Major Security Vulnerabilities Now Have Marketing Campaigns ⇥ axios.com

Shannon Vavra, Axios:

There’s a four-way handshake that establishes a key for securing traffic, but the third step allows the key to be resent multiple times, which allows encryption to be undermined, according to a researcher briefed on the vulnerability. The researchers, the United States Computer Emergency Readiness Team and KU Leuven, report this breach, called KRACK (Key Reinstallation Attacks) could allow connection hijacking and malicious code injection.

Mathy Vanhoef discovered the vulnerability, which comprises ten CVEs. And, yeah, it’s a big problem, but we’re not all completely screwed. Alex Hudson explains:

Remember, there is a limited amount of physical security already on offer by WiFi: an attack needs to be in proximity. So, you’re not suddenly vulnerable to everyone on the internet. It’s very weak protection, but this is important when reviewing your threat level.

Additionally, it’s likely that you don’t have too many protocols relying on WPA2 security. Every time you access an https site – like this one – your browser is negotiating a separate layer of encryption. Accessing secure websites over WiFi is still totally safe. Hopefully – but there is no guarantee – you don’t have much information going over your network that requires the encryption WPA2 provides.

Juli Clover, MacRumors:

Apple’s iOS devices (and Windows machines) are not as vulnerable as Macs or devices running Linux or Android because the vulnerability relies on a flaw that allows what’s supposed to be a single-use encryption key to be resent and reused more than once, something the iOS operating system does not allow, but there’s still a partial vulnerability.

Apple’s latest round of betas, released to developers today, include a patch.

Here’s the thing about this: it’s clearly a bad bug, but it is both generally fixable and the fear is — at least to some extent — driven by the researcher’s PR campaign around it. Much like Heartbleed, KRACK has a cool name and a logo.

But compare the immediate groundswell of attention around Heartbleed and KRACK against, say, a critