KRACK

classic Classic list List threaded Threaded
17 messages Options
Reply | Threaded
Open this post in threaded view
|

KRACK

gepr
Key Reinstallation Attacks
Breaking WPA2 by forcing nonce reuse
https://www.krackattacks.com/

> We discovered serious weaknesses in WPA2, a protocol that secures all modern protected Wi-Fi networks. An attacker within range of a victim can exploit these weaknesses using key reinstallation attacks (KRACKs). Concretely, attackers can use this novel attack technique to read information that was previously assumed to be safely encrypted. This can be abused to steal sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on. The attack works against all modern protected Wi-Fi networks. Depending on the network configuration, it is also possible to inject and manipulate data. For example, an attacker might be able to inject ransomware or other malware into websites.
>
> The weaknesses are in the Wi-Fi standard itself, and not in individual products or implementations. Therefore, any correct implementation of WPA2 is likely affected. To prevent the attack, users must update affected products as soon as security updates become available. Note that if your device supports Wi-Fi, it is most likely affected. During our initial research, we discovered ourselves that Android, Linux, Apple, Windows, OpenBSD, MediaTek, Linksys, and others, are all affected by some variant of the attacks. For more information about specific products, consult the database of CERT/CC, or contact your vendor.



--
␦glen?

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove
uǝʃƃ ⊥ glen
Reply | Threaded
Open this post in threaded view
|

Re: KRACK

Nick Thompson
YIKES!

Nicholas S. Thompson
Emeritus Professor of Psychology and Biology
Clark University
http://home.earthlink.net/~nickthompson/naturaldesigns/


-----Original Message-----
From: Friam [mailto:[hidden email]] On Behalf Of ?glen?
Sent: Tuesday, October 17, 2017 8:56 AM
To: FriAM <[hidden email]>
Subject: [FRIAM] KRACK

Key Reinstallation Attacks
Breaking WPA2 by forcing nonce reuse
https://www.krackattacks.com/

> We discovered serious weaknesses in WPA2, a protocol that secures all modern protected Wi-Fi networks. An attacker within range of a victim can exploit these weaknesses using key reinstallation attacks (KRACKs). Concretely, attackers can use this novel attack technique to read information that was previously assumed to be safely encrypted. This can be abused to steal sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on. The attack works against all modern protected Wi-Fi networks. Depending on the network configuration, it is also possible to inject and manipulate data. For example, an attacker might be able to inject ransomware or other malware into websites.
>
> The weaknesses are in the Wi-Fi standard itself, and not in individual products or implementations. Therefore, any correct implementation of WPA2 is likely affected. To prevent the attack, users must update affected products as soon as security updates become available. Note that if your device supports Wi-Fi, it is most likely affected. During our initial research, we discovered ourselves that Android, Linux, Apple, Windows, OpenBSD, MediaTek, Linksys, and others, are all affected by some variant of the attacks. For more information about specific products, consult the database of CERT/CC, or contact your vendor.



--
␦glen?

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove


============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove
Reply | Threaded
Open this post in threaded view
|

Re: KRACK

Robert Wall
In reply to this post by gepr
Thanks for the heads-up, Glen!

On Tue, Oct 17, 2017 at 8:55 AM, ┣glen┫ <[hidden email]> wrote:
Key Reinstallation Attacks
Breaking WPA2 by forcing nonce reuse
https://www.krackattacks.com/

> We discovered serious weaknesses in WPA2, a protocol that secures all modern protected Wi-Fi networks. An attacker within range of a victim can exploit these weaknesses using key reinstallation attacks (KRACKs). Concretely, attackers can use this novel attack technique to read information that was previously assumed to be safely encrypted. This can be abused to steal sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on. The attack works against all modern protected Wi-Fi networks. Depending on the network configuration, it is also possible to inject and manipulate data. For example, an attacker might be able to inject ransomware or other malware into websites.
>
> The weaknesses are in the Wi-Fi standard itself, and not in individual products or implementations. Therefore, any correct implementation of WPA2 is likely affected. To prevent the attack, users must update affected products as soon as security updates become available. Note that if your device supports Wi-Fi, it is most likely affected. During our initial research, we discovered ourselves that Android, Linux, Apple, Windows, OpenBSD, MediaTek, Linksys, and others, are all affected by some variant of the attacks. For more information about specific products, consult the database of CERT/CC, or contact your vendor.



--
␦glen?

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove


============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove
Reply | Threaded
Open this post in threaded view
|

Re: KRACK

Russell Standish-2
It's big alright. Linux and Android are particularly badly affected. I
tried upgrading my Linux WiFi client yesterday when the news first
broke, but the fix only landed overnight, so I've managed to update this
morning. Not too shabby - MS, Google and Apple all had about a month's
head start on the open source OSes.

I'm going to have to do a full upgrade of my laptop, as the OS on that
looks like it is too old to be fixed.

I updated the firmware on my WiFi router yesterday, but there's no
indication of whether there is a KRACK problem, or when any fix might
be coming... :(.

