#krack

Devastating news for avid Wi-Fi users was released over the weekend when Belgian researcher Mathy Vanhoef of The Katholieke Universiteit Leuven discovered a weakness with the WPA2 protocol used to secure all modern Wi-Fi networks. The weakness, which can be exploited by someone within range of the victim’s local network using key re-installation attacks, known as KRACK, can be abused to decrypt traffic. This means attackers can steal credentials and payment card data, for example. Or, in an even worse scenario, could inject malicious code or even manipulate data on a wireless network. According to Vanhoef, “The weaknesses are in the Wi-Fi standard itself, and not in individual products or implementations. Therefore, any correct implementation of WPA2 is likely affected.”Around July 14th, Vanhoef began privately notifying vendors when he realized the large scale of the issue. While many vendors have already issued security updates, the affected vendors list released by US CERT is not comprehensive. Vanhoef realized that the attack "concentrates on the four-way handshake carried out when clients join WPA2 networks. It is at this step where the key reinstallation attack takes place; an attacker on the network is able to intercede and replay cryptographic handshake messages, bypassing a mandate where keys should be used only once. The weakness occurs when messages during the handshake are lost or dropped, a fairly common occurrence, and the access point retransmits the third part of the handshake, theoretically multiple times."

This vulnerability appears to be caused by a remark in the Wi-Fi standard that suggests to clear the encryption key from memory once it has been installed for the first time. When the client now receives a retransmitted message 3 of the 4-way handshake, it will reinstall the now-cleared encryption key, effectively installing an all-zero key. -Mathy Vanhoef

Learn more about Wi-Fi attacks. Read 'Wi-Fi Security: WEP, WPA, WPA2.'

#malware

Kaspersky Labs recently discovered malware for sale on the Dark Web which would allow users to rob ATMs either via network or physical access. Cha-ching. The malware, dubbed 'CUTLET MAKER,' which researchers have noted is a Russian slang term meaning 'bundle of money,' was being sold a part of a kit on on AlphaBay, a Dark Net marketplace that was taken down over the summer. The post describes required equipment, targeted ATM models, as well a detailed manual for the toolkit with tips and tricks on the malware’s operation. In the kit, buyers receive a password generator and a stimulator, which is an application that can "grab information on the status of cash cassettes in a target ATM (such as currency, value, and the amount of notes)."In the manual, 'Wall ATM Read Me.txt,' researchers observed it being distributed as a plain text file, and noticed it suggests two people should be involved in the theft, a 'drop' and a 'drop master.' According to Kaspersky, the attackers using 'CUTLET MAKER' might have had physical access to the PC, allowing them to install the malware onto the machine. Researchers recommend installing device control software to prevent the connection of new devices, such as USBs. Additional countermeasures against similar malware attacks include default-deny policies and device control, the first of which prevents criminals from "running their own code on the ATM’s internal PC."

This type of malware does not affect bank customers directly, it is intended for the theft of cash from specific vendor ATMs. CUTLET MAKER and Stimulator show how criminals are using legitimate proprietary libraries and a small piece of code to dispense money from an ATM. -Kaspersky

Learn to detect malware yourself. Explore 'How to Identify Malware Attacks.'

#cryto-flaw

Thought KRACK was bad? The newly discovered crypto- vulnerability (CVE-2017-15361) may be worse, as it could allow a remote attacker to reverse-calculate a private encryption key just by having a target's public key.Fondly named 'ROCA' (Return of Coppersmith's Attack), this vulnerability affects Microsoft, Google, Lenovo, HP and Fujitsu customers, as it stems from the widely used RSA cryptographic library produced by German semiconductor manufacturer Infineon Technologies, residing in the implementation of RSA key pair generation by Infineon's Trusted Platform Module (TPM). TPM is a "dedicated microcontroller designed to secure hardware by integrating cryptographic keys into devices and is used for secured crypto processes."Discovered by researchers from Masaryk University in the Czech Republic, this 5-year-old algorithmic vulnerability could allow attackers to "impersonate the key owner, decrypt victim's sensitive data, inject malicious code into digitally signed software, and bypass protections that prevent accessing or tampering with the targeted computer." ROCA exposes billions of devices to attack, as it affects chips manufactured by Infineon as early as 2012. It is feasible for key lengths, including 1024 and 2048 bits, which is most commonly used in the "national identity cards, on PC motherboards to securely store passwords, in authentication tokens, during secure browsing, during software and application signing, and with message protection like PGP." Currently, the confirmed number of vulnerable keys is about 760,000, but researchers indicated hundreds of thousands more could be vulnerable. Many of the affected companies have already released software updates, so users are strongly recommended to patch.

Only the knowledge of a public key is necessary and no physical access to the vulnerable device is required. The vulnerability does NOT depend on a weak or a faulty random number generator, all RSA keys generated by a vulnerable chip are impacted. -Masaryk University researchers

#factbyte

The Economist report has analyzed 60 cities across 49 indicators spanning digital, climate, infrastructural, health, and personal security concerns, and found in many cities, security is falling rather than rising with two exceptions: Madrid, which is up 13 points and Seoul, up six. Cities tend to have fallen in the index since 2015, for example, New York is down 11, Lima is down 13, Johannesburg is down nine, Ho Chi Minh City is down ten and Jakarta is down 13.Olivia Lynch (@Cybrary_Olivia) is the Marketing & Communications Manager at Cybrary. Like many of you, she is just getting her toes wet in the infosec field and is working to make cyber security news more interesting. A firm believer that the pen is mightier than the sword, Olivia considers corny puns and an honest voice essential to any worthwhile blog.