Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

2/26/2020
10:15 AM
50%
50%

Kr00k Wi-Fi Vulnerability Affected a Billion Devices

Routers and devices with Broadcom and Cypress Wi-Fi chipsets could be forced to sometimes use encryption keys consisting of all zeroes. Now patched, the issue affected a billion devices, including those from Amazon, Apple, Google, and Samsung.

RSA Conference 2020 – San Francisco – A vulnerability in the way that two Wi-Fi chipsets handled network interruptions and encryption keys could have given attackers the ability to decrypt some of the network packets sent by more than a billion common wireless devices and routers — including those from Amazon, Apple, and Samsung, security firm ESET said at the RSA Conference on Wednesday.

Found in late 2018, the vulnerability — dubbed Kr00k and assigned CVE-2019-15126 — can force part of the wireless communication between devices to use all zeroes for the encryption key, allowing the attacker to eavesdrop on a limited amount of wireless data. The National Vulnerability Database assigned the vulnerability a base score of 3.1, which makes it low severity.

"If an attack is successful, several kilobytes of potentially sensitive information can be exposed," Miloš Čermák, the lead ESET researcher into the Kr00k vulnerability, said in a statement. "By repeatedly triggering disassociations, the attacker can capture a number of network packets with potentially sensitive data."

The vulnerability expands on research that ESET over the past 18 months on home Internet of Things devices. In October 2019, the company revealed that older Amazon Echoes and Kindles were vulnerable to the Key Reinstallation Attack, or KRACK — a 2-year-old issue that allows bad actors to perform a man-in-the-middle attack.

The latest attack affects far more devices — more than a billion, according to ESET, including older Amazon Echo devices and Kindles, Apple iPad mini 2, various older Apple iPhones, the Apple MacBook Air, and various Google Nexus smartphones. At least two models of the Samsung Galaxy are affected, as are Raspberry Pi 3 and the Xiaomi Redmi 3S.

In addition, Wi-Fi access points from Asus and Huawei are vulnerable as well, potentially leaving some device communication vulnerable if the hotspot base station remains vulnerable, ESET stated in its analysis of the issue.

"This greatly increases the attack surface, as an adversary can decrypt data that was transmitted by a vulnerable access point, which is often beyond your control, to your device, which doesn’t have to be vulnerable," Robert Lipovský, an ESET researcher working with the Kr00k vulnerability research team, said in a statement.

Related to the KRACK vulnerability discovered in 2017, the vulnerability affects both WPA2-Personal and WPA2-Enterprise protocols. ESET first reported the vulnerability to Amazon more than a year ago, and with further research, discovered in July 2019 that the Cypress Wi-Fi chipset was the source of the security issue. In August, the company confirmed that the widely used Broadcom Wi-Fi chipsets were vulnerable as well.

The attack abuses an implementation flaw in the chipsets. When a Wi-Fi connection is lost — either because the device moves to a different network or due to interference — the device is "disassociated" from the network. The problem for the affected chipsets is that disassociation causes the key to be zeroed out and then any buffered data will be sent using that key of all zeros. By repeated disassociating the device from the network, an attacker can capture several data frames.

"Kr00k manifests itself after Wi-Fi disassociations, which can happen naturally, for example due to a weak Wi-Fi signal, or may be manually triggered by an attacker," ESET's Čermák said.

For more than a year, ESET has worked with device makers to create a fix for the issue and patch devices. Most users should be safe, but they should check that their devices have the more recent software updates, the company said. Even though the source of the bug is in the Wi-Fi chipsets, their behavior can be modified through the firmware. Patches for all affected devices made by major manufacturers have been released, ESET stated.

"To protect yourself, as a user, make sure you have updated all your Wi-Fi capable devices, including phones, tablets, laptops, IoT smart devices, and Wi-Fi access points and routers, to the latest firmware version," Lipovský said.

The company urged device manufacturers that may not have patched their device to reach out to their chipset vendors for more information.

Related Content

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Wendy Nather on How to Make Security 'Democratization' a Reality."

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
New 'Nanodegree' Program Provides Hands-On Cybersecurity Training
Nicole Ferraro, Contributing Writer,  8/3/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15820
PUBLISHED: 2020-08-08
In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence.
CVE-2020-15821
PUBLISHED: 2020-08-08
In JetBrains YouTrack before 2020.2.6881, a user without permission is able to create an article draft.
CVE-2020-15823
PUBLISHED: 2020-08-08
JetBrains YouTrack before 2020.2.8873 is vulnerable to SSRF in the Workflow component.
CVE-2020-15824
PUBLISHED: 2020-08-08
In JetBrains Kotlin before 1.4.0, there is a script-cache privilege escalation vulnerability due to kotlin-main-kts cached scripts in the system temp directory, which is shared by all users by default.
CVE-2020-15825
PUBLISHED: 2020-08-08
In JetBrains TeamCity before 2020.1, users with the Modify Group permission can elevate other users' privileges.