41

There is a new vulnerability in WPA2 called KRACK (short for Key Reinstallation Attack), as described in The Guardian article: 'All WiFi networks' are vulnerable to hacking, security expert discovers'

According to the article:

The vulnerability affects a number of operating systems and devices, the report said, including Android, Linux, Apple, Windows, OpenBSD, MediaTek, Linksys and others.

Have there been any security releases for iOS fixing this?

Improve this question
2
  • 5
    Close voters: This question is definitely on topic here; unless you are familiar with the inner working of security vulnerability management, it's difficult to research - basically, you don't know what you're not aware of.
    – Allan
    Oct 16, 2017 at 13:57
  • 5
    AirPort firmware updates are going to be equally important!
    – self.name
    Oct 16, 2017 at 16:16

3 Answers 3

Reset to default
33

Updates released 31 October 2017

Apple has released updates that include a fix for the KRACK vulnerability for macOS, iOS, tvOS and watchOS. To get the updates:

It's Apple's policy to not comment on security vulnerabilities until they are patched, and even when they do, they are often quite vague about it.

About Apple security updates

For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page.

However, with a little detective work, we can gain some insight. Looking at the CVEs assigned to this particular vulnerability,* we can get listing of the issues that should be addressed by Apple when they decide to issue a security patch:

  • CVE-2017-13077: Reinstallation of the pairwise encryption key (PTK-TK) in the 4-way handshake.
  • CVE-2017-13078: Reinstallation of the group key (GTK) in the 4-way handshake.
  • CVE-2017-13079: Reinstallation of the integrity group key (IGTK) in the 4-way handshake.
  • CVE-2017-13080: Reinstallation of the group key (GTK) in the group key handshake.
  • CVE-2017-13081: Reinstallation of the integrity group key (IGTK) in the group key handshake.
  • CVE-2017-13082: Accepting a retransmitted Fast BSS Transition (FT) Reassociation Request and reinstalling the pairwise encryption key (PTK-TK) while processing it.
  • CVE-2017-13084: Reinstallation of the STK key in the PeerKey handshake.
  • CVE-2017-13086: reinstallation of the Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) key in the TDLS handshake.
  • CVE-2017-13087: reinstallation of the group key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame.
  • CVE-2017-13088: reinstallation of the integrity group key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame.

Also, this ZDNet Article - Here's every patch for KRACK Wi-Fi vulnerability available right now (Oct. 16, 2017) indicates that vendors are responding quickly and Apple has confirmed that patches are in beta.

Apple confirmed it has a fix in beta for iOS, MacOS, WatchOS and TVOS, and will be rolling it out in a software update in a few weeks.

*Common Vulnerabilities and Exposures (CVE®) is a list of common identifiers for publicly known cyber security vulnerabilities. Use of "CVE Identifiers (CVE IDs)," which are assigned by CVE Numbering Authorities (CNAs) from around the world, ensures confidence among parties when used to discuss or share information about a unique software vulnerability, provides a baseline for tool evaluation, and enables data exchange for cyber security automation.

Improve this answer
1
  • 2
    I'm tempted to test this; absence of documentation of fixes might effectively be proof of absence of fixes but Apple could just be playing psychological tricks on wannabe crackers to divert them away from the open issues. (Of course, I wouldn't share my findings until Apple have fixed the problem.)
    – wizzwizz4
    Oct 16, 2017 at 18:27
11

Rene Ritchie, the editor in chief of iMore, reports that this vulnerability is fixed in all current macOS, watchOS, tvOS and iOS betas.

Until the updates ship, many security blogs recommend to use VPN and sites protected with SSL to safeguard any information transmitted over Wi-Fi.

While SSL does not guarantee data safety from a KRACK attack, it makes it significantly harder. However, KRACK gains access deep enough to possibly access data prior to encryption.

Improve this answer
9
  • 2
    But please don’t use free or untrusted VPNs as that will just trade one threat for another
    – Steve
    Oct 17, 2017 at 4:43
  • 1
    Yes. That VPN line was added to my original post by an editor. I personally would not trust any VPN that I did not run myself, off my own server.
    – vykor
    Oct 17, 2017 at 5:19
  • I did see that it wasn’t your edit, but just wanted to make sure I added a note for anyone passing by :)
    – Steve
    Oct 17, 2017 at 5:25
  • 1
    "However, KRACK gains access deep enough to possibly access data prior to encryption." Umm no. This is a vulnerability in wireless communication. This is your answer, you can reject edits other people make.
    – miken32
    Oct 17, 2017 at 20:00
  • 1
    @FyodorGlebov this attack is against clients. The router should be updated, but the clients are the source of the vulnerability.
    – dwightk
    Oct 22, 2017 at 12:59
-2

Considering vulnerability has been just published (at the time of this question asked) and I doubt that it was sent to any manufacturers first (as that would be very difficult considering number of parties to inform about this) - it will take awhile for Apple to bundle new update for all existing devices and release it.

As it has always been before Apple does not do urgent patch of iOS/Mac OS for only a single vulnerability, it bundles a few of the fixes/changes together into an update.

Also making a fix, testing, verifying, releasing etc takes time. So it won't be addressed instantly.

Improve this answer
2
  • 10
    US-CERT coordinates notifications in these cases. For this case, vendors were notified in July and August ( krackattacks.com ). Plenty of time was given before disclosure. In fact, OpenBSD broke embargo and patched too early, causing a minor incident with the original researcher.
    – vykor
    Oct 17, 2017 at 5:18
  • 2
    “As it has always been before Apple does not do urgent patch of iOS/Mac OS for only a single vulnerability…” Err, Apple did quickly release a one time patch for Bash—outside of normal update channels and schedules—when “shellshock” was discovered.
    – Giacomo1968
    Oct 17, 2017 at 20:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .