Google this week finally addressed the KRACK vulnerability in Android, three weeks after the WPA2 protocol flaw was publicly disclosed.
The KRACK patches are the most high-profile fixes in the November Android Security Bulletin, which includes three patches levels; the KRACK patches are in the Nov. 6 patch level, Google said.
A separate Google Pixel and Nexus security bulletin was also released, but it does not contain patches for KRACK.
KRACK is short for key-reinstallation attacks and can be exploited by an attacker within range of a victim’s Wi-Fi network to read encrypted traffic.
The vulnerability surfaces in the four-way handshake carried out when clients join WPA2-protected networks. A pre-shared network password is exchanged during this handshake, authenticating the client and access point. It’s also where a fresh encryption key is negotiated that will be used to secure subsequent traffic.
It is at this step where the key reinstallation attack takes place; an attacker on the network is able to intercede and replay cryptographic handshake messages, bypassing a mandate where keys should be used only once. The weakness occurs when messages during the handshake are lost or dropped—a fairly common occurrence—and the access point retransmits the third part of the handshake (re-using a nonce), theoretically multiple times.
An attacker sniffing the traffic could replay it offline and piece together enough information to steal secrets.
Google shared the updates with its Android partners and OEMs last month and said source code patches should be available in the Android Open Source Project repository some time today.
Source: https://threatpost.com/google-patches-krack-vulnerability-in-android/128818/
Submitted by: Arnfried Walbrecht
Comments are closed.