On Tue, Oct 17, 2017 at 11:09:00AM -0600, Robert Wall wrote:

> Thanks for the heads-up, Glen!
>
> On Tue, Oct 17, 2017 at 8:55 AM, ┣glen┫ <[hidden email]> wrote:
>
> > Key Reinstallation Attacks
> > Breaking WPA2 by forcing nonce reuse
> > https://www.krackattacks.com/
> >
> > > We discovered serious weaknesses in WPA2, a protocol that secures all
> > modern protected Wi-Fi networks. An attacker within range of a victim can
> > exploit these weaknesses using key reinstallation attacks (KRACKs).
> > Concretely, attackers can use this novel attack technique to read
> > information that was previously assumed to be safely encrypted. This can be
> > abused to steal sensitive information such as credit card numbers,
> > passwords, chat messages, emails, photos, and so on. The attack works
> > against all modern protected Wi-Fi networks. Depending on the network
> > configuration, it is also possible to inject and manipulate data. For
> > example, an attacker might be able to inject ransomware or other malware
> > into websites.
> > >
> > > The weaknesses are in the Wi-Fi standard itself, and not in individual
> > products or implementations. Therefore, any correct implementation of WPA2
> > is likely affected. To prevent the attack, users must update affected
> > products as soon as security updates become available. Note that if your
> > device supports Wi-Fi, it is most likely affected. During our initial
> > research, we discovered ourselves that Android, Linux, Apple, Windows,
> > OpenBSD, MediaTek, Linksys, and others, are all affected by some variant of
> > the attacks. For more information about specific products, consult the
> > database of CERT/CC, or contact your vendor.
> >
> >
> >
> > --
> > ␦glen?
> >
> > ============================================================
> > FRIAM Applied Complexity Group listserv
> > Meets Fridays 9a-11:30 at cafe at St. John's College
> > to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
> > FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove

> ============================================================
> FRIAM Applied Complexity Group listserv
> Meets Fridays 9a-11:30 at cafe at St. John's College
> to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
> FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove


--

----------------------------------------------------------------------------
Dr Russell Standish                    Phone 0425 253119 (mobile)
Principal, High Performance Coders
Visiting Senior Research Fellow        [hidden email]
Economics, Kingston University         http://www.hpcoders.com.au
----------------------------------------------------------------------------

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove
Reply | Threaded
Open this post in threaded view
|

Re: KRACK

Marcus G. Daniels
In reply to this post by gepr
Indiegogo

 

 

From: Flter: Privacy & Security Router via Indiegogo [mailto:[hidden email]]
Sent: Friday, October 20, 2017 4:34 PM
To: Marcus Daniels <[hidden email]>
Subject:
📢 Update #11 from Flter: Privacy & Security Router

 

 

 

 

 

 

 

posted by Peter DiPreta

Oct 20, 2017 • 3:27PM PDT

KRACK Attack

The recently discovered WPA2 weakness allows attackers to decrypt information sent over WiFi that would otherwise be encrypted by your WiFi password.

Being that WPA2 is the most widely adopted wireless encryption protocol in the world right now, the scope of this issue is enormous. This vulnerability affects almost every device that has WiFi capability. Whether it’s a Smart TV, IP camera, phone or computer, it’s safe to assume that it’s data can be intercepted and/or altered by an attacker.

We’re currently preparing a software update for Flter that will eliminate any risk of data intercept while being used as an access point or client (repeater). Flter will automatically update when it’s connected to power and internet.

Just keep in mind that even though Flter will be updated your other devices might still be vulnerable to attack. You will want to make sure that you update them as soon as a patch is released by their manufacturers.

While you’re waiting for software updates for your mobile devices and computers we recommend using our VPN client while connected to WiFi. The encrypted tunnel that the VPN creates when you connect prevents Man-in-the-middle attacks. This is the sort of attack that the WPA2 vulnerability puts you at risk for.

The release of our Android and iOS VPN app along with our new desktop client is right around the corner and we’ll be posting another update as soon as they are ready for release.

You can find more information about this over at https://www.krackattacks.com/

Stay safe out there!

Posted By

What's your reaction to this post?

Your feedback will help Peter DiPreta improve future updates.

 

You are receiving this email because you have contributed to or are following this campaign. To stop receiving updates from this campaign, change the settings in your email_preferences

 

 

 

 

 

You can always visit our Help Center for tips and resources or contact Customer Happiness with questions. We’ll respond within 24 hours!

 

FacebookTwitterInstagramEmail

 

Apple StoreGoogle Play Store

 

 

Indiegogo
965 Mission Street, 7th Floor, San Francisco, CA 94103
© 2017 Indiegogo, All rights reserved

 

 


============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove
Reply | Threaded
Open this post in threaded view
|

Re: KRACK

gepr
But if I understand correctly, my TV and printer will remain the weakest links, regardless.  And as long as those are present, whatever credentials my router requires are compromisable.  So, a possible solution is to use one subnet for the devices for which you don't have patches and a more trusted subnet for those that are patched.  ... perhaps even different routers.

