- WLUG - wlug.mailman3.com

Re: [Wlug] Major WPA2 Vulnerability
by Theo Van Dinter Oct. 16, 2017

Oct. 16, 2017

fwiw, my understanding is that the vulnerability is on the client side. therefore, I'm not sure what patches would get applied to an access point, though presumably if you use bridging (and maybe extension?) functionality then maybe there's an issue there. iow, I think patching access points isn't necessary or at least is a low priority if you're not using a feature that turns the device into a client. """ What if there are no security updates for my router? Our main attack is against the 4-way handshake, and does not exploit access points, but instead targets clients. So it might be that your router does not require security updates. We strongly advise you to contact your vendor for more details. In general though, you can try to mitigate attacks against routers and access points by disabling client functionality (which is for example used in repeater modes) and disabling 802.11r (fast roaming). For ordinary home users, your priority should be updating clients such as laptops and smartphones. """ On Mon, Oct 16, 2017 at 3:21 PM, Michael C Voorhis <mvoorhis(a)cs.wpi.edu> wrote: > Chuck Anderson writes: > > Because none of Fedora's updates aren't actually released yet. They > > are built and undergoing pushing/testing now, but being a public > > distro, anyone can get them if they know where to look: > > Ubuntu released a bunch of WPA-related patches a little after noontime > today, it appears. > > John Stoffel: > > I'm using DD-WRT on my APs at home, but god do the web pages and > > forums suck for actually figuring out what version to run and > > whether it's patched or not. Sigh... > > Ditto for OpenWRT, it appears the project is still alive, but you'd > never know, looking at their website. I may switch to LEDE, which > confusingly appears to be a fork of OpenWRT which is trying to merge > back with OpenWRT....? > > --MCV. > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

1 0

Re: [Wlug] Major WPA2 Vulnerability
by thinkbrown＠gmail.com Oct. 16, 2017

Oct. 16, 2017

wpa_supplicant got an update pushed to the Arch repos at around 11AM too (if anybody else here uses Arch) On Oct 16, 2017 15:23, "Michael C Voorhis" <mvoorhis(a)cs.wpi.edu> wrote: Chuck Anderson writes: > Because none of Fedora's updates aren't actually released yet. They > are built and undergoing pushing/testing now, but being a public > distro, anyone can get them if they know where to look: Ubuntu released a bunch of WPA-related patches a little after noontime today, it appears. John Stoffel: > I'm using DD-WRT on my APs at home, but god do the web pages and > forums suck for actually figuring out what version to run and > whether it's patched or not. Sigh... Ditto for OpenWRT, it appears the project is still alive, but you'd never know, looking at their website. I may switch to LEDE, which confusingly appears to be a fork of OpenWRT which is trying to merge back with OpenWRT....? --MCV. _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

1 0

Re: [Wlug] Major WPA2 Vulnerability
by Chuck Anderson Oct. 16, 2017

Oct. 16, 2017

On Mon, Oct 16, 2017 at 03:21:29PM -0400, Michael C Voorhis wrote: > Chuck Anderson writes: > > Because none of Fedora's updates aren't actually released yet. They > > are built and undergoing pushing/testing now, but being a public > > distro, anyone can get them if they know where to look: > > Ubuntu released a bunch of WPA-related patches a little after noontime > today, it appears. > > John Stoffel: > > I'm using DD-WRT on my APs at home, but god do the web pages and > > forums suck for actually figuring out what version to run and > > whether it's patched or not. Sigh... > > Ditto for OpenWRT, it appears the project is still alive, but you'd > never know, looking at their website. I may switch to LEDE, which > confusingly appears to be a fork of OpenWRT which is trying to merge > back with OpenWRT....? LEDE does a bunch of faster-paced development with the goal of having their work eventually merged back into OpenWRT. They often experiment with different ideas/features.

1 0

Re: [Wlug] Major WPA2 Vulnerability
by Michael C Voorhis Oct. 16, 2017

Oct. 16, 2017

Chuck Anderson writes: > Because none of Fedora's updates aren't actually released yet. They > are built and undergoing pushing/testing now, but being a public > distro, anyone can get them if they know where to look: Ubuntu released a bunch of WPA-related patches a little after noontime today, it appears. John Stoffel: > I'm using DD-WRT on my APs at home, but god do the web pages and > forums suck for actually figuring out what version to run and > whether it's patched or not. Sigh... Ditto for OpenWRT, it appears the project is still alive, but you'd never know, looking at their website. I may switch to LEDE, which confusingly appears to be a fork of OpenWRT which is trying to merge back with OpenWRT....? --MCV.

