KRACKATTACKS Major Wireless Security Issues - Your advisory is unclear and possibly flawed

It maybe because Its a Thursday and its been a busy week so I’m tired and lacking patience, or maybe I have completely misunderstood this vulnerability and your 100% in the right to be pounding away at this issue with multiple posts on it and near abusive comments aimed the Peplink engineering team, but this issue seems to have been answered already?

The Key Reinstallation Attack AKA KRACATTACK targets WiFI clients NOT Access Points (unless that access point also itself acts as client in some way - ie as a WiFi repeater).

Peplinks Response to this vulnerability has been quite clear. The devices that are affected are those that use WiFi as WAN functionality (ie those that act in the role of a WiFI client). Their guidance to disable WiFi WAN as a workaround seems valid to me.

On the https://www.krackattacks.com/ page you link to in the FAQs section is a paragraph that says the following (i have highlighted pertiernant parts in bold):

Our main attack is against the 4-way handshake, and does not exploit access points, but instead targets clients. So it might be that your router does not require security updates. We strongly advise you to contact your vendor for more details. In general though, you can try to mitigate attacks against routers and access points by disabling client functionality (which is for example used in repeater modes) and disabling 802.11r (fast roaming). For ordinary home users, your priority should be updating clients such as laptops and smartphones.

As you can see it also recommends disabling client functionality as a way to mitigate the issue- as per the response from Peplink.

I don’t see what your issue is on Peplink’s response. If I have missed something please advise what that is.

6 Likes