KRACK Vulnerability and DD-WRT

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 07:56, 23 October 2017 (edit)
Tmittelstaedt (Talk | contribs)
(Mitigation steps other than patching clients and routers)
← Previous diff
Revision as of 08:00, 23 October 2017 (edit) (undo)
Tmittelstaedt (Talk | contribs)
(Mitigation steps other than patching clients and routers)
Next diff →
Line 56: Line 56:
Disabling Fast Roaming (802.11r) protects against this attack but FT is part of the standard and doing that can cause other problems. dd-wrt doesn't have Fast Roaming so if it's configured to only act as an AP and not as a repeater, it should not be vulnerable. Disabling Fast Roaming (802.11r) protects against this attack but FT is part of the standard and doing that can cause other problems. dd-wrt doesn't have Fast Roaming so if it's configured to only act as an AP and not as a repeater, it should not be vulnerable.
-Kong announced on 10/18 "There will be an option in the webif in the next build, that allows to set an flag that will fix that issue even if the client does not have a patch, but it can cause interoperability issues and therefore is off by default." in this [http://www.dd-wrt.com/phpBB2/viewtopic.php?t=311689] thread.+Kong announced on 10/18 "There will be an option in the webif in the next build, that allows to set an flag that will fix that issue even if the client does not have a patch, but it can cause interoperability issues and therefore is off by default." in this [http://www.dd-wrt.com/phpBB2/viewtopic.php?t=311689] thread. The option was set a day later here [https://w1.fi/cgit/hostap/commit/?id=6f234c1e2ee1ede29f2412b7012b3345ed8e52d3] into the build system.
== dd-wrt devices not vulnerable == == dd-wrt devices not vulnerable ==
Any Brainslayer build after 10/17/2017 Any Brainslayer build after 10/17/2017

Revision as of 08:00, 23 October 2017

Contents

Overview

The KRACK vulnerability was announced on 10/17/2017 and it is the most significant networking vulnerability since Heartbleed. It is documented here [1] by it's finder. The vulnerability allows an attacker that is within wifi range of the Access Point and the wifi client to tap into a connection made with WPA2 and see the unencrypted data going over it. This attack is primarily a client attack. dd-wrt contains client wireless code that is used for certain operations (repeating, etc) and is thus vulnerable. dd-wrt does NOT support 802.11r-2008 Fast Roaming which means it's server code is not vulnerable. (many commercial AP's do, however)

NOTE THAT THIS ATTACK DOES NOT ALLOW THE ATTACKER TO OBTAIN THE PRE-SHARED KEY (AKA "wifi password")

Note that while it is true that these same issues exist on WiFi networks that do not have encryption turned on, the user does get a warning message from their operating system when connecting to one of those networks.

Extent of vulnerability

Some of the locations that are affected:

  • Inner city housing with residential homes close together. In many cities the average home can see dozens of SSID advertisements from neighbor's wifi routers.
  • Apartment buildings, multiplexes, duplexes and other shared housing situations
  • Multi-tenant commercial buildings
  • Coffee shops, airport waiting rooms, hotels
  • Hospitals and medical wifi networks

Types of WiFi access points and routers potentially affected:

  • Any dd-wrt router running Brainslayer builds older than build 33525 (10/17/2017) or any obsolete builds (old Kong builds, Eko builds, and one-off builds such as the CrushedHat IPv6-in-4MB build as well as personal builds created by users from source before 10/17/2017. Some devices require older and specialty builds due to bugs in newer builds (ie: wl1 failing to work in the Linksys WRT 610N v1 in newer builds)
  • Any AP or router running any firmware released before 10/17/2017
  • ISP-supplied cable modems, DSL modems, and routers that have not been patched
  • Devices running OpenWRT released before the vulnerability announced
  • Wireless cellular "hotspot" devices such as the Verizon MiFi
  • Cellular phones configured for tethering.
  • Vehicle cellular devices that provide WiFi for vehicle occupants (some new cars do this)

Types of WiFi clients affected:

  • All cellular phones running Android or iOS or Windows Phone that have not been patched. As of 10/22/2017 neither Apple or Google has released patches.
  • Industrial scanning guns that use WiFi (handheld barcode scanners, etc.)
  • Mobile medical scanners and other medical systems that use WiFi networks
  • Unpatched operating systems that the users have disabled automatic patching
  • Obsolete operating systems (Windows XP, older MacOS X)

In theory it should be possible to design a virus that would hijack a user system and allow it to attack other systems on it's wifi network using this vulnerability.

Impact to DD-WRT

There are dozens if not hundreds of models of WiFi routers that will NEVER be patched by their manufacturers, either due to the manufacturer no longer existing, or the manufacturer refusing to release updates. For example the purchase of Linksys by Cisco then the selling of Linksys to Belkin created tens of orphaned models. There are MANY wifi vendors who refuse to devote programmer time to rebuild firmware for models that they have stopped selling. Some, such as Cisco, have formal End Of Life processes where the company unequivocally states that after EoL date, NO further firmware updates will be provided.

While it is probably a truism that the majority of residential users probably think a firmware file is a manila folder, there is a serious issue with businesses. Many businesses have a "patch or toss" approach and if a device is considered obsolete by it's manufacturer with no firmware forthcoming, the business has no choice but to retire the gear.

It may be that this will see increased use of dd-wrt in businesses. It may also be that there will be a flood of used WiFi gear that comes on to the market as a result of accelerated gear retirement. Certainly there will be increased interest in dd-wrt as a way of prolonging gear service life.

Mitigation steps other than patching clients and routers

Encrypting the data from the application to the server by the PC or phone operating system before transfer over the wifi network is one other way to protect against a KRACK attack. https, SSL IMAP and POP3, and VPN clients running in the client operating system are some examples of how this can be done.

Atheros-based dd-wrt routers can disable EAPOL Key Retries to block these attack as discussed here [2]

Setting MAC Address filtering DOES NOT protect against this attack

Disabling Fast Roaming (802.11r) protects against this attack but FT is part of the standard and doing that can cause other problems. dd-wrt doesn't have Fast Roaming so if it's configured to only act as an AP and not as a repeater, it should not be vulnerable.

Kong announced on 10/18 "There will be an option in the webif in the next build, that allows to set an flag that will fix that issue even if the client does not have a patch, but it can cause interoperability issues and therefore is off by default." in this [3] thread. The option was set a day later here [4] into the build system.

dd-wrt devices not vulnerable

Any Brainslayer build after 10/17/2017