1 0

Re: [Wlug] Major WPA2 Vulnerability
by Krichevsky, Nicholas Jacob Oct. 16, 2017

Oct. 16, 2017

Looks like they were just pushed to stable about 30 minutes ago. I don't have the update yet but I'm sure it's a matter of time. https://bodhi.fedoraproject.org/updates/FEDORA-2017-60bfb576b7 Get Outlook for Android<https://aka.ms/ghei36> ________________________________ From: wlug-bounces(a)mail.wlug.org <wlug-bounces(a)mail.wlug.org> on behalf of Chuck Anderson <cra(a)WPI.EDU> Sent: Monday, October 16, 2017 2:11:05 PM To: wlug(a)mail.wlug.org Subject: Re: [Wlug] Major WPA2 Vulnerability Because none of Fedora's updates aren't actually released yet. They are built and undergoing pushing/testing now, but being a public distro, anyone can get them if they know where to look: https://bugzilla.redhat.com/buglist.cgi?quicksearch=krack&list_id=7995606 https://bodhi.fedoraproject.org/updates/?packages=wpa_supplicant https://bodhi.fedoraproject.org/updates/FEDORA-2017-60bfb576b7 https://bodhi.fedoraproject.org/updates/FEDORA-2017-12e76e8364 https://koji.fedoraproject.org/koji/packageinfo?packageID=717 On Mon, Oct 16, 2017 at 12:06:34PM -0400, Eric Martin wrote: > Here's a comprehensive write up with the latest fixes, and it's getting > updated regularly: > > https://www.bleepingcomputer.com/news/security/list-of-firmware-and-driver-… > > I'm not sure how Fedora can have an update and also not have released any > info... > > On Mon, Oct 16, 2017 at 9:42 AM, Tim Keller <turbofx(a)gmail.com> wrote: > > > Hey Gang, > > > > If you haven't heard already, it appears someone has found a major flaw in > > WPA2! > > > > https://www.krackattacks.com/ > > > > Hopefully patches should be forth coming! > > > > Later, > > Tim. _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

1 0

Re: [Wlug] Major WPA2 Vulnerability
by Chuck Anderson Oct. 16, 2017

Oct. 16, 2017

Because none of Fedora's updates aren't actually released yet. They are built and undergoing pushing/testing now, but being a public distro, anyone can get them if they know where to look: https://bugzilla.redhat.com/buglist.cgi?quicksearch=krack&list_id=7995606 https://bodhi.fedoraproject.org/updates/?packages=wpa_supplicant https://bodhi.fedoraproject.org/updates/FEDORA-2017-60bfb576b7 https://bodhi.fedoraproject.org/updates/FEDORA-2017-12e76e8364 https://koji.fedoraproject.org/koji/packageinfo?packageID=717 On Mon, Oct 16, 2017 at 12:06:34PM -0400, Eric Martin wrote: > Here's a comprehensive write up with the latest fixes, and it's getting > updated regularly: > > https://www.bleepingcomputer.com/news/security/list-of-firmware-and-driver-… > > I'm not sure how Fedora can have an update and also not have released any > info... > > On Mon, Oct 16, 2017 at 9:42 AM, Tim Keller <turbofx(a)gmail.com> wrote: > > > Hey Gang, > > > > If you haven't heard already, it appears someone has found a major flaw in > > WPA2! > > > > https://www.krackattacks.com/ > > > > Hopefully patches should be forth coming! > > > > Later, > > Tim.

1 0

Re: [Wlug] Major WPA2 Vulnerability
by John Stoffel Oct. 16, 2017

Oct. 16, 2017

>>>>> "Eric" == Eric Martin <eric.joshua.martin(a)gmail.com> writes: Eric> Aruba posted a really good write up as well as patches, and I just updated iOS Eric> on my phone though I haven’t seen the typical security email from Apple. Don’t Eric> forget, upgrade the client side as well! I'm using DD-WRT on my APs at home, but god do the web pages and forums suck for actually figuring out what version to run and whether it's patched or not. Sigh...

1 0

Re: [Wlug] Major WPA2 Vulnerability
by Eric Martin Oct. 16, 2017

Oct. 16, 2017

Here's a comprehensive write up with the latest fixes, and it's getting updated regularly: https://www.bleepingcomputer.com/news/security/list-of-firmware-and-driver-… I'm not sure how Fedora can have an update and also not have released any info... On Mon, Oct 16, 2017 at 9:42 AM, Tim Keller <turbofx(a)gmail.com> wrote: > Hey Gang, > > If you haven't heard already, it appears someone has found a major flaw in > WPA2! > > https://www.krackattacks.com/ > > Hopefully patches should be forth coming! > > Later, > Tim. > > > -- > I am leery of the allegiances of any politician who refers to their > constituents as "consumers". > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > > -- Eric Martin

1 0

Re: [Wlug] Major WPA2 Vulnerability
by Eric Martin Oct. 16, 2017

Oct. 16, 2017

Aruba posted a really good write up as well as patches, and I just updated iOS on my phone though I haven’t seen the typical security email from Apple. Don’t forget, upgrade the client side as well! Thank you, -- Eric > On Oct 16, 2017, at 9:42 AM, Tim Keller <turbofx(a)gmail.com> wrote: > > Hey Gang, > > If you haven't heard already, it appears someone has found a major flaw in WPA2! > > https://www.krackattacks.com/ > > Hopefully patches should be forth coming! > > Later, > Tim. > > > -- > I am leery of the allegiances of any politician who refers to their constituents as "consumers". > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug

1 0

Major WPA2 Vulnerability
by Tim Keller Oct. 16, 2017

Oct. 16, 2017

Hey Gang, If you haven't heard already, it appears someone has found a major flaw in WPA2! https://www.krackattacks.com/ Hopefully patches should be forth coming! Later, Tim. -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

1 0