Kr00k Bug in Broadcom, Cypress WiFi Chips Leaks Sensitive Info

guest · Feb 26, 2020

Kr00k Bug in Broadcom, Cypress WiFi Chips Leaks Sensitive Info
February 26, 2020
https://www.bleepingcomputer.com/ne...dcom-cypress-wifi-chips-leaks-sensitive-info/

A vulnerability in some popular WiFi chips present in client devices, routers, and access points, can be leveraged to partially decrypt user communication and expose data in wireless network packets.

The flaw received the name Kr00k and was identified in components from Broadcom and Cypress, which are integrated into mobile phones, tablets, laptops, IoT gadgets. By current conservative estimates, over one billion devices are affected.
All-zero session key
Researchers at security company ESET, who found the vulnerability, explain that exploitation leads to unpatched devices to "use an all-zero encryption key to encrypt part of the user’s communication."

Kr00k is now identified as CVE-2019-15126 and affects both WPA2-Personal and WPA2-Enterprise protocols using AES-CCMP encryption for data integrity and confidentiality, the researchers say.
It is related to KRACK (Key Reinstallation Attack), a flaw in the 4-way handshake of the WPA2 protocol [...]
Click to expand...

Exploitation potential
Exploiting the vulnerability is possible by inducing a disassociation state on the target device - a trivial thing to do via a deauthentication attack that requires the victim device MAC address and sending a management data frame that is processed as is: unauthenticated and unencrypted.

An adversary can intercept the data frames remnant in the transmit buffer and decrypt them, potentially capturing sensitive information.
Click to expand...

ESET: Kr00k - A serious vulnerability deep inside Wi-Fi encryption
Technical paper (PDF - 345 KB): https://www.welivesecurity.com/wp-content/uploads/2020/02/ESET_Kr00k.pdf

Kr00k – formally known as CVE-2019-15126 – is a vulnerability in Broadcom and Cypress Wi-Fi chips that allows unauthorized decryption of some WPA2-encrypted traffic.
Click to expand...

guest · Feb 26, 2020

ESET blogpost:
KrØØk: Serious vulnerability affected encryption of billion+ Wi‑Fi devices
February 26, 2020
https://www.welivesecurity.com/2020...ity-affected-encryption-billion-wifi-devices/

ESET Research has published its latest white paper, KrØØk – CVE-2019-15126: Serious vulnerability deep inside your Wi-Fi encryption. This blogpost summarizes that white paper, authored by researchers Miloš Čermák, Robert Lipovský and Štefan Svorenčík. For more information, readers can also refer to our dedicated webpage.

KrØØk affects devices with Wi-Fi chips by Broadcom and Cypress that haven’t yet been patched. These are the most common Wi-Fi chips used in contemporary Wi-Fi capable devices such as smartphones, tablets, laptops, and IoT gadgets.
Our tests confirmed that prior to patching, some client devices by Amazon (Echo, Kindle), Apple (iPhone, iPad, MacBook), Google (Nexus), Samsung (Galaxy), Raspberry (Pi 3), Xiaomi (RedMi), as well as some access points by Asus and Huawei, were vulnerable to KrØØk.
Click to expand...

The vulnerability affects both WPA2-Personal and WPA2-Enterprise protocols, with AES-CCMP encryption.
According to our information, patches for devices by major manufacturers have been released by now.

These findings were presented publicly for the first time at the RSA Conference 2020.
Click to expand...

guest · Feb 27, 2020

Cisco Working on Patches for New Kr00k WiFi Vulnerability
February 27, 2020
https://www.bleepingcomputer.com/ne...-on-patches-for-new-kr00k-wifi-vulnerability/

Cisco today announced that it is working to patch multiple products that are affected by the recently disclosed Kr00k vulnerability in WiFi chips from Broadcom and Cypress.
Kr00k affects at least 14 Cisco products
An attacker exploiting this security vulnerability does not need to know the Wireless Protected Access (WPA) or Wireless Protected Access 2 (WPA2) keys that secure the network.
The company warns that there is no workaround to mitigate the issue and a patch is the only reliable solution. The assessed severity level is medium.

