SoylentNews is people
SoylentNews
from the encrypted-for-some-values-of-encryption dept.
Billions of devices—many of them already patched—are affected by a Wi-Fi vulnerability that allows nearby attackers to decrypt sensitive data sent over the air, researchers said on Wednesday at the RSA security conference.
[...]Eset researchers wrote in a research paper published on Wednesday. "The attack surface is greatly increased, since an adversary can decrypt data that was transmitted by a vulnerable access point to a specific client (which may or may not be vulnerable itself)."
[...]Kr00k exploits a weakness that occurs when wireless devices disassociate from a wireless access point. If either the end-user device or the access point is vulnerable, it will put any unsent data frames into a transmit buffer and then send them over the air. Rather than encrypt this data with the session key negotiated earlier and used during the normal connection, vulnerable devices use a key consisting of all zeros, a move that makes decryption trivial.
[...]Eset researchers determined that a variety of devices are vulnerable, including:
- Amazon Echo 2nd gen
- Amazon Kindle 8th gen
- Apple iPad mini 2
- Apple iPhone 6, 6S, 8, XR
- Apple MacBook Air Retina 13-inch 2018
- Google Nexus 5
- Google Nexus 6
- Google Nexus 6S
- Raspberry Pi 3
- Samsung Galaxy S4 GT-I9505
- Samsung Galaxy S8
- Xiaomi Redmi 3S
The researchers also found that the following wireless routers are vulnerable:
- Asus RT-N12
- Huawei B612S-25d
- Huawei EchoLife HG8245H
- Huawei E5577Cs-321
An Apple spokesman said the vulnerabilities were patched last October with details for macOS here and for iOS and iPadOS here.
[...]While the vulnerability is interesting and users should make sure their devices are patched quickly—if they aren't already—there are a few things that minimize the real-world threat posed.
[...]Despite the limited threat posed, readers should ensure their devices have received updates issued by the manufacturers. This advice is most important for users of vulnerable Wi-Fi routers, since routers are often hard to patch and because vulnerable routers leave communications open to interception even when client devices are unaffected or are already patched.
(Score: 0) by Anonymous Coward on Friday February 28 2020, @06:20PM (5 children)
Wow. I only have one of the devices on that list. I would have expected it to be higher. I guess deciding to skip the Pi3 and wait for to upgrade to a Pi4 was the right decision.
(Score: 4, Insightful) by takyon on Friday February 28 2020, @06:22PM (2 children)
Is that list exhaustive or just a list of the devices the researchers had on hand?
[SIG] 10/28/2017: Soylent Upgrade v14 [soylentnews.org]
(Score: 3, Informative) by NotSanguine on Friday February 28 2020, @06:44PM
Check the comment [soylentnews.org] I posted in the last iteration of this story. There's a link to the CVE with more details about affected software/firmware versions and configs.
HTHAL.
No, no, you're not thinking; you're just being logical. --Niels Bohr
(Score: 2) by janrinok on Saturday February 29 2020, @10:18AM
Definitely not exhaustive.
(Score: 2) by hendrikboom on Sunday March 01 2020, @08:19PM (1 child)
I dumped my Nexus 5 recently -- apparently just in time. I have been unable to upgrade it for years, and every day it reports on a failed upgrade attempt.
My new phone is also a bit old, but at least it doesn't complain about repeated failed upgrades. I hope it *is* doing security upgrades.
-- hendrik
(Score: 2) by Freeman on Monday March 02 2020, @05:46PM
Yeah, if you're hoping it is, and it's more than 2 years old. You're likely not getting those.
https://www.wired.com/story/android-phones-hide-missed-security-updates-from-you/ [wired.com]
You're not even very likely to be getting any anyway. Unless, you have a phone that is part of Android One. There's some enterprise recommendation thing as well, and those phones are likely to be updated more consistently. Unless I was reading old info and the Android One thing replaced it.
Joshua 1:9 "Be strong and of a good courage; be not afraid, neither be thou dismayed: for the Lord thy God is with thee"