Router manufacturers such as AVM or Netgear, the community of the open source router firmware OpenWRT, the modder community behind Lineage OS and a number of large software companies have taken a stance on # KrackAttacks . Who delivers patches against the WPA2 vulnerability and is it really bad if they fail to appear?
A large part of the WPA2-protected WLANs can be cracked and data transmitted over them can even be manipulated in the case of Android 6.0 or newer. This emerges from the paper by the Belgian security researcher Mathy Vanhoef .
Most of the attacks are of theoretical interest and there is no need to panic, as Carsten Dobschat of the Mobilegeeks aptly analyzes. KRACK is used little or not at all in the wild. Nevertheless, all affected devices must be updated if you want to maintain the trust of your users and customers and keep the promise of guarantee. We also deserve an open and honest handling of such a vulnerability.
Microsoft delivered a Windows patch on October 10, Apple will bring it in a few weeks. This writes Cnet , which is currently producing a complete list of all manufacturers with a KRACK patch. The bug was quickly fixed in Linux too. The modders behind the Android variant Lineage OS proudly announce that they were faster than Google. Users of that mod are on the safe side from the next update. The remaining Android users will probably be able to close the gaps in question with the update at the security patch level in November 2017.LineageOS@LineageAndroid
All official 14.1 builds built after this tweet have been patched for KRACK.991Twitter Ads Info und Datenschutz470 Nutzer sprechen darüber
The Reddit community brings light into the dark, links important sources and gathers the devices and manufacturers in a large table in which already available patches can be recognized at a glance. Germany’s most important router manufacturer AVM warns and explains that the affected 802.11r standard is not used at all in Fritzboxes in access point mode (as in normal operation). Repeaters, on the other hand, will receive a patch soon. Thereupon Reddit members complain that 11r is only one of many attack vectors and AVM must not overlook the others.
But even if AVM would patch the routers, which according to its previously exemplary update policy is likely to happen very soon anyway, the still unpatched Android smartphones stand in the way of complete protection. In the case of Android devices, the situation is particularly annoying because attackers can manipulate the data connection with them. The computer philes on YouTube explain how this works:
However, this does not change the fact that KRACK and its exploitation are of theoretical interest. You do not necessarily have to do without online banking because this is done via an additionally encrypted connection anyway. You don’t have to change your WiFi password either, since KRACK circumvents it anyway. And you don’t have to switch off all WLANs or switch from WPA2 to WEP, since there is probably no hacker in your area. Nevertheless, you should update your devices if this is possible.Opinion by Eric Ferrari-HerrmannKRACK is a good way for manufacturers to present themselves as reliable.Do you agree?5050195 participants
And KRACK is a good opportunity to see which manufacturers are delivering such updates in a timely manner. The large software companies and the open source community are exemplary here. The Freifunk community, for example, which would most likely be a target with its OpenWRT devices and its technically savvy users, has already patched; the same goes for the LineageOS modders. AVM, Telekom and Netgear deliver router updates promptly. The target area for potential users of the gap very quickly becomes very small and therefore uninteresting – if it weren’t for the cursed Android updates that still arrive with too few users.