On 10/20/2017 03:52 PM, Marcus Daniels wrote:
> The recently discovered WPA2 weakness allows attackers to decrypt information sent over WiFi that would otherwise be encrypted by your WiFi password.
>
> Being that WPA2 is the most widely adopted wireless encryption protocol in the world right now, the scope of this issue is enormous. This vulnerability affects almost every device that has WiFi capability. Whether it’s a Smart TV, IP camera, phone or computer, it’s safe to assume that it’s data can be intercepted and/or altered by an attacker.
>
> We’re currently preparing a software update for Flter that will eliminate any risk of data intercept while being used as an access point or client (repeater). Flter will automatically update when it’s connected to power and internet.
>
> Just keep in mind that even though Flter will be updated your other devices might still be vulnerable to attack. You will want to make sure that you update them as soon as a patch is released by their manufacturers.
>
> While you’re waiting for software updates for your mobile devices and computers we recommend using our VPN client while connected to WiFi. The encrypted tunnel that the VPN creates when you connect prevents Man-in-the-middle attacks. This is the sort of attack that the WPA2 vulnerability puts you at risk for.

--
☣ gⅼеɳ

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove
uǝʃƃ ⊥ glen
Reply | Threaded
Open this post in threaded view
|

Re: KRACK

Marcus G. Daniels
Add extra (vpn/tor) encryption where it matters [by using this device].

Sent from my iPhone

On Oct 20, 2017, at 5:02 PM, gⅼеɳ ☣ <[hidden email]> wrote:

But if I understand correctly, my TV and printer will remain the weakest links, regardless.  And as long as those are present, whatever credentials my router requires are compromisable.  So, a possible solution is to use one subnet for the devices for which you don't have patches and a more trusted subnet for those that are patched.  ... perhaps even different routers.

On 10/20/2017 03:52 PM, Marcus Daniels wrote:
The recently discovered WPA2 weakness allows attackers to decrypt information sent over WiFi that would otherwise be encrypted by your WiFi password.

Being that WPA2 is the most widely adopted wireless encryption protocol in the world right now, the scope of this issue is enormous. This vulnerability affects almost every device that has WiFi capability. Whether it’s a Smart TV, IP camera, phone or computer, it’s safe to assume that it’s data can be intercepted and/or altered by an attacker.

We’re currently preparing a software update for Flter that will eliminate any risk of data intercept while being used as an access point or client (repeater). Flter will automatically update when it’s connected to power and internet.

Just keep in mind that even though Flter will be updated your other devices might still be vulnerable to attack. You will want to make sure that you update them as soon as a patch is released by their manufacturers.

While you’re waiting for software updates for your mobile devices and computers we recommend using our VPN client while connected to WiFi. The encrypted tunnel that the VPN creates when you connect prevents Man-in-the-middle attacks. This is the sort of attack that the WPA2 vulnerability puts you at risk for.

--
☣ gⅼеɳ

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove
Reply | Threaded
Open this post in threaded view
|

Re: KRACK

gepr
Ah!  I see. So, the idea is that even if the router-managed network is compromised, if we always rely on device-to-device encryption/conflation, then it doesn't matter if the network is compromised.  Hm.  I'm not convinced.  It seems like there should be meta-data and packet envelope data that would still be useful to the red team.  Plus, I have no idea how my roku or playstation, both of which provide access to my credit card, authenticate.  I'd like to think they use end-to-end encryption.  But ...  And then there are things like my DLNA server.  I'd like to think that I've done everything correctly and a black hat couldn't hack my server from my playstation.  But ...  And, of course, I've configured Renee's Windows 10 machine so that it doesn't use the firewall while on the home network.  I suppose I should change that, too.  [sigh]

If it weren't for that serial-killer-style van with the fake looking logo on the side, parked outside my house every month or so, I wouldn't worry so much. 8^)

On 10/20/2017 04:11 PM, Marcus Daniels wrote:
> Add extra (vpn/tor) encryption where it matters [by using this device].

--
☣ gⅼеɳ

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove
uǝʃƃ ⊥ glen
Reply | Threaded
Open this post in threaded view
|

Re: KRACK

Roger Critchlow-2
The OpenWRT/LEDE open source images for compatible routers got updated a few days ago.  Since the hack attacks the handshake protocol between client and access point, there are apparently several ways the access point can subvert the attack.  Whether the update accomplishes that without introducing new vulnerabilities remains to be seen.

