The content of the article
In the fall of 2017, the world learned about a new threat to the security of Wi-Fi networks. It affects absolutely all devices and software platforms. No matter how complicated and long the password may be, this will not help, because KRACK is a vulnerability of the WPA2 encryption key exchange protocol itself. In this article, we will understand the theory of a bug and try to test it in practice.
On October 16, 2017, information was disclosed about critical WPA2 problems that circumvent protection and, as a result, listen to Wi-Fi traffic transmitted between the access point and the computer.
The complex of vulnerabilities in WPA2, called KRACK (abbreviation for Key Reinstallation Attacks), was discovered by a joint group of researchers from various universities and companies.
Team leader Mati Vanhof said that he managed to find the problems that make up KRACK back in 2016, but he improved his attack for more than a year. The researcher reported vulnerabilities to some manufacturers and representatives of the US-CERT organization in July 2017, and in August shared information about problems with a wide range of vendors.
Equipment manufacturers hastened to release firmware patches that eliminate vulnerabilities, but, as always happens in such cases, there remains a huge number of non-updated devices.
The attack is based on the vulnerability of the four-element handshake WPA2. This handshake is performed when the client wants to connect to a secure Wi-Fi network. The process confirms that both parties (client and access point) have the correct credentials. At the same time, the handshake is used to negotiate a fresh encryption key, which will subsequently be used to protect traffic.
An attacker could launch a man in the middle attack and force network participants to reinstall encryption keys that protect WPA2 traffic. In addition, if the network is configured to use WPA-TKIP or GCMP, an attacker can not only listen on WPA2 traffic, but also inject packets into the victim’s data.
By exploiting this critical error, you can decrypt traffic, make HTTP injections, intercept TCP connections, and much more.
The use of HTTPS can protect against KRACK, but by no means always. The fact is that HTTPS itself cannot be called absolutely secure (for example, there are downgrade connection methods), although it will become an additional layer of encryption.
The method is universal and works against any unpatched devices connected to Wi-Fi. The main condition is that the attacker will have to be in the range of the attacked Wi-Fi network, that is, the attack cannot be carried out remotely.
Mati Vanhof demonstrates vulnerability
Vulnerabilities in KRACK
- CVE-2017-13077: Reinstallation of the pairwise encryption key (PTK-TK) in the 4-way handshake.
- CVE-2017-13078: Reinstallation of the group key (GTK) in the 4-way handshake.
- CVE-2017-13079: Reinstallation of the integrity group key (IGTK) in the 4-way handshake.
- CVE-2017-13080: Reinstallation of the group key (GTK) in the group key handshake.
- CVE-2017-13081: Reinstallation of the integrity group key (IGTK) in the group key handshake.
- CVE-2017-13082: Accepting a retransmitted Fast BSS Transition (FT) Reassociation Request and reinstalling the pairwise encryption key (PTK-TK) while processing it.
- CVE-2017-13084: Reinstallation of the STK key in the PeerKey handshake.
- CVE-2017-13086: reinstallation of the Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) key in the TDLS handshake.
- CVE-2017-13087: reinstallation of the group key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame.
- CVE-2017-13088: reinstallation of the integrity group key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame.
To demonstrate the vulnerability, we need equipment – at least one, or better, several USB Wi-Fi adapters compatible with Kali Linux. My choice fell on the TP-Link N150 Wireless High Gain USB Adapter (TL-WN722N), it has already been tested and is well compatible with my distribution. But you can use any other to your taste.
Why do we even need this “whistle” if the laptop has a Wi-Fi adapter? A separate device for wardriving is recommended not only because it has fewer pickups and it has a stronger antenna, but also for reasons of convenience. With the built-in Wi-Fi adapter, you can simultaneously access the Internet, and this is a pretty important opportunity.
In general, with TP-Link we will raise our fake (or, if you like, test) network and we will perform our experiment in it.
Raise Wi-Fi on Kali Linux
So, download Kali and go to the taskbar (upper right corner of the desktop), raise the Wi-Fi adapter (that is, turn it on) and connect to a pre-prepared network.
We have WPA2-Personal encryption key, and we’ll immediately agree to use a long and strong password. The network to which we will connect is called SKG2.
Install the Krack Attack Toolkit
First, we need to make sure that we have all the necessary dependencies for the Krack Attack toolkit in our system. Run the following command:
Continuation is available only to participants
Materials from the latest issues become available separately only two months after publication. To continue reading, you must become a member of the Xakep.ru community.
Join the Xakep.ru Community!
Membership in the community during the specified period will open you access to ALL Hacker materials, increase your personal cumulative discount and allow you to accumulate a professional Xakep Score!
I am already a member of Xakep.ru