ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    WPA2 Hacked

    IT Discussion
    9
    56
    4.6k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Mike DavisM
      Mike Davis
      last edited by

      I just read about it too, but it seems some vendors have patched their systems. I checked for Ubiquiti and that article says "One researcher told Ars that Aruba and Ubiquiti, which sell wireless access points to large corporations and government organizations, already have updates available to patch or mitigate the vulnerabilities."

      I can't seem to find a list of which Ubiquiti products have patches available. Can anyone find a link to that?

      1 Reply Last reply Reply Quote 1
      • DustinB3403D
        DustinB3403
        last edited by

        WPA2 and WPA2-Enterprise are equally compromised. So there is simply no remedy to this situation for now besides to remove WPA2 wireless configurations and replace them with another mechanism (RADIUS).

        Until a patch is released for your devices that is.

        1 Reply Last reply Reply Quote 1
        • DashrenderD
          Dashrender
          last edited by

          At least there's this

          One researcher told Ars that Aruba and Ubiquiti, which sell wireless access points to large corporations and government organizations, already have updates available to patch or mitigate the vulnerabilities.

          1 Reply Last reply Reply Quote 0
          • DustinB3403D
            DustinB3403
            last edited by

            Every encryption method that is tied to WPA2 is compromised as well, this just gets worse and worse.

            DashrenderD 1 Reply Last reply Reply Quote 0
            • DashrenderD
              Dashrender @DustinB3403
              last edited by

              @dustinb3403 said in WPA2 Hacked:

              Every encryption method that is tied to WPA2 is compromised as well, this just gets worse and worse.

              Considering it's a problem in the handshake, I guess I'm not surprised.

              1 Reply Last reply Reply Quote 0
              • DustinB3403D
                DustinB3403
                last edited by

                WPA-TKIP or GCMP are the most vulnerability encryption methods as they allow for additional information to be injected.

                1 Reply Last reply Reply Quote 0
                • DustinB3403D
                  DustinB3403
                  last edited by

                  "Note that our attacks do not recover the password of the Wi-Fi network. They also do not recover (any parts of) the fresh encryption key that is negotiated during the 4-way handshake."

                  So changing your wireless password does nothing here.

                  1 Reply Last reply Reply Quote 0
                  • DashrenderD
                    Dashrender
                    last edited by

                    Unifi page on latest firmware.

                    https://community.ubnt.com/t5/UniFi-Updates-Blog/FIRMWARE-3-9-3-7537-for-UAP-USW-has-been-released/ba-p/2099365

                    1 Reply Last reply Reply Quote 1
                    • Mike DavisM
                      Mike Davis
                      last edited by

                      I went in to my unifi controller under Settings -> Maintenance -> "Check Firmware Update" and it doesn't seem to be pulling down the new firmware. Should it?

                      DashrenderD 1 Reply Last reply Reply Quote 0
                      • DashrenderD
                        Dashrender @Mike Davis
                        last edited by

                        @mike-davis said in WPA2 Hacked:

                        I went in to my unifi controller under Settings -> Maintenance -> "Check Firmware Update" and it doesn't seem to be pulling down the new firmware. Should it?

                        There was a 3.9 that wasn't pulled in last week either. I'm not sure at what point the controller auto updates (or updates via the button push) the firmware.

                        In the past, I only got new firmware when updating the Unifi Controller software itself. The Firmware update button is kinda new (though I'm sure this is where JB will tell me it's been in there for years).

                        1 Reply Last reply Reply Quote 1
                        • JaredBuschJ
                          JaredBusch
                          last edited by

                          @dashrender said in WPA2 Hacked:

                          In the past, I only got new firmware when updating the Unifi Controller software itself. The Firmware update button is kinda new (though I'm sure this is where JB will tell me it's been in there for years).

                          It has been there since 5.0 was reelased

                          JaredBuschJ 1 Reply Last reply Reply Quote 0
                          • ObsolesceO
                            Obsolesce
                            last edited by

                            ...must be a Monday. News like this only comes on Mondays.

                            1 Reply Last reply Reply Quote 2
                            • JaredBuschJ
                              JaredBusch
                              last edited by

                              The handshake has always been the weak spot of WPA and WPA2. WPA had other issues, but was only even supposed to be a stopgap until WPA2 hardware was readily available.

                              You can easily negate this entire thing by using PEAP to prevent malicious actors from spoofing disconnect frames that make your devices reconnect and thus require a new 4 way handshake.