-- rec --


On Fri, Oct 20, 2017 at 7:26 PM, gⅼеɳ ☣ <[hidden email]> wrote:
Ah!  I see. So, the idea is that even if the router-managed network is compromised, if we always rely on device-to-device encryption/conflation, then it doesn't matter if the network is compromised.  Hm.  I'm not convinced.  It seems like there should be meta-data and packet envelope data that would still be useful to the red team.  Plus, I have no idea how my roku or playstation, both of which provide access to my credit card, authenticate.  I'd like to think they use end-to-end encryption.  But ...  And then there are things like my DLNA server.  I'd like to think that I've done everything correctly and a black hat couldn't hack my server from my playstation.  But ...  And, of course, I've configured Renee's Windows 10 machine so that it doesn't use the firewall while on the home network.  I suppose I should change that, too.  [sigh]

If it weren't for that serial-killer-style van with the fake looking logo on the side, parked outside my house every month or so, I wouldn't worry so much. 8^)

On 10/20/2017 04:11 PM, Marcus Daniels wrote:
> Add extra (vpn/tor) encryption where it matters [by using this device].

--
☣ gⅼеɳ

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove


============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove
Reply | Threaded
Open this post in threaded view
|

Re: KRACK

gepr
Yeah. They've built with a patch for ddwrt, too. Supposedly here:
http://svn.dd-wrt.com/changeset/33525
But it's still fun to think about.


On October 20, 2017 5:00:38 PM PDT, Roger Critchlow <[hidden email]> wrote:
>The OpenWRT/LEDE open source images for compatible routers got updated
>a
>few days ago.  Since the hack attacks the handshake protocol between
>client
>and access point, there are apparently several ways the access point
>can
>subvert the attack.  Whether the update accomplishes that without
>introducing new vulnerabilities remains to be seen.


--
⛧glen⛧

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove
uǝʃƃ ⊥ glen
Reply | Threaded
Open this post in threaded view
|

Re: KRACK

Nick Thompson
Hi, Wizards,

I hope at some point you will let us civilians know what we should do about this.  Other than cringing in abject terror, of course.  

Nick

Nicholas S. Thompson
Emeritus Professor of Psychology and Biology
Clark University
http://home.earthlink.net/~nickthompson/naturaldesigns/

-----Original Message-----
From: Friam [mailto:[hidden email]] On Behalf Of gepr ?
Sent: Friday, October 20, 2017 7:11 PM
To: The Friday Morning Applied Complexity Coffee Group <[hidden email]>
Subject: Re: [FRIAM] KRACK

Yeah. They've built with a patch for ddwrt, too. Supposedly here:
http://svn.dd-wrt.com/changeset/33525
But it's still fun to think about.


On October 20, 2017 5:00:38 PM PDT, Roger Critchlow <[hidden email]> wrote:
>The OpenWRT/LEDE open source images for compatible routers got updated
>a few days ago.  Since the hack attacks the handshake protocol between
>client and access point, there are apparently several ways the access
>point can subvert the attack.  Whether the update accomplishes that
>without introducing new vulnerabilities remains to be seen.


--
⛧glen⛧

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove


============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove
Reply | Threaded
Open this post in threaded view
|

Re: KRACK

Marcus G. Daniels

Nick writes:


"I hope at some point you will let us civilians know what we should do about this.  Other than cringing in abject terror, of course."


You can subscribe to one of these..


https://www.pcmag.com/article2/0,2817,2403388,00.asp


This will involve pressing a Connect button before using the Internet.   The channel will be encrypted, so that a wiretap (without the wires) it will only show gibberish.  


Or download the software at www.torproject.org

Tor takes more extensive measures to both encrypt your connections and also to make it very difficult to track you.  The cost of this is that it is slower.  A VPN is less noticeable in this regard. 


As Glen points out, there are other kinds of wireless access that are easy to overlook such as when a smartphone switches from LTE to Wifi, Kindle/Tablet browsing, Amazon Fire sticks, wireless cameras, and so on.   There are VPN app for smartphones too.  


Then there is another option which is to buy a big estate and put a moat around it.   That doesn't stop drones, though.   A moat and a plexiglass bubble, then.   Oh, and watch out for boring machines too from well-equipped people like Elon Musk and El Chapo.


Marcus


From: Friam <[hidden email]> on behalf of Nick Thompson <[hidden email]>
Sent: Saturday, October 21, 2017 9:49:23 AM
To: 'The Friday Morning Applied Complexity Coffee Group'
Subject: Re: [FRIAM] KRACK
 
Hi, Wizards,

I hope at some point you will let us civilians know what we should do about this.  Other than cringing in abject terror, of course. 

Nick

Nicholas S. Thompson
Emeritus Professor of Psychology and Biology
Clark University
http://home.earthlink.net/~nickthompson/naturaldesigns/

-----Original Message-----
From: Friam [[hidden email]] On Behalf Of gepr ?
Sent: Friday, October 20, 2017 7:11 PM
To: The Friday Morning Applied Complexity Coffee Group <[hidden email]>
Subject: Re: [FRIAM] KRACK

Yeah. They've built with a patch for ddwrt, too. Supposedly here:
http://svn.dd-wrt.com/changeset/33525
But it's still fun to think about.


On October 20, 2017 5:00:38 PM PDT, Roger Critchlow <[hidden email]> wrote:
>The OpenWRT/LEDE open source images for compatible routers got updated
>a few days ago.  Since the hack attacks the handshake protocol between
>client and access point, there are apparently several ways the access
>point can subvert the attack.  Whether the update accomplishes that
>without introducing new vulnerabilities remains to be seen.


