Tag Archives: Intel

WPA2 KRACK Vulnerability: What you need to know

Last Sunday, the early signs of a vulnerability disclosure affecting the extensively used Wi-Fi protected access (WPA2) protocol were evident. The next day, disclosure of the vulnerability lead to more details. The vulnerability was discovered by  two researchers Mathy Vanhoef and Frank Piessens of the Katholieke Universiteit Leuven (KU Leuven) while examining OpenBSD’s implementation of the WPA2 four way handshake.

Why should this vulnerability be considered important?
On Monday 16th October, the KRACK (key re-installation attacks) vulnerability was disclosed. This vulnerability was found within the implementation of the WPA2 protocol rather than any single device making it’s impact much more widespread. For example, vulnerable devices include Windows, OpenBSD (if not already patched against it), Linux, Apple iOS, Apple macOS and Google Android.

If exploited this vulnerability could allow decryption, packet replay, TCP connection hijacking and if WPA-TKIP (defined) or GCMP (explained) are used; the attacker can inject packets (defined) into a victim’s data, forging web traffic.

How can an attacker exploit this vulnerability?
To exploit the vulnerability an attacker must be within range of a vulnerable Wi-Fi network in order to perform a man in the middle attack (MiTM)(defined). This means that this vulnerability cannot be exploited over the Internet.

This vulnerability occurs since the initial four way handshake is used to generate a strong and unique key to encrypt the traffic between wireless devices. A handshake is used to authenticate two entities (in this example a wireless router and a wireless device wishing to connect to it) and to establish the a new key used to communicate.

The attacker needs to manipulate the key exchange (described below) by replaying cryptographic handshake messages (which blocks the message reaching the client device) causing it to be re-sent during the third step of the four way handshake. This is allowed since wireless communication is not 100% reliable e.g. a data packet could be lost or dropped and the router will re-send the third part of the handshake. This is allowed to occur multiple times if necessary. Each time the handshake is re-sent the attacker can use it to gather how cryptographic nonces (defined here and here) are created (since replay counters and nonces are reset) and use this to undermine the entire encryption scheme.

How can I protect myself from this vulnerability?
AS described in this CERT knowledge base article.; updates from vendors will be released in the coming days and weeks. Apple (currently a beta update) and Microsoft already have updates available. OpenBSD also resolved this issue before the disclosure this week.

Microsoft within the information they published for the vulnerability discusses how when a Windows device enters a low power state the vulnerable functionality of the wireless connection is passed to the underlying Wi-Fi hardware. For this reason they recommend contacting the vendor of that Wi-Fi hardware to request updated drivers (defined).

Links to affected hardware vendors are available from this ICASI Multi-Vendor Vulnerability Disclosure statement. Intel’ security advisory with relevant driver updates is here. The wireless vendor, Edimax also posted a statement with further updates to follow. A detailed but easy to use list of many vendors responses is here. Since I use an Asus router, the best response I could locate is here.

======
Update: 21st October 2017:
Cisco have published a security advisory relating to the KRACK vulnerability for its wireless products. At the time of writing no patches were available but the advisory does contain a workaround for some of the affected products.
======

The above updates are software fixes but updates will also be made available for devices in the form of firmware updates e.g. for wireless routers, smartphones and Internet of Things (IoT)(defined) devices. For any wireless devices you own, please check with the manufacturer/vendor for available updates with the above CERT article and vendor response list detailing many of the common vendors.

Thank you.

Intel works with system vendors to address AMT vulnerability

In early May, Intel began the process of making available updates to resolve 2 critical security vulnerabilities within the hardware of corporate Intel systems. Security researchers located vulnerabilities within the co-processor which has the role of a management engine and to provide further features as part of Intel’s vPro technology. vPro allows IT teams to remotely administer systems (e.g. determine a systems status regardless of its condition, power on/power off, restart etc.) and provides capabilities including secure wiping of data should the device be lost or stolen.

Why should these vulnerabilities be considered important?
As documented within Intel’s advisory: The first vulnerability allows a remote attacker to gain system level privileges (the highest privileges available)(defined) thus allowing them to make any changes they wish to the affected system. This applies to systems with Intel Active Management Technology (AMT) or Intel® Standard Manageability (ISM) enabled.

The second vulnerability allows an attacker already located within your internal/corporate network to gain network or local system privileges on affected systems. This vulnerability affects AMT and systems with Intel Small Business Technology (SBT) enabled. Definitions for AMT, ISM and SBT are available from Intel. A useful FAQ on the vulnerabilities is available here.

Vulnerable systems are very likely to be in use by many corporate organisations and small businesses. The version numbers of the affected Intel technologies are listed within US-CERTs advisory. All Intel systems which have Intel Active Management Technology (AMT), Intel® Standard Manageability (ISM), and Intel® Small Business Technology enabled are vulnerable. Such systems have been in production for more than nine years.

It should be noted that only business configured devices have such enablement capabilities, the same vulnerabilities do not exist on consumer devices.  However, given the increasingly blurry distinction between user and business devices, especially with concepts such as Bring your own device (BYOD)(defined) these issues can easily be widespread and will take time to address. Intel has published steps which will help to identify affected systems.  A tool is also available from Intel’s download center.

For this vulnerability to be successfully exploited the Active Management Technology (AMT) must be configured to support remote administration.  This tool is not configured by default.

Moreover while the above mentioned three management technologies are vulnerable, the first vulnerability can only be exploited if Active Management Technology (AMT) is provisioned. If not provisioned, the second vulnerability applies.

These vulnerabilities are particularly severe since the management engine co-processor (mentioned above) can access any memory region within an affected system without the primary Intel processor (CPU)(defined) being aware of it. The co-processor can send, receive, read/write data travelling on your network below the level at which firewalls operate thus bypassing them. The management engine can also read and write to the systems storage device (a hard drive) upon the successful authorisation of a user. The co-processor also has read and write access to the devices screen (your monitor) all while remaining undetected and unlogged (events are not captured within the logs of your operating systems making detection by SIEMs (defined) unviable).

How can I protect myself from these vulnerabilities?
Intel has created a list of affected vendors which links to their respective websites including the status of the availability of updates as well as already completed/available updates.

While the preparation of updates is in progress, the following mitigation options are available:

  1. Un-provisioning Intel manageability SKU (stock keeping unit) clients to mitigate unprivileged network attacker from gaining system privileges (Unprovisioning Tool v1.0)
  2. Disabling or removing the Local Manageability Service (LMS) to mitigate unprivileged local attacker from gaining system privileges
  3. Optionally configuring local manageability configuration restrictions

Unfortunately it will take time for vendors to issue updates for all affected systems. If you are in any doubt if your systems are affected, please contact them. In addition, please continue to access the list of vendor websites (provided above) to monitor when the updates to your systems become available. If due dates are instead present at this time, you can schedule a downtime window for these systems to be updated.

Thank you.

=======================
Aside:
What is a stock keeping unit (SKU)?

It refers to a specific item stored to a specific location. The SKU is intended as the most disaggregated level when dealing with inventory (Source)
=======================