works in K3.x builds) due to wireless driver issues. Client Bridge works. So if you need that you must move to K3.x builds to have the vulnerability fixed or downgrade to K2.4 builds (if your device supports it)</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">A number of people have reported that builds post 33525 are significantly faster. Build 33555 and 33607 are also slightly smaller than <del style="color: red; font-weight: bold; text-decoration: none;">33535 </del>and their builds fit on certain routers that have slightly smaller main partitions (ie: Netgear)</td><td>+</td><td style="background: #cfc; font-size: smaller;">A number of people have reported that builds post 33525 are significantly faster. Build 33555 and 33607 are also slightly smaller than <ins style="color: red; font-weight: bold; text-decoration: none;">33525 </ins>and their builds fit on certain routers that have slightly smaller main partitions (ie: Netgear)</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">IPv6 was broken in build 33555 and only K2.4 and Mini (both lack IPv6) should be used in that build. Build 33607 had some issues with wireless radios particularly on dual radio devices and should be avoided. IPv6 was fixed in build 33679 however that build is larger than 33555 and Mega and std_nokaid_small versions of that build MAY NOT LOAD on a number of devices (primarily certain Netgear devices which reserve some of the flash in a separate partition) both 4MB and 8MB flash devices are affected.</td><td> </td><td style="background: #eee; font-size: smaller;">IPv6 was broken in build 33555 and only K2.4 and Mini (both lack IPv6) should be used in that build. Build 33607 had some issues with wireless radios particularly on dual radio devices and should be avoided. IPv6 was fixed in build 33679 however that build is larger than 33555 and Mega and std_nokaid_small versions of that build MAY NOT LOAD on a number of devices (primarily certain Netgear devices which reserve some of the flash in a separate partition) both 4MB and 8MB flash devices are affected.</td></tr> </table> Thu, 09 Nov 2017 08:40:31 GMT Tmittelstaedt http://wiki.dd-wrt.com/wiki/index.php/Talk:KRACK_Vulnerability_and_DD-WRT Tmittelstaedt: /* Build recommendations */ http://wiki.dd-wrt.com/wiki/index.php?title=KRACK_Vulnerability_and_DD-WRT&diff=52870&oldid=prev <p><span class="autocomment">Build recommendations</span></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 07:49, 9 November 2017</td> </tr> <tr><td colspan="2" align="left"><strong>Line 21:</strong></td> <td colspan="2" align="left"><strong>Line 21:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">IPv6 was broken in build 33555 and only K2.4 and Mini (both lack IPv6) should be used in that build. Build 33607 had some issues with wireless radios particularly on dual radio devices and should be avoided. IPv6 was fixed in build 33679 however that build is larger than 33555 and Mega and std_nokaid_small versions of that build MAY NOT LOAD on a number of devices (primarily certain Netgear devices which reserve some of the flash in a separate partition) both 4MB and 8MB flash devices are affected.</td><td> </td><td style="background: #eee; font-size: smaller;">IPv6 was broken in build 33555 and only K2.4 and Mini (both lack IPv6) should be used in that build. Build 33607 had some issues with wireless radios particularly on dual radio devices and should be avoided. IPv6 was fixed in build 33679 however that build is larger than 33555 and Mega and std_nokaid_small versions of that build MAY NOT LOAD on a number of devices (primarily certain Netgear devices which reserve some of the flash in a separate partition) both 4MB and 8MB flash devices are affected.</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">It is NOT recommended to upgrade production routers UNLESS they are vulnerable (ie: used as a client bridge or repeater) ALWAYS search the BUILD thread in the forum for your router to see if someone has tested on it.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==Extent of vulnerability==</td><td> </td><td style="background: #eee; font-size: smaller;">==Extent of vulnerability==</td></tr> </table> Thu, 09 Nov 2017 07:49:11 GMT Tmittelstaedt http://wiki.dd-wrt.com/wiki/index.php/Talk:KRACK_Vulnerability_and_DD-WRT