--
⛧glen⛧

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove


============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove
Reply | Threaded
Open this post in threaded view
|

Re: KRACK

gepr
Ha! That reminds me of the fact that gmane no longer archives this list. (And even the mailman archives have been down for awhile.) So now's the time to speak freely because your words are less likely to be used against you later. 8^)

I can't help but wonder how the notorious lack of security in the Internet of Things will impact our (what Mikhail Epstein calls) "textoids", those little snippets of our produce, video, music, email, tweets, etc. The openness of the universe (as Dave's rant gets right) continues to flummox the GUMmers amongst us. At the ALife Evolution of evolvability I workshop, the group was bifurcated into 2 camps: those who thought hierarchy decreased degrees of freedom and those who thought it increased DoF. I'm still too ignorant to have a coherent opinion. But it seems either could be right.


On October 21, 2017 9:59:01 AM PDT, Marcus Daniels <[hidden email]> wrote:
>Then there is another option which is to buy a big estate and put a
>moat around it.   That doesn't stop drones, though.   A moat and a
>plexiglass bubble, then.   Oh, and watch out for boring machines too
>from well-equipped people like Elon Musk and El Chapo.
--
⛧glen⛧

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove
uǝʃƃ ⊥ glen
Reply | Threaded
Open this post in threaded view
|

Re: KRACK

Steve Smith
In reply to this post by Marcus G. Daniels

I recently heard from a friend who achieved a very transient and unexpected contact with a US Antartica Science team member via a 1W handheld DMR RX/TX device.   Anecdotally, they field about 10 such contacts a week.   This is more than a little misleading since DMR is a packet-relay system, albeit ad-hoc, but doesn't really say anything about the distance of any single link... just that there were a finite(reasonable) number of hops between my friend in Kansas and the folks on the ground in Antartica.  


Meanwhile, my own tiny low-power handheld device (iPhone 4) hears (and more importantly, can be heard by) a small handful of cell towers, the closest is known to be 9 miles away and I don't get much if any useful reception BTW.   That would suggest to me that my 2.4Ghz WiFi modem could be "heard" from a similar distance (given the similar frequency of 1.9Ghz) I"m sure there are some folks here with more SIGINT knowledge than I, I'm just winging it on the back of an envelope.   So that makes for a pretty big "moat" around my 2.9 acre property.   And if I can't stop gophers from boring under my garden fence buried 18 inches, how can I hope to stop Musk and El Chapo?  And the drones and tethered balloons? No way!  I can barely see them with my 100x scope on my WWI 30.06 which has a theoretical ceiling of 10,000 ft anyway, so I doubt I can shoot them down even if I can find them (PS.  I don't own any ammunition for said antique handed down from my grandfather who carried it in Europe 100 years ago).


I remember scoffing at a colleague 25 years ago who claimed that the holographic strips added to $50/$100 bills was a "gubmint konspiracy" to track our cash from satellite... and yup!  He had an MS in CS but lined his wallet with tinfoil (but not his hat?).    It seems steered phased array antenna can interrogate UHF RFID tags from about 600ft in free air today... so while he was a few orders of magnitude off in his paranoia, it is MORE reasonable than I'd expected.


McNealy told us 20 years ago "there is NO privacy, get OVER it".   I'm not sure what "over it" means, but I think we need a whole restructuring of social norms and expectations based on this issue.   


My latest bets are on ideas grown up out of BlockChain tech...  it's not just for Digital Currency anymore?


I think we need to transcend both Capitalism (and for sure consumerism) and Democracy (but not egalitarianism) at this point, so folks like Democracy Earth might either be "a good start" or "a bad seed", I'm not sure yet.   http://democracy.earth/ .  Any observations?


- Sneeze

On 10/21/17 10:59 AM, Marcus Daniels wrote:

Nick writes:


"I hope at some point you will let us civilians know what we should do about this.  Other than cringing in abject terror, of course."


You can subscribe to one of these..


https://www.pcmag.com/article2/0,2817,2403388,00.asp


This will involve pressing a Connect button before using the Internet.   The channel will be encrypted, so that a wiretap (without the wires) it will only show gibberish.  


Or download the software at www.torproject.org

Tor takes more extensive measures to both encrypt your connections and also to make it very difficult to track you.  The cost of this is that it is slower.  A VPN is less noticeable in this regard. 


As Glen points out, there are other kinds of wireless access that are easy to overlook such as when a smartphone switches from LTE to Wifi, Kindle/Tablet browsing, Amazon Fire sticks, wireless cameras, and so on.   There are VPN app for smartphones too.  


Then there is another option which is to buy a big estate and put a moat around it.   That doesn't stop drones, though.   A moat and a plexiglass bubble, then.   Oh, and watch out for boring machines too from well-equipped people like Elon Musk and El Chapo.


