Kr00k: How KRACKing Amazon Echo Exposed a Billion+ Vulnerable Wi-Fi Devices
summary
Researchers demonstrate that Broadcom/Cypress FullMAC Wi‑Fi chips let transmitted frames be encrypted with an all-zero encryption key after a disassociation, allowing passive or active attackers to decrypt HTTP, DNS and credential data by sending crafted disassociation frames and capturing the leftover 32 KB in the 32 KB transmit buffer. A lab monitor-mode sniffer script repeatedly triggers and collects plaintext frames, affects over a billion devices including routers, and is shown working; vendors later release firmware/driver patches.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 6:24What is Kr00k
- 13:20What can an attacker do
- 16:14Demo
- 19:51Access Point
- 23:24Crack
- 26:50Other Chipsets
- 31:09Conclusion
related talks
34mPractical Side-Channel Attacks Against WPA-TKIP
30mCommSec D1 - How to Find and Exploit Bugs in IoT Devices
40mSweet Dreams: Abusing Sleep Mode to Break Wi-Fi Encryption and Disrupt WPA2/3 Networks
22mWhat Amazon Echo Taught Me About IoT Security
47mKey Reinstallation Attacks: Breaking the WPA2 Protocol
40mWarezTheRemote? Under the Couch, and Listening to You
13mUnmasking the Black Box: Eduardo Montovani on Wi-Fi Security, AI, and Affordable Hacking
47mBLEEDINGBIT: Your APs Belong to Us