Apple Says 'KRACK' Wi-Fi Vulnerabilities Are Already Patched in iOS, macOS, watchOS, and tvOS Betas

[elvisimprsntr]

So is my 3rd gen Apple TV just left vulnerable? Apple was still selling those until pretty recently. I guess the Apple TV doesn't handle much "sensitive" information... but still!

Yes, unless you connect the LAN port.

Only your iTunes account credentials.

See my previous post for other mitigation steps.

https://forums.macrumors.com/thread...s-and-tvos-betas.2078236/page-4#post-25231262

 

[ackmondual]

This is entirely why I’ve always told people “even if you don’t give a damn another the new features, just update to the newest os as long as your device supports it”. But did anyone listen? No. They just sit back all stubborn until something terrible happens

For those that use their devices for business, it does them no good either if core business functionality gets compromised instead.

 

[MadeTheSwitch]

The computer industry as a whole needs to do a much better job at security. They need to get it right the first time. Not rely on endless patching. Why? Because there are products out there that might not ever be updated, that a manufacturer has already moved on from. Old TV sets, old phones and operating systems that cannot be upgraded, smoke detectors, door locks, light bulbs, refrigerators,...wifi is used in just about everything now.

Got to get this stuff right to begin with. Too important not to.

 

[lkrupp]

It's not likely someone is going to be using this exploit on your home WiFi, but a crowded airport to sniff out credit cards or passwords? Maybe more likely. Also, a lot of newer public networks use WPA2 and aren't completely open.

Anyone who uses public Wi-Fi while transmitting credit cards or passwords is asking ,no, begging for trouble. I stopped using public Wi-Fi some years ago in favor LTE exclusively. I don’t use any retail store’s “free” Wi-Fi. Just turn off Wi-Fi when you’re out in public and you’ll be fine.

 

[Avatarshark]

Is it possible that Apple already patched it 10.3.3? As there were quite a few patches to wifi and stuff and still within the 90 day window for security disclosures? Some of which aren’t disclosed in the patch notes?

 

[Dave-Z]

@elvisimprsntr,

And to add to those points, a properly configured VPN will help as well.

 

[lkrupp]

The computer industry as a whole needs to do a much better job at security. They need to get it right the first time. Not rely on endless patching. Why? Because there are products out there that might not ever be updated, that a manufacturer has already moved on from. Old TV sets, old phones and operating systems that cannot be upgraded, smoke detectors, door locks, light bulbs, refrigerators,...wifi is used in just about everything now.

Got to get this stuff right to begin with. Too important not to.

Yeah, well Wi-Fi has been around for over ten years now and this flaw has just now been discovered. There is literally NO WAY to “get this stuff right to begin with.” Like I have posted once before I worked for AT&T for 34 years in a telephone central office. Digital telephone switches began to be installed in the 1980s and thirty years later those switches are still being patched almost daily. Software development just doesn’t work the way you are expecting it too. There has never been a piece of software released that didn’t require updating or patching. And there never will be.

 

[Ghost31]

Yeah, all those 5c owners are stubbornly sitting back and refuse to update to iOS 11.

You missed the”if you’re device supports it”

 

[Tech198]

I guess Python scripts are easier to do.

Looks like obsolete routers with WPA2 are out of luck with updates. You may even say the "drive" are the exploits because that forces more people to buy newer stuff

 

[elvisimprsntr]

My biggest concern is WiFi POS terminals at retailers and restaurants. If businesses don't disable SSID broadcast, the initial attack vector exists, thus vulnerable and the hackers gets my CC details.

 

[FloatingBones]

What about for 32 bit devices ?

Use a VPN with your 32 bit devices.

 

[elvisimprsntr]

Looks like obsolete routers with WPA2 are out of luck with updates. You may even say the "drive" are the exploits because that forces more people to buy newer stuff

Forced ob$olence is what drive$ the economy.

 

[dumastudetto]

Is it possible that Apple already patched it 10.3.3? As there were quite a few patches to wifi and stuff and still within the 90 day window for security disclosures? Some of which aren’t disclosed in the patch notes?

No, it's only patched in the latest iOS, macOS and tvOS betas.

10.3.3 hold outs definitely will have to upgrade now, or face the very real risk of handing over control of your bank accounts, email accounts, and other sensitive data to hackers.

In a way I'm delighted it means nobody can choose to stay on iOS 10 anymore.
[doublepost=1508191365][/doublepost]

Here is what mitigation you can take until patches arrive or for devices which will likely never get a patch.
1. Use wired LAN connections where possible.
2. Use a random SSID and disable broadcast. The initial attack vector requires knowledge of the SSID to be cloned.
3. Unrelated to this specific vulnerability, never ever use public wifi.

