Is VirginMedia Hub 3.0 vulnerable for KRACK attack?

ck0

Hi,

I am referring to the recently announced KRACK attack which exploits WPA2 protocol. https://www.krackattacks.com/

In short: it allows to intercept comms between router and client (MITM attack) without using password for Access Point. I feel it quite risky nowadays because WPA2 became defacto industry standard and is used in most homes/organizations.

If I understood correctly it wasn't clearly confirmed by a security researcher that Access Points are exploitable, client-side was targeted when they discovered vulnerability, however in the mean time they are saying they informed AP/routers vendors to address this problem to them.

Can VirginMedia comment on this?

@other_professionals: your thoughts?

Yggr of Asgard

I asked Virgin here: http://www.boards.ie/ttfthread/2057798183

ED E

COMPAL will likely have to fix this due to the pressure, that'll then be branded and pushed out by VM.

The EPCs might get fixed as Cisco are a serious operation. Older Thompsons? Who knows. Ubee? No idea.

Yggr of Asgard

COMPAL is a proud member of the Wifi Standards Org so I would assume they already are working on it, but the researchers point out, that clients are the problem and very limited access points have the issue.

Let's see what yarn VM is going to spin tomorrow about it, in the meantime, check your client because that seams to be the more important part at this point.

ED E

Im september patch level, not november, so I'll need to wait for the ROM developers to push a new build.

Yggr of Asgard

Lucky you if you have a reliable vendor, I'm afraid my otherwise excellent Vodafone Smart Platinum 7 is not going to get an upgrade (as they are way behind and I think have abandon their TCL partnership).

As to VM there are now a couple of posts in the VM forum, so let's see what they come up with.

Cuddlesworth

Router to client is only vulnerable when 802.11r or a mesh network is in use. Pretty sure most home routers are not using 802.11r. Client to router requires a patch on the host OS.

The direction in which packets can be decrypted (and possibly forged) depends on the handshake being attacked. Simplified, when attacking the 4-way handshake, we can decrypt (and forge) packets sent by the client. When attacking the Fast BSS Transition (FT) handshake, we can decrypt (and forge) packets sent towards the client. Finally, most of our attacks also allow the replay of unicast, broadcast, and multicast frames. For further details, see Section 6 of our research paper.