Marcus


From: Friam [hidden email] on behalf of Nick Thompson [hidden email]
Sent: Saturday, October 21, 2017 9:49:23 AM
To: 'The Friday Morning Applied Complexity Coffee Group'
Subject: Re: [FRIAM] KRACK
 
Hi, Wizards,

I hope at some point you will let us civilians know what we should do about this.  Other than cringing in abject terror, of course. 

Nick

Nicholas S. Thompson
Emeritus Professor of Psychology and Biology
Clark University
http://home.earthlink.net/~nickthompson/naturaldesigns/

-----Original Message-----
From: Friam [[hidden email]] On Behalf Of gepr ?
Sent: Friday, October 20, 2017 7:11 PM
To: The Friday Morning Applied Complexity Coffee Group [hidden email]
Subject: Re: [FRIAM] KRACK

Yeah. They've built with a patch for ddwrt, too. Supposedly here:
http://svn.dd-wrt.com/changeset/33525
But it's still fun to think about.


On October 20, 2017 5:00:38 PM PDT, Roger Critchlow [hidden email] wrote:
>The OpenWRT/LEDE open source images for compatible routers got updated
>a few days ago.  Since the hack attacks the handshake protocol between
>client and access point, there are apparently several ways the access
>point can subvert the attack.  Whether the update accomplishes that
>without introducing new vulnerabilities remains to be seen.


--
⛧glen⛧

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove


============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove


============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove


============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove
Reply | Threaded
Open this post in threaded view
|

Re: KRACK

gepr
Awesome contribution!

On October 21, 2017 2:26:51 PM PDT, Steven A Smith <[hidden email]> wrote:

>I recently heard from a friend who achieved a very transient and
>unexpected contact with a US Antartica Science team member via a 1W
>handheld DMR RX/TX device.   Anecdotally, they field about 10 such
>contacts a week.   This is more than a little misleading since DMR is a
>
>packet-relay system, albeit ad-hoc, but doesn't really say anything
>about the distance of any single link... just that there were a
>finite(reasonable) number of hops between my friend in Kansas and the
>folks on the ground in Antartica.
>
>
>Meanwhile, my own tiny low-power handheld device (iPhone 4) hears (and
>more importantly, can be heard by) a small handful of cell towers, the
>closest is known to be 9 miles away and I don't get much if any useful
>reception BTW.   That would suggest to me that my 2.4Ghz WiFi modem
>could be "heard" from a similar distance (given the similar frequency
>of
>1.9Ghz) I"m sure there are some folks here with more SIGINT knowledge
>than I, I'm just winging it on the back of an envelope.   So that makes
>
>for a pretty big "moat" around my 2.9 acre property.   And if I can't
>stop gophers from boring under my garden fence buried 18 inches, how
>can
>I hope to stop Musk and El Chapo?  And the drones and tethered
>balloons?
>No way!  I can barely see them with my 100x scope on my WWI 30.06 which
>
>has a theoretical ceiling of 10,000 ft anyway, so I doubt I can shoot
>them down even if I can find them (PS.  I don't own any ammunition for
>said antique handed down from my grandfather who carried it in Europe
>100 years ago).
>
>
>I remember scoffing at a colleague 25 years ago who claimed that the
>holographic strips added to $50/$100 bills was a "gubmint konspiracy"
>to
>track our cash from satellite... and yup!  He had an MS in CS but lined
>
>his wallet with tinfoil (but not his hat?).    It seems steered phased
>array antenna can interrogate UHF RFID tags from about 600ft in free
>air
>today... so while he was a few orders of magnitude off in his paranoia,
>
>it is MORE reasonable than I'd expected.
>
>
>McNealy told us 20 years ago "there is NO privacy, get OVER it".   I'm
>not sure what "over it" means, but I think we need a whole
>restructuring
>of social norms and expectations based on this issue.
>
>
>My latest bets are on ideas grown up out of BlockChain tech... it's not
>
>just for Digital Currency anymore?
>
>
>I think we need to transcend both Capitalism (and for sure consumerism)
>
>and Democracy (but not egalitarianism) at this point, so folks like
>Democracy Earth might either be "a good start" or "a bad seed", I'm not
>
>sure yet.   http://democracy.earth/ .  Any observations?
--
⛧glen⛧

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove
uǝʃƃ ⊥ glen
Reply | Threaded
Open this post in threaded view
|

Re: KRACK

Marcus G. Daniels
In reply to this post by Steve Smith
I am all for big investments in Blockchain:  Secure the vote, secure hazardous materials, secure titles to property, fuel the quantum computing arms race..  Good stuff!

Sent from my iPhone

On Oct 21, 2017, at 3:27 PM, Steven A Smith <[hidden email]> wrote:

I recently heard from a friend who achieved a very transient and unexpected contact with a US Antartica Science team member via a 1W handheld DMR RX/TX device.   Anecdotally, they field about 10 such contacts a week.   This is more than a little misleading since DMR is a packet-relay system, albeit ad-hoc, but doesn't really say anything about the distance of any single link... just that there were a finite(reasonable) number of hops between my friend in Kansas and the folks on the ground in Antartica.  