Isn't it trivial to sniff out SSID's that aren't being broadcast?

 

[BlueBook]

Any word on when the current betas will be finalized for release to everyone?

 

[33man]

Use a VPN with your 32 bit devices.

They will sell external adapters / wifi adapter for 32bits old devices, only 99$ piece

 

[Rigby]

My biggest concern is WiFi POS terminals at retailers and restaurants. If businesses don't disable SSID broadcast, the initial attack vector exists, thus vulnerable and the hackers gets my CC details.

Disabling SSID broadcast doesn't do anything. It's trivially easy to sniff the SSID of any Wifi network as long as there is any traffic, SSID broadcast disabled or not.

POS traffic has its own encryption and doesn't rely on Wifi encryption, BTW. I don't think that's a big concern. This primarily affects enterprise and home networks.

 

[gnasher729]

I think I’m confused, is this about the clients (our devices...) or is this about the WiFi security itself? As in, does my AirPort Extreme need an update?

If Apple fixes this in iOS and MacOS, then your iOS and MacOS devices are safe. If you use an Android phone, or a Windows PC, then it may or may not be safe. In that case, _either_ your Android phone and Windows PC, _or_ your Airport Extreme needs an update.

 

[Feenician]

So if Apple fixed this already would it be fair to say it's Krack-a-lackin'?

 

[elvisimprsntr]

Isn't it trivial to sniff out SSID's that aren't being broadcast?

Adds another barrier for embedded devices which may never get patched.

 

[NewPilgrim]

Here is what mitigation you can take until patches arrive or for devices which will likely never get a patch.
1. Use wired LAN connections where possible.
2. Use a random SSID and disable broadcast. The initial attack vector requires knowledge of the SSID to be cloned.
3. Unrelated to this specific vulnerability, never ever use public wifi.

Would it be safe if I leave the “unpatched” devices turned on but without connecting them to my home WiFi (the WiFi is from my Airport Time Capsule) ?

 

[Tech198]

Here is what mitigation you can take until patches arrive or for devices which will likely never get a patch.
1. Use wired LAN connections where possible.
2. Use a random SSID and disable broadcast. The initial attack vector requires knowledge of the SSID to be cloned.
3. Unrelated to this specific vulnerability, never ever use public wifi.

In other words, makes things more difficult for the user, since the SSID will need to be typed in.. I guess when you have "Auto join enabled" there would be no reason to broadcast. since the host already has it in Network.

 

[wolfshades]

I almost forwarded this article to a friend as a good news story. Until I re-read the headline. It's patched in the *betas*? Well that's good, and I'm happy for the beta testers. Now tell me something about the non-beta folk: when we will have our macOS, IOS, tvOS and watchOS patched? Hmm?

And yeah, to echo just about every other comment in here: what about the devices that can't run the latest operating system? Will they get patches too?

 

[gnasher729]

According to Rene Ritchie it looks like the AirPort products are not affected: https://www.imore.com/krack-wpa2-wi-fi-exploit-already-fixed-ios-macos-tvos-watchos-betas

That's great news. Especially if you have two or more of them, with one acting as a repeater.

 

[dumastudetto]

Adds another barrier for embedded devices which may never get patched.

It is no barrier for anyone looking to exploit this. It takes seconds to find "hidden" SSID's. It is basically no slower than obtaining the broadcast SSID list.

I am very sure if anyone nearby is trying to exploit this, having your SSID set to not broadcast will do nothing to protect you. It may even make you a bigger target since someone going to trouble of trying to hide, most probably has something worth hiding the attacker might like to see. If I was the attacker, I think I'd probably start with the "hidden" SSID list.

 

[gnasher729]

The point is they can be used to gain access to the network, then a hacker could listen to all traffic on that network, not just the compromised device.

It doesn't work like that. The hacker can only listen to the traffic between two vulnerable devices.

If you have a vulnerable router, and two vulnerable phones A and B, and two safe phones C and D, then the hacker can listen to conversation between router and A or B, and between A and B directly. Any connection involving C and D is safe.
[doublepost=1508193431][/doublepost]

Thx. But would that imply that unpatcheable legacy devices cannot logon anymore on pached routers ?

No, they will work just fine and be safe as long as they are connected to a patched router. The problem happens when a hacker interrupts a logon that is half done, and the device try to continue from that half connected state. All the patched router needs to do is not allow this - when a logon is interrupted when it's half done, both sides have to start from scratch, and that is safe.