WPA2 Hacked
-
"Note that our attacks do not recover the password of the Wi-Fi network. They also do not recover (any parts of) the fresh encryption key that is negotiated during the 4-way handshake."
So changing your wireless password does nothing here.
-
Unifi page on latest firmware.
-
I went in to my unifi controller under Settings -> Maintenance -> "Check Firmware Update" and it doesn't seem to be pulling down the new firmware. Should it?
-
@mike-davis said in WPA2 Hacked:
I went in to my unifi controller under Settings -> Maintenance -> "Check Firmware Update" and it doesn't seem to be pulling down the new firmware. Should it?
There was a 3.9 that wasn't pulled in last week either. I'm not sure at what point the controller auto updates (or updates via the button push) the firmware.
In the past, I only got new firmware when updating the Unifi Controller software itself. The Firmware update button is kinda new (though I'm sure this is where JB will tell me it's been in there for years).
-
@dashrender said in WPA2 Hacked:
In the past, I only got new firmware when updating the Unifi Controller software itself. The Firmware update button is kinda new (though I'm sure this is where JB will tell me it's been in there for years).
It has been there since 5.0 was reelased
-
...must be a Monday. News like this only comes on Mondays.
-
The handshake has always been the weak spot of WPA and WPA2. WPA had other issues, but was only even supposed to be a stopgap until WPA2 hardware was readily available.
You can easily negate this entire thing by using PEAP to prevent malicious actors from spoofing disconnect frames that make your devices reconnect and thus require a new 4 way handshake.
-
Also, while this is a serious flaw, it requires a malicious actor on site.
This is not anything that I am worried about at a business.
I will of course patch as soon as non-beta patches are available, but it is not some stupid OMG FUCKING PANIC situation.
-
@jaredbusch said in WPA2 Hacked:
@dashrender said in WPA2 Hacked:
In the past, I only got new firmware when updating the Unifi Controller software itself. The Firmware update button is kinda new (though I'm sure this is where JB will tell me it's been in there for years).
It has been there since 5.0 was reelased
Oh additionally, your UniFi instance will download updates on a schedule even without you pressing that button or updating the version.
-
@jaredbusch said in WPA2 Hacked:
@jaredbusch said in WPA2 Hacked:
@dashrender said in WPA2 Hacked:
In the past, I only got new firmware when updating the Unifi Controller software itself. The Firmware update button is kinda new (though I'm sure this is where JB will tell me it's been in there for years).
It has been there since 5.0 was reelased
Oh additionally, your UniFi instance will download updates on a schedule even without you pressing that button or updating the version.
Isn't this only enabled by the admin and not by default? (I'll have to double check my controller)
-
@dustinb3403 said in WPA2 Hacked:
@jaredbusch said in WPA2 Hacked:
@jaredbusch said in WPA2 Hacked:
@dashrender said in WPA2 Hacked:
In the past, I only got new firmware when updating the Unifi Controller software itself. The Firmware update button is kinda new (though I'm sure this is where JB will tell me it's been in there for years).
It has been there since 5.0 was reelased
Oh additionally, your UniFi instance will download updates on a schedule even without you pressing that button or updating the version.
Isn't this only enabled by the admin and not by default? (I'll have to double check my controller)
There is no button for it to my knowledge, but I am almost certain I read that in the guide. My devices occasionally have firmware updates when I have not clicked the button, nor updated the controller itself.
-
@jaredbusch said in WPA2 Hacked:
@dustinb3403 said in WPA2 Hacked:
@jaredbusch said in WPA2 Hacked:
@jaredbusch said in WPA2 Hacked:
@dashrender said in WPA2 Hacked:
In the past, I only got new firmware when updating the Unifi Controller software itself. The Firmware update button is kinda new (though I'm sure this is where JB will tell me it's been in there for years).
It has been there since 5.0 was reelased
Oh additionally, your UniFi instance will download updates on a schedule even without you pressing that button or updating the version.
Isn't this only enabled by the admin and not by default? (I'll have to double check my controller)
There is no button for it to my knowledge, but I am almost certain I read that in the guide. My devices occasionally have firmware updates when I have not clicked the button, nor updated the controller itself.
Yeah, I think I've seen this once - but I wrote it off as - I updated the controller, and then got side tracked and didn't push out the firmware to the APs.
-
Just updated the UniFi Controller here at home,.. now running 5.5.24 and AP version 3.8.14.6780.. have to check the above link as well....
-
-
-
-
@dustinb3403 said in WPA2 Hacked:
@jaredbusch said in WPA2 Hacked:
Can you post direct links for that?
Thread in quesiton: https://community.ubnt.com/t5/UniFi-Wireless/FIRMWARE-3-9-3-7537-for-UAP-USW-has-been-released/td-p/2099370
I am jsut picking out the news from the noise.
-
@gjacobse said in WPA2 Hacked:
Just updated the UniFi Controller here at home,.. now running 5.5.24 and AP version 3.8.14.6780.. have to check the above link as well....
5.5.24 was released like two weeks ago slacker.
-
@jaredbusch said in WPA2 Hacked:
@gjacobse said in WPA2 Hacked:
Just updated the UniFi Controller here at home,.. now running 5.5.24 and AP version 3.8.14.6780.. have to check the above link as well....
5.5.24 was released like two weeks ago slacker.
Your point being? It's not something I have on my daily agenda to check on. and since it's my home setup,.. and it was working fine,.. there wasn't any business critical need.
-
@gjacobse said in WPA2 Hacked:
@jaredbusch said in WPA2 Hacked:
@gjacobse said in WPA2 Hacked:
Just updated the UniFi Controller here at home,.. now running 5.5.24 and AP version 3.8.14.6780.. have to check the above link as well....
5.5.24 was released like two weeks ago slacker.
Your point being? It's not something I have on my daily agenda to check on. and since it's my home setup,.. and it was working fine,.. there wasn't any business critical need.
Excuses excuses