Meanwhile, my own tiny low-power handheld device (iPhone 4) hears (and more importantly, can be heard by) a small handful of cell towers, the closest is known to be 9 miles away and I don't get much if any useful reception BTW.   That would suggest to me that my 2.4Ghz WiFi modem could be "heard" from a similar distance (given the similar frequency of 1.9Ghz) I"m sure there are some folks here with more SIGINT knowledge than I, I'm just winging it on the back of an envelope.   So that makes for a pretty big "moat" around my 2.9 acre property.   And if I can't stop gophers from boring under my garden fence buried 18 inches, how can I hope to stop Musk and El Chapo?  And the drones and tethered balloons? No way!  I can barely see them with my 100x scope on my WWI 30.06 which has a theoretical ceiling of 10,000 ft anyway, so I doubt I can shoot them down even if I can find them (PS.  I don't own any ammunition for said antique handed down from my grandfather who carried it in Europe 100 years ago).


I remember scoffing at a colleague 25 years ago who claimed that the holographic strips added to $50/$100 bills was a "gubmint konspiracy" to track our cash from satellite... and yup!  He had an MS in CS but lined his wallet with tinfoil (but not his hat?).    It seems steered phased array antenna can interrogate UHF RFID tags from about 600ft in free air today... so while he was a few orders of magnitude off in his paranoia, it is MORE reasonable than I'd expected.


McNealy told us 20 years ago "there is NO privacy, get OVER it".   I'm not sure what "over it" means, but I think we need a whole restructuring of social norms and expectations based on this issue.   


My latest bets are on ideas grown up out of BlockChain tech...  it's not just for Digital Currency anymore?


I think we need to transcend both Capitalism (and for sure consumerism) and Democracy (but not egalitarianism) at this point, so folks like Democracy Earth might either be "a good start" or "a bad seed", I'm not sure yet.   http://democracy.earth/ .  Any observations?


- Sneeze

On 10/21/17 10:59 AM, Marcus Daniels wrote:

Nick writes:


"I hope at some point you will let us civilians know what we should do about this.  Other than cringing in abject terror, of course."


You can subscribe to one of these..


https://www.pcmag.com/article2/0,2817,2403388,00.asp


This will involve pressing a Connect button before using the Internet.   The channel will be encrypted, so that a wiretap (without the wires) it will only show gibberish.  


Or download the software at www.torproject.org

Tor takes more extensive measures to both encrypt your connections and also to make it very difficult to track you.  The cost of this is that it is slower.  A VPN is less noticeable in this regard. 


As Glen points out, there are other kinds of wireless access that are easy to overlook such as when a smartphone switches from LTE to Wifi, Kindle/Tablet browsing, Amazon Fire sticks, wireless cameras, and so on.   There are VPN app for smartphones too.  


Then there is another option which is to buy a big estate and put a moat around it.   That doesn't stop drones, though.   A moat and a plexiglass bubble, then.   Oh, and watch out for boring machines too from well-equipped people like Elon Musk and El Chapo.


Marcus


From: Friam [hidden email] on behalf of Nick Thompson [hidden email]
Sent: Saturday, October 21, 2017 9:49:23 AM
To: 'The Friday Morning Applied Complexity Coffee Group'
Subject: Re: [FRIAM] KRACK
 
Hi, Wizards,

I hope at some point you will let us civilians know what we should do about this.  Other than cringing in abject terror, of course. 

Nick

Nicholas S. Thompson
Emeritus Professor of Psychology and Biology
Clark University
http://home.earthlink.net/~nickthompson/naturaldesigns/

-----Original Message-----
From: Friam [[hidden email]] On Behalf Of gepr ?
Sent: Friday, October 20, 2017 7:11 PM
To: The Friday Morning Applied Complexity Coffee Group [hidden email]
Subject: Re: [FRIAM] KRACK

Yeah. They've built with a patch for ddwrt, too. Supposedly here:
http://svn.dd-wrt.com/changeset/33525
But it's still fun to think about.


On October 20, 2017 5:00:38 PM PDT, Roger Critchlow [hidden email] wrote:
>The OpenWRT/LEDE open source images for compatible routers got updated
>a few days ago.  Since the hack attacks the handshake protocol between
>client and access point, there are apparently several ways the access
>point can subvert the attack.  Whether the update accomplishes that
>without introducing new vulnerabilities remains to be seen.


--
⛧glen⛧

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove


============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove


============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove
Reply | Threaded
Open this post in threaded view
|

Re: KRACK

Roger Critchlow-2

On Sat, Oct 21, 2017 at 6:05 PM, Marcus Daniels <[hidden email]> wrote:
I am all for big investments in Blockchain:  Secure the vote, secure hazardous materials, secure titles to property, fuel the quantum computing arms race..  Good stuff!

