KRACK Vulnerability and DD-WRT
From DD-WRT Wiki
Overview
The KRACK vulnerability was announced on 10/17/2017 and it is the most significant networking vulnerability since Heartbleed. It is documented here [1] by it's finder. The vulnerability allows an attacker that is within wifi range of the Access Point and the wifi client to tap into a connection made with WPA2 and see the unencrypted data going over it.
Extent of vulnerability
Some of the locations that are affected:
- Inner city housing with residential homes close together. In many cities the average home can see dozens of SSID advertisements from neighbor's wifi router.
- Apartment buildings, multiplexes, duplexes and other shared housing situations
- Multi-tenant commercial buildings
- Coffee shops, airport waiting rooms, hotels
Types of WiFi access points and routers potentially affected:
- Any dd-wrt router running Brainslayer builds older than build 33525 (10/17/2017) or any obsolete builds (old Kong builds, Eko builds, and one-off builds such as the CrushedHat IPv6-in-4MB build as well as personal builds created by users from source before 10/17/2017
- Any AP or router running any firmware released before 10/17/2017
- ISP-supplied cable modems, DSL modems, and routers that have not been patched
- Devices running OpenWRT released before the vulnerability announced
- Wireless cellular "hotspot" devices such as the Verizon MiFi
- Cellular phones configured for tethering.
- Vehicle cellular devices that provide WiFi for vehicle occupants (some new cars do this)
Types of WiFi clients affected:
- All cellular phones running Android or iOS or Windows Phone that have not been patched. As of 10/22/2017 neither Apple or Google has released patches.
- Industrial scanning guns that use WiFi (handheld barcode scanners, etc.)
- Unpatched operating systems that the users have disabled automatic patching
- Obsolete operating systems (Windows XP, older MacOS X)