{"id":1568,"date":"2020-03-03T14:08:41","date_gmt":"2020-03-03T10:08:41","guid":{"rendered":"https:\/\/www.techxmedia.com\/?p=1568"},"modified":"2025-04-18T00:01:37","modified_gmt":"2025-04-17T20:01:37","slug":"billion-devices-at-risk-eset","status":"publish","type":"post","link":"https:\/\/techxmedia.com\/en\/billion-devices-at-risk-eset\/","title":{"rendered":"Communications of a billion+ devices were at risk, ESET"},"content":{"rendered":"\n

ESET researchers have discovered Kr00k (CVE-2019-15126), a previously unknown vulnerability in Wi-Fi<\/a> chips used in many client devices, Wi-Fi access points and routers. <\/p>\n\n\n\n

Kr00k is a vulnerability that causes the network\ncommunication of an affected device to be encrypted with an all-zero encryption\nkey. In a successful attack, this allows an adversary to decrypt wireless\nnetwork packets.<\/p>\n\n\n\n

The discovery of Kr00k follows previous ESET research<\/a> into the Amazon Echo being vulnerable to\nKRACKs (Key Reinstallation Attacks). Kr00k is related to KRACK, but is also\nfundamentally different. During the investigation into KRACK, ESET researchers\nidentified Kr00k as one of the causes behind the \u201creinstallation\u201d of an\nall-zero encryption key observed in tests for KRACK attacks. Subsequent to our\nresearch, most major device manufacturers have released patches. <\/p>\n\n\n\n

Kr00k is particularly dangerous because it has\naffected over a billion Wi-Fi enabled devices \u2013 a conservative estimate. <\/p>\n\n\n\n

ESET presented its research into this vulnerability\nfor the first time on February 26 at the RSA Conference 2020<\/a>.<\/p>\n\n\n\n

Kr00k affects all devices with Broadcom and Cypress\nWi-Fi chips that remain unpatched. These are the most common Wi-Fi chips used\nin today’s client devices. Wi-Fi access points and routers are also affected by\nthe vulnerability, making even environments with patched client devices\nvulnerable. ESET tested and confirmed that among the vulnerable devices were\nclient devices by Amazon (Echo, Kindle), Apple (iPhone, iPad, MacBook), Google\n(Nexus), Samsung (Galaxy), Raspberry (Pi 3) and Xiaomi (Redmi), as well as\naccess points by Asus and Huawei.<\/p>\n\n\n\n

ESET responsibly disclosed the vulnerability to the\nchip manufacturers Broadcom and Cypress, who subsequently released patches. We\nalso worked with the Industry Consortium for Advancement\nof Security on the Internet <\/a>(ICASI) to ensure that all possibly affected\nparties \u2013 including affected device manufacturers using the vulnerable chips,\nas well as other possibly affected chip manufacturers \u2013 were aware of Kr00k.\nAccording to our information, devices by major manufacturers have now been patched.<\/p>\n\n\n\n

\u201cKr00k manifests itself after Wi-Fi disassociations \u2013\nwhich can happen naturally, for example due to a weak Wi-Fi signal, or may be\nmanually triggered by an attacker. If an attack is successful, several\nkilobytes of potentially sensitive information can be exposed,\u201d explains Milo\u0161\n\u010cerm\u00e1k, the lead ESET researcher into the Kr00k vulnerability. \u201cBy repeatedly\ntriggering disassociations, the attacker can capture a number of network\npackets with potentially sensitive data,\u201d he adds.<\/p>\n\n\n\n

\"\"
An active attacker can trigger disassociations to capture and decrypt data.<\/em> <\/figcaption><\/figure><\/div>\n\n\n\n

\u201cTo protect yourself, as a user, make sure you have updated all your Wi-Fi capable devices, including phones, tablets, laptops, IoT smart devices, and Wi-Fi access points and routers, to the latest firmware version,\u201d advises Robert Lipovsk\u00fd, an ESET researcher working with the Kr00k vulnerability research team. \u201cOf great concern is that not only client devices, but also Wi-Fi access points and routers that have been affected by Kr00k. This greatly increases the attack surface, as an adversary can decrypt data that was transmitted by a vulnerable access point, which is often beyond your control, to your device, which doesn\u2019t have to be vulnerable.\u201d  <\/p>\n","protected":false},"excerpt":{"rendered":"

Kr00k is a vulnerability that causes the network communication of an affected device to be encrypted with an all-zero encryption key. In a successful attack, this allows an adversary to decrypt wireless network packets.<\/p>\n","protected":false},"author":8,"featured_media":1571,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[154,1595,9621],"tags":[686,518,527,573,683,684,685],"contributor":[],"class_list":["post-1568","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cloud-computing","category-cybersecurity","category-emerging-technologies","tag-cyber_attack","tag-cyber_security","tag-cyber_threat","tag-eset","tag-eset_researchers","tag-kr00k","tag-wi-fi"],"featured_image_src":"https:\/\/techxmedia.com\/en\/wp-content\/uploads\/2020\/03\/Kr00k_ESET_image-e1583229957722.png","author_info":{"display_name":"Rabab","author_link":"https:\/\/techxmedia.com\/en\/author\/rabab\/"},"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t