Sent from my iPhone

On Oct 21, 2017, at 3:27 PM, Steven A Smith <[hidden email]> wrote:

I recently heard from a friend who achieved a very transient and unexpected contact with a US Antartica Science team member via a 1W handheld DMR RX/TX device.   Anecdotally, they field about 10 such contacts a week.   This is more than a little misleading since DMR is a packet-relay system, albeit ad-hoc, but doesn't really say anything about the distance of any single link... just that there were a finite(reasonable) number of hops between my friend in Kansas and the folks on the ground in Antartica.  


Meanwhile, my own tiny low-power handheld device (iPhone 4) hears (and more importantly, can be heard by) a small handful of cell towers, the closest is known to be 9 miles away and I don't get much if any useful reception BTW.   That would suggest to me that my 2.4Ghz WiFi modem could be "heard" from a similar distance (given the similar frequency of 1.9Ghz) I"m sure there are some folks here with more SIGINT knowledge than I, I'm just winging it on the back of an envelope.   So that makes for a pretty big "moat" around my 2.9 acre property.   And if I can't stop gophers from boring under my garden fence buried 18 inches, how can I hope to stop Musk and El Chapo?  And the drones and tethered balloons? No way!  I can barely see them with my 100x scope on my WWI 30.06 which has a theoretical ceiling of 10,000 ft anyway, so I doubt I can shoot them down even if I can find them (PS.  I don't own any ammunition for said antique handed down from my grandfather who carried it in Europe 100 years ago).


I remember scoffing at a colleague 25 years ago who claimed that the holographic strips added to $50/$100 bills was a "gubmint konspiracy" to track our cash from satellite... and yup!  He had an MS in CS but lined his wallet with tinfoil (but not his hat?).    It seems steered phased array antenna can interrogate UHF RFID tags from about 600ft in free air today... so while he was a few orders of magnitude off in his paranoia, it is MORE reasonable than I'd expected.


McNealy told us 20 years ago "there is NO privacy, get OVER it".   I'm not sure what "over it" means, but I think we need a whole restructuring of social norms and expectations based on this issue.   


My latest bets are on ideas grown up out of BlockChain tech...  it's not just for Digital Currency anymore?


I think we need to transcend both Capitalism (and for sure consumerism) and Democracy (but not egalitarianism) at this point, so folks like Democracy Earth might either be "a good start" or "a bad seed", I'm not sure yet.   http://democracy.earth/ .  Any observations?


- Sneeze

On 10/21/17 10:59 AM, Marcus Daniels wrote:

Nick writes:


"I hope at some point you will let us civilians know what we should do about this.  Other than cringing in abject terror, of course."


You can subscribe to one of these..


https://www.pcmag.com/article2/0,2817,2403388,00.asp


This will involve pressing a Connect button before using the Internet.   The channel will be encrypted, so that a wiretap (without the wires) it will only show gibberish.  


Or download the software at www.torproject.org

Tor takes more extensive measures to both encrypt your connections and also to make it very difficult to track you.  The cost of this is that it is slower.  A VPN is less noticeable in this regard. 


As Glen points out, there are other kinds of wireless access that are easy to overlook such as when a smartphone switches from LTE to Wifi, Kindle/Tablet browsing, Amazon Fire sticks, wireless cameras, and so on.   There are VPN app for smartphones too.  


Then there is another option which is to buy a big estate and put a moat around it.   That doesn't stop drones, though.   A moat and a plexiglass bubble, then.   Oh, and watch out for boring machines too from well-equipped people like Elon Musk and El Chapo.


Marcus


From: Friam [hidden email] on behalf of Nick Thompson [hidden email]
Sent: Saturday, October 21, 2017 9:49:23 AM
To: 'The Friday Morning Applied Complexity Coffee Group'
Subject: Re: [FRIAM] KRACK
 
Hi, Wizards,

I hope at some point you will let us civilians know what we should do about this.  Other than cringing in abject terror, of course. 

Nick

Nicholas S. Thompson
Emeritus Professor of Psychology and Biology
Clark University
http://home.earthlink.net/~nickthompson/naturaldesigns/

-----Original Message-----
From: Friam [[hidden email]] On Behalf Of gepr ?
Sent: Friday, October 20, 2017 7:11 PM
To: The Friday Morning Applied Complexity Coffee Group [hidden email]
Subject: Re: [FRIAM] KRACK

Yeah. They've built with a patch for ddwrt, too. Supposedly here:
http://svn.dd-wrt.com/changeset/33525
But it's still fun to think about.


On October 20, 2017 5:00:38 PM PDT, Roger Critchlow [hidden email] wrote:
>The OpenWRT/LEDE open source images for compatible routers got updated
>a few days ago.  Since the hack attacks the handshake protocol between
>client and access point, there are apparently several ways the access
>point can subvert the attack.  Whether the update accomplishes that
>without introducing new vulnerabilities remains to be seen.


--
⛧glen⛧

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove


============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove


============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove


============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
FRIAM-COMIC http://friam-comic.blogspot.com/ by Dr. Strangelove