WPA2 weakness discovered (KRACK)

[ChrisP]

Hi,

With the Krack attack that have been published today regarding WPA2 weakness, what are the plan to mitigate risk in ESP Easy implementation ?

The issue have already been trigered to esp8266 arduino Github: https://github.com/esp8266/Arduino/issues/3725

IOT devices should not be a weak part regarding security :/

more info here: https://www.krackattacks.com/

[danmero]

+1

[sups]

+1

but also there are a few other things I would like to see implemented too
1) Masking of the WPA2 password
2) Use of HTTPs rather than HTTP (though I'm not sure if this is possible)

re: KRACK the only thing I can think of to reduce the chances of this exploit happening, is to disable SSID broadcast on the WiFi appliance. If an attacker cant see what SSIDs are around him/her they wont have anything to target. Something i'll be testing with my ESP based devices in the coming days.

[DeNB3rt]

My thoughts yesterday,
Create 2 wifi networks, one for ESP one for other devices (phone, laptop) with restrictions.
Disable SSID broadcast for the ESPeasy network.

[Shardan]

Espressif has released security patches for their own ESP-SDK's RTOS and NONOS:

https://www.kb.cert.org/vuls/id/CHEU-ARFFHX

So hopefully we will see some updated ESP8266-Core for Arduino and same for PlatformIO soon........


Regards
Shardan

[ChrisP]

Apparently the Espressif correction is already included in the 2.4 rc2 version of ESP8266 arduiono SDK, which is good news: https://github.com/esp8266/Arduino/comm ... edff08755c

But what are the plan for ESP Easy to integrate it ?

I'm not so sure that hiding the SSID will protect against KRACK, since KRACK attack do not target AP but it's dialog between host and AP that should be listened and removing SSID broadcast would not prevent that.

in addition to https when ESP is in AP mode (but this is not related to KRACK) I would really like to see TLS implementation for MQTT connection.

(Yes I have separate SSID on specific VLAN and a strict firewall for my IOT devices, but it's a limited mitigation.)