PSA: Update your Wi-Fi Routers & Client OS

Looks like clients are the higher priority to patch, although routers can have some functionality (largely bridging modes) that will require patching. (My Mikrotik router already received a patch earlier this month, but then that's business-grade hardware.)

The nasty thing is that a lot of routers and IoT devices are horrendously badly supported and won't get updates.

 

Sadly, most home users don't remember how to log into their routers, much less upgrade the firmware and why.

 

And bad news for anyone using a Yubikey 4 with RSA generated PGP keys.

https://arstechnica.com/information-technology/2017/10/crypto-failure-cripples-millions-of-high-security-keys-750k-estonian-ids

PSA: Use ECC or another non-RSA method.

Posted via the PriusChat mobile app.

 

There are lots of cheap Android devices that probably won't get patched, including mobile broadband devices that are "the only ones certified to work with" certain firewalls and enterprise routers.

Glad I'm not at work today.

Posted via the PriusChat mobile app.

 

does this apply to comcast supplied wifi routers?

 

It really does not matter who supplies or makes the router. It's about the security protocol WPA2-Personal & WPA2-Enterprise that the router uses as security between itself and the connecting client. If you have or use WPA2-Personal or WPA2-Enterprise then it applies. I don't know of any modern router that this would not apply to.

 

thanks, how would i find this out, and how concerned should i be, if i do have it?

 

Patch all devices you can patch, regardless of type. It's the protocol that's broken.

This article says it best:

"Attacking routers is a means to an end for attackers. What they’re really after are your devices."

KrackAttacks: What you need to know – Safe and Savvy Blog by F-Secure


Posted via the PriusChat mobile app.

 

Many devices come with default as "WPA2-PSK/WPA-PSK" (or similar) as the authentication type and encryption method.

Patch whatever you use to connect to the WiFi router and the router itself.

Posted via the PriusChat mobile app.

 

thanks, but i would have no idea how do go about that. i suspect 75% of home users are in the same boat.

 

Yes, the warnings sound dire, but you guys are speaking another language.

(I sent a link to my son, he will likely grok.)

Flaw lets hackers read data over secure Wi-Fi - Technology & Science - CBC News

 

My son's saying for home user, barring hacker neighbours and drive-by, you should be ok. Also: "If you're doing anything through an https site, like banking etc you're safe". His words, not mine, lol. And that It's coffee shop wifi and the like you'd want to be careful about, till they sort something out.

 

Check below to see if your router has a patch. List will be updated.

These are the router makers that have patched KRACK WPA2 Wi-Fi flaws | Android Central

Posted via the PriusChat mobile app.

 

A good summary article, also being updated. Google to release wpa_supplicant patch in November 6 security patch update.

Everything you need to know about KRACK, the WPA2 vulnerability | Android Central

Posted via the PriusChat mobile app.

 

DLInk is not on their list of vulnerable routers?