In today's advisory, Cisco describes two methods that can be used to intercept the weakly-encrypted WiFi frames:
Triggering the disassociation event by injecting malicious packets into the wireless network and capturing the frames sent after the event.
Passively listening to traffic from the wireless network and capturing the frames sent after a disassociation event.
Click to expand...

guest · Mar 20, 2020

Proof of Concept Released for kr00k Wi-Fi Vulnerability
March 20, 2020
https://www.darkreading.com/attacks...-for-kr00k-wi-fi-vulnerability/d/d-id/1337371

Researchers at HexWay have demonstrated a proof-of-concept (PoC) exploit of kr00k, a significant Wi-Fi vulnerability first described by Eset researchers in February. The vulnerability forces a device to use an encryption key of all zeroes under certain circumstances. The PoC shows that the circumstances are not difficult to achieve.

In the PoC, a python script called r00kie-kr00kie is used to force a device to disassociate from the network; any data packets left in the device's Wi-Fi chip are encrypted with all zeros and can then be flushed and read. The action can be conducted repeatedly, potentially gathering large amounts of unencrypted data from the victim.
kr00k was estimated to have had an impact on well over 1 billion devices, including some from Apple, Amazon, Google, Raspberry Pi, Samsung, and Xiaomi.
Click to expand...

guest · Aug 6, 2020

KrØØk attack variants impact Qualcomm, MediaTek Wi-Fi chips
August 6, 2020
https://www.bleepingcomputer.com/ne...ariants-impact-qualcomm-mediatek-wi-fi-chips/

Qualcomm and MediaTek Wi-Fi chips were found to have been impacted by new variants of the KrØØk information disclosure vulnerability discovered by ESET researchers Robert Lipovský and Štefan Svorenčík.

KrØØk, a security flaw disclosed by ESET in February 2020 and tracked as CVE-2019-15126, can be used by attackers to decrypt some WPA2-encrypted wireless network packets transmitted by vulnerable devices after successful exploitation by forcing them to use all-zero encryption keys to encrypt part of the exchanged traffic.
Click to expand...

Qualcomm and MediaTek Wi-Fi-enabled devices also vulnerable
Even though initially ESET said that only devices with Broadcom and Cypress Wi-Fi chips were affected, Lipovský and Svorenčík discovered new KrØØk variants that have also impacted systems Qualcomm and MediaTek radios used in vehicles, navigation systems, watches, laptops, smartphones, routers, and other devices.

"One of the chips we looked at aside from those from Broadcom and Cypress was by Qualcomm," the researchers explain in a report published today and shared with BleepingComputer earlier this week.
Click to expand...

New KrØØk variants already fixed
Qualcomm released a fix for the proprietary driver affected by the newly discovered KrØØk attack in July, and MediaTek fixed the flaw during March and April 2020.
These new findings greatly increase the number of vulnerable devices to KrØØk attacks and their variants if left unpatched.

Lipovský and Svorenčík have released a proof-of-concept testing script for triggering and detecting the KrØØk vulnerability on unpatched devices.
Click to expand...

ESET: Beyond KrØØk: Even more Wi‑Fi chips vulnerable to eavesdropping

At Black Hat USA 2020, ESET researchers delved into details about the KrØØk vulnerability in Wi-Fi chips and revealed that similar bugs affect more chip brands than previously thought
Click to expand...

Bill Tadevich · Aug 8, 2020

mood said: ↑

KrØØk attack variants impact Qualcomm, MediaTek Wi-Fi chips
August 6, 2020
https://www.bleepingcomputer.com/ne...ariants-impact-qualcomm-mediatek-wi-fi-chips/

ESET: Beyond KrØØk: Even more Wi‑Fi chips vulnerable to eavesdropping
Click to expand...

Is there a way to identify what OEMs are using the Qualcomm, MediaTek chips, so that we can ensure we are patching all Access Points?

Log in or Sign up

Kr00k Bug in Broadcom, Cypress WiFi Chips Leaks Sensitive Info

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Bill Tadevich Registered Member

Log in or Sign up

Kr00k Bug in Broadcom, Cypress WiFi Chips Leaks Sensitive Info

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Bill Tadevich Registered Member

Useful Searches