Apple Says 'KRACK' Wi-Fi Vulnerabilities Are Already Patched in iOS, macOS, watchOS, and tvOS Betas

[Euroamerican]

I have to say, that I'm glad only my TV, computers, and phones are in need of possible patches... Oh, and my routers....

The thought of having to patch car's OSes or devices in those, cars, light bulbs, doorknobs, microwaves, curling irons.... NO THANKS.

 

[mpainesyd]

So far there is no sign of a relevant firmware update for Airport products like my Time Capsule and maybe there is no need for this.
BTW - You can check for updates through the Airport app in macOS (Applications/Utilities) . It automatically reports if a firmware update is available for connected Airport devices.

 

[Naaaaak]

Apple has known about this since Aug 28. How come a security update was not pushed on Friday?

I've noticed they seem to be behind the ball on a lot of security issues, taking a few days to patch things. Not as pro-active as they should be if privacy and security are such a focus.

 

[WannaGoMac]

I read that Apple routers will NOT need to be patched. The flaw doesnt apply to them...

 

[nutmac]

So far there is no sign of a relevant firmware update for Airport products like my Time Capsule and maybe there is no need for this.

I read that Apple routers will NOT need to be patched. The flaw doesnt apply to them...

There's a lot of misinformation about KRACK. According to WiFi router makers like Eero, that's not true:

All routers — including whole-home WiFi systems like eero — and client devices like your smartphone are potentially affected by KRACK. To exploit KRACK, someone would need to be physically in or very near your home.

My understanding from reading various articles is that if a router is patched, devices affected by KRACK vulnerability will be able to do secure 4-way handshake, thus not at risk for Man-in-the-Middle attack from nearby hackers.

So if you have older WiFi client devices that are always at home, getting your router patched is highly beneficial.

 

[seedylee]

This is why I keep my devices updated, its worth dealing with a few bugs.

Except new bugs can themselves be new software vulnerabilities. Every change and new feature represents a potentially new vulnerability.

 

[jamesrick80]

This is sort of messed up for people who didn't want to update to Buggy iOS 11. They either choose to be unsecure or go to a buggy OS for security.
[doublepost=1508217399][/doublepost]

Again one appreciates the iOS/macOS ecosystem with patches coming for units going back to iPhone 5S. Good luck to those on Android, patch for a majority of those devices will probably stay as vapourware till the end of time.

Samsung has KNOX for extra security layers...some of the best software even for wifi security. Highest level mobile device security software in the world. Options such as browsing only in the secure folder, creating Knox security VPNs, and Enterprise level firewalls secures these devices.

 

[haruhiko]

Given that Apple is only going to fix the vulnerability in 11.1, I can say they are not aware of this until recently. Otherwise they could have put it in 11.0 release.
[doublepost=1508219415][/doublepost]

So far there is no sign of a relevant firmware update for Airport products like my Time Capsule and maybe there is no need for this.
BTW - You can check for updates through the Airport app in macOS (Applications/Utilities) . It automatically reports if a firmware update is available for connected Airport devices.

As many have said, only clients not access points (routers) need the update.

 

[happyprozak]

The point is they can be used to gain access to the network, then a hacker could listen to all traffic on that network, not just the compromised device.

What can be picked up or stolen if someone is listening in on my network and all my internet traffic is through https sites?

 

[vmachiel]

I just do not see a real issue with the wifi/BT toggle - if you want to really switch off just turn on flight mode...

And lose cell signal, boy that's convenient.

 

[displayguy2]

Because these vulnerabilities affect all devices that use WPA2, this is a serious problem that device manufacturers need to address immediately. Apple is often quick to fix major security exploits, so it is not a surprise that the company has already addressed this particular issue.

When did you first notify vendors about the vulnerability?
We sent out notifications to vendors whose products we tested ourselves around 14 July 2017. After communicating with these vendors, we realized how widespread the weaknesses we discovered are (only then did I truly convince myself it was indeed a protocol weaknesses and not a set of implementation bugs). At that point, we decided to let CERT/CC help with the disclosure of the vulnerabilities. In turn, CERT/CC sent out a broad notification to vendors on 28 August 2017.

 

[DCIFRTHS]

True. It's very likely though a separate patch for this vulnerability will be released on several older macOS versions

I hope so because I can't install anything later than El Capitan on my MacBook Pro.

 

[displayguy2]

On iOS devices, there isn't a way to selectively delete previously connected and remembered multiple WiFi networks. Device need to be connected to that network for it to be deleted. One brute way is reset network settings, but this deletes every network ever saved including all your trusted networks.

 

[Roadstar]

As many have said, only clients not access points (routers) need the update.

Not exactly. To protect against all Krack attacks, both APs and clients need to be updated. However, especially for home users the priority is to update the clients.

Source? See the Q&A section at https://www.krackattacks.com/

In addition, if there are vulnerable devices that aren't getting updates in the network, having the AP patched should mitigate the risk at least to some degree as the flawed handshake shouldn't succeed when at least the other end is patched.

 

[displayguy2]

The even bigger mess is going to be smart devices. Your lightswitch? Fitness tracker? TV? Car? Good luck getting updates for those.

amen

 

[Xofer]

Ahead of the release of the update that addresses the vulnerabilities, customers who are concerned about attacks should avoid public Wi-Fi networks, use Ethernet where possible, and use a VPN.

