KRACK Vulnerability and DD-WRT

From DD-WRT Wiki

Revision as of 17:08, 23 October 2017 by Tmittelstaedt (Talk | contribs)
Jump to: navigation, search

Contents

Overview

The KRACK vulnerability was announced on 10/17/2017 and it is the most significant networking vulnerability since Heartbleed. It is documented here [1] by it's finder. The vulnerability allows an attacker that is within wifi range of the Access Point and the wifi client to tap into a connection made with WPA2 and see the unencrypted data going over it. This attack is primarily a client attack. dd-wrt contains client wireless code that is used for certain operations (repeating, etc) and is thus vulnerable. dd-wrt does NOT support 802.11r-2008 Fast Roaming which means it's server code is not vulnerable. (many commercial AP's do, however)

NOTE THAT THIS ATTACK DOES NOT ALLOW THE ATTACKER TO OBTAIN THE PRE-SHARED KEY (AKA "wifi password")

Note that while it is true that these same issues exist on WiFi networks that do not have encryption turned on, the user does get a warning message from their operating system when connecting to one of those networks.

Location of vulnerability in dd-wrt

dd-wrt routers running hostapd were fixed in the wpa_supplicant and hostapd code in build 33525. non-hostapd dd-wrt routers are vulnerable in the driver itself (ie: Broadcom-based devices) A quick way to tell the difference is in dd-wrt click Administration, Commands and put in the command "ps" then click Run Commands, if the output as "nas" in it the router is a non-hostapd router

Extent of vulnerability

Some of the locations that are affected:

  • Inner city housing with residential homes close together. In many cities the average home can see dozens of SSID advertisements from neighbor's wifi routers.
  • Apartment buildings, multiplexes, duplexes and other shared housing situations
  • Multi-tenant commercial buildings
  • Coffee shops, airport waiting rooms, hotels
  • Hospitals and medical wifi networks

Examples of types of WiFi access points and routers potentially affected:

  • Any dd-wrt router running Brainslayer builds older than build 33525 (10/17/2017) or any obsolete builds (old Kong builds, Eko builds, and one-off builds such as the CrushedHat IPv6-in-4MB build as well as personal builds created by users from source before 10/17/2017. Some devices require older and specialty builds due to bugs in newer builds (ie: wl1 failing to work in the Linksys WRT 610N v1 in newer builds)
  • Any AP or router running any firmware released before 10/17/2017 that supports client bridging, or 802.11r AKA fast roaming, this includes ISP-supplied cable modems, DSL modems, etc.
  • Devices running OpenWRT released before the vulnerability announced
  • OpenWRT devices modified to support 802.11r this way[2]
  • Any other wireless AP that defaults to 802.11r turned on, such as cellular "hotspot" devices, cellular phones configured for tethering, vehicle cellular devices that provide WiFi for vehicle occupants, etc. (some of these devices have no reason to turn FT on but might have it on inadvertently)

The finder of the vulnerability has announced he is working on tools that will allow AP's and clients to be checked for the presence of the vulnerability.

Types of WiFi clients affected:

  • All cellular phones running Android or iOS or Windows Phone that have not been patched. As of 10/22/2017 neither Apple or Google has released patches.
  • Industrial scanning guns that use WiFi (handheld barcode scanners, etc.)
  • Mobile medical scanners and other medical systems that use WiFi networks
  • Unpatched operating systems that the users have disabled automatic patching
  • Obsolete operating systems (Windows XP, older MacOS X)

In theory it should be possible to design a virus that would hijack a user system and allow it to attack other systems on it's wifi network using this vulnerability.

Impact to DD-WRT

There are dozens if not hundreds of models of WiFi routers that will NEVER be patched by their manufacturers, either due to the manufacturer no longer existing, or the manufacturer refusing to release updates. For example the purchase of Linksys by Cisco then the selling of Linksys to Belkin created tens of orphaned models. There are MANY wifi vendors who refuse to devote programmer time to rebuild firmware for models that they have stopped selling. Some, such as Cisco, have formal End Of Life processes where the company unequivocally states that after EoL date, NO further firmware updates will be provided.

While it is probably a truism that the majority of residential users probably think a firmware file is a manila folder, there is a serious issue with businesses. Many businesses have a "patch or toss" approach and if a device is considered obsolete by it's manufacturer with no firmware forthcoming, the business has no choice but to retire the gear.

It may be that this will see increased use of dd-wrt in businesses. It may also be that there will be a flood of used WiFi gear that comes on to the market as a result of accelerated gear retirement. Certainly there will be increased interest in dd-wrt as a way of prolonging gear service life.

Mitigation steps other than patching clients and routers

Encrypting the data from the application to the server by the PC or phone operating system before transfer over the wifi network is one other way to protect against a KRACK attack. https, SSL IMAP and POP3, and VPN clients running in the client operating system are some examples of how this can be done.

Atheros-based dd-wrt routers can disable EAPOL Key Retries to block these attack as discussed here [3]

Disable any client access in dd-wrt. Because dd-wrt does not have 802.11r support (fast roaming) it's AP server code is not vulnerable so if it is configured only as an AP (repeater functionality turned off) the vulnerability is not exploitable against the AP. (it IS still exploitable against the client if the client isn't patched)

Kong announced on 10/18 "There will be an option in the webif in the next build, that allows to set an flag that will fix that issue even if the client does not have a patch, but it can cause interoperability issues and therefore is off by default." in this [4] thread. The option was set a day later here [5] into the build system.

Note that setting MAC Address filtering DOES NOT protect against this attack!!

dd-wrt device firmware not vulnerable

  • Any Brainslayer build after 10/17/2017 that uses wpa_supplicant
  • Any Kong build after 10/17/2017