                              1 Reply Last reply Reply Quote 1
                              • JaredBuschJ
                                JaredBusch
                                last edited by

                                Also, while this is a serious flaw, it requires a malicious actor on site.

                                This is not anything that I am worried about at a business.

                                I will of course patch as soon as non-beta patches are available, but it is not some stupid OMG FUCKING PANIC situation.

                                1 Reply Last reply Reply Quote 1
                                • JaredBuschJ
                                  JaredBusch @JaredBusch
                                  last edited by

                                  @jaredbusch said in WPA2 Hacked:

                                  @dashrender said in WPA2 Hacked:

                                  In the past, I only got new firmware when updating the Unifi Controller software itself. The Firmware update button is kinda new (though I'm sure this is where JB will tell me it's been in there for years).

                                  It has been there since 5.0 was reelased

                                  Oh additionally, your UniFi instance will download updates on a schedule even without you pressing that button or updating the version.

                                  DustinB3403D 1 Reply Last reply Reply Quote 0
                                  • DustinB3403D
                                    DustinB3403 @JaredBusch
                                    last edited by

                                    @jaredbusch said in WPA2 Hacked:

                                    @jaredbusch said in WPA2 Hacked:

                                    @dashrender said in WPA2 Hacked:

                                    In the past, I only got new firmware when updating the Unifi Controller software itself. The Firmware update button is kinda new (though I'm sure this is where JB will tell me it's been in there for years).

                                    It has been there since 5.0 was reelased

                                    Oh additionally, your UniFi instance will download updates on a schedule even without you pressing that button or updating the version.

                                    Isn't this only enabled by the admin and not by default? (I'll have to double check my controller)

                                    JaredBuschJ 1 Reply Last reply Reply Quote 0
                                    • JaredBuschJ
                                      JaredBusch @DustinB3403
                                      last edited by

                                      @dustinb3403 said in WPA2 Hacked:

                                      @jaredbusch said in WPA2 Hacked:

                                      @jaredbusch said in WPA2 Hacked:

                                      @dashrender said in WPA2 Hacked:

                                      In the past, I only got new firmware when updating the Unifi Controller software itself. The Firmware update button is kinda new (though I'm sure this is where JB will tell me it's been in there for years).

                                      It has been there since 5.0 was reelased

                                      Oh additionally, your UniFi instance will download updates on a schedule even without you pressing that button or updating the version.

                                      Isn't this only enabled by the admin and not by default? (I'll have to double check my controller)

                                      There is no button for it to my knowledge, but I am almost certain I read that in the guide. My devices occasionally have firmware updates when I have not clicked the button, nor updated the controller itself.

                                      DashrenderD 1 Reply Last reply Reply Quote 1
                                      • DashrenderD
                                        Dashrender @JaredBusch
                                        last edited by

                                        @jaredbusch said in WPA2 Hacked:

                                        @dustinb3403 said in WPA2 Hacked:

                                        @jaredbusch said in WPA2 Hacked:

                                        @jaredbusch said in WPA2 Hacked:

                                        @dashrender said in WPA2 Hacked:

                                        In the past, I only got new firmware when updating the Unifi Controller software itself. The Firmware update button is kinda new (though I'm sure this is where JB will tell me it's been in there for years).

                                        It has been there since 5.0 was reelased

                                        Oh additionally, your UniFi instance will download updates on a schedule even without you pressing that button or updating the version.

                                        Isn't this only enabled by the admin and not by default? (I'll have to double check my controller)

                                        There is no button for it to my knowledge, but I am almost certain I read that in the guide. My devices occasionally have firmware updates when I have not clicked the button, nor updated the controller itself.

                                        Yeah, I think I've seen this once - but I wrote it off as - I updated the controller, and then got side tracked and didn't push out the firmware to the APs.

                                        1 Reply Last reply Reply Quote 0
                                        • gjacobseG
                                          gjacobse
                                          last edited by

                                          Just updated the UniFi Controller here at home,.. now running 5.5.24 and AP version 3.8.14.6780.. have to check the above link as well....

                                          JaredBuschJ 1 Reply Last reply Reply Quote 0
                                          • JaredBuschJ
                                            JaredBusch
                                            last edited by

                                            0_1508166535922_ddba928b-53a7-49b7-a39b-078bc1e7299c-image.png
                                            0_1508166506976_4f93984b-dc05-4494-9c42-15a6605bbb49-image.png

                                            DustinB3403D 1 Reply Last reply Reply Quote 2
                                            • 1
                                            • 2
                                            • 3
                                            • 1 / 3
                                            • First post
                                              Last post