Why would we avoid public wifi networks NOW? Public wifi networks are generally not encrypted at all and this vulnerability has not made them any less safe than they already are.

 

[mi7chy]

The two dominant operating systems, Windows and Linux, have already had patches released to consumers.

 

[Feenician]

This is sort of messed up for people who didn't want to update to Buggy iOS 11. They either choose to be unsecure or go to a buggy OS for security.
[doublepost=1508217399][/doublepost]

Samsung has KNOX for extra security layers...some of the best software even for wifi security. Highest level mobile device security software in the world. Options such as browsing only in the secure folder, creating Knox security VPNs, and Enterprise level firewalls secures these devices.

Neither VPNs or firewalls protect in any way from this exploit. Enjoy.

 

[haruhiko]

Not exactly. To protect against all Krack attacks, both APs and clients need to be updated. However, especially for home users the priority is to update the clients.

Source? See the Q&A section at https://www.krackattacks.com/

In addition, if there are vulnerable devices that aren't getting updates in the network, having the AP patched should mitigate the risk at least to some degree as the flawed handshake shouldn't succeed when at least the other end is patched.

Thanks! Hopefully Netgear will release a patch for my router (or better, already fixed).

 

[Roadstar]

Thanks! Hopefully Netgear will release a patch for my router (or better, already fixed).

I'm also waiting for Asus to provide patches for my router, I hope there will be some. For some strange reason I'm also finding the F-Secure Sense router more enticing than ever

 

[Ener Ji]

Given that Apple is only going to fix the vulnerability in 11.1, I can say they are not aware of this until recently. Otherwise they could have put it in 11.0 release.

Apple was notified just over three months ago.

Neither VPNs or firewalls protect in any way from this exploit. Enjoy.

It was my understanding that a VPN absolutely protects against this exploit, as all an attacker would see is encrypted VPN traffic, much like anyone trying to sniff a public WiFi hotspot where someone is using a VPN.

 

[Bacillus]

Support for 32-bit has ended. The newest 32-bit device was released in 2013. Sorry, but supporting devices that are over 4 years old just doesn't make sense.
Apple supports their devices FAR LONGER than the industry average. If you're concerned, it might be time to consider upgrading to something a bit newer.

You'll probably also nod your shoulders if a car company fails to make a steering or breaking function reliable. Whether that turns out on day 1 or after 10 years - it is just plain unacceptable and the car will be called back.
I don't see your reasoning as to why Apple shouldn't take measures across the line.
Because they don't have the budgets to support their legacy ? Well, they own continents by now and keep memorizing that legacy as long and as often as it suits them well.
Because this technology is so old that the engineers are pensioned by now ?
Well, 30 year old tech should have been documented and kept alive anyway - in particular if it still is part of their OS codebase.
Because it's too costly to send multi- gigabytes over the Internet ?
Well, Apple could have devised elegant small 10 K patches instead of sending multigig packages around for every single bug, function, new set of (poo)mojies.
Because it is just too much work ?
Well, this is bug so elementary that it is probably in the shared codebase where it could be patched in 1 fell swoop.
Because Eddy Cue is too busy contracting content providers ?
Well, I would keep him so - far from the crown jewels (remaining) and anything that has to do with reputation - anyway.
Patches should be done across the (former) product line where necessary.
This is not a subject for lamentation, appeasement or waning.
Let alone your irrelevant guesses about the "industry average" (that mediocrity Apple already compares itself too often now)

 

[jb-net]

What about the AirPort Extreme?
Apple needs to release a patch asap and not wait till iOS 11.1 which might non come for weeks.

 

[alex0002]

If Apple fixes this in iOS and MacOS, then your iOS and MacOS devices are safe. If you use an Android phone, or a Windows PC, then it may or may not be safe. In that case, _either_ your Android phone and Windows PC, _or_ your Airport Extreme needs an update.

Microsoft updates appear to be available for end users now (unless I'm reading this wrong and the new links are still not posted - edit: no I'm informed that KB4042895 is indeed the patch for Window 10).
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-13080

Refer to the document above for download links for Windows 7, 8, 10 and Windows Server releases. Both 32 bit and 64 bit versions of the update are provided.

The Debian linux wpa package update is available for the latest stable release and also the two previous stable releases.
https://www.debian.org/security/2017/dsa-3999

Right now my Macbook Pro is the only desktop/notebook device in my house without a patch available.

 

[IPadNParadise]

Tell that to someone who bought a new iPhone 5c just under two years ago? I get where you're coming from, but I think there is an obligation to patch such a serious vulnerability for a device that's been off the market for less than two years. I predict that Apple will come through with a patch for iOS 10.x.



I wouldn't panic just yet. The tech industry is still wrapping their heads around this issue. As devices receive patches, the focus will turn to devices that are not being patched, and in turn what we should do to minimize or mitigate risk from those unpatched devices. I actually predict that this is a serious enough issue to motivate manufacturers to patch a lot of smart devices released in recent years, but it may take a little while.

In the meantime, just update promptly when your Mac/iPad/iPhone offers you an update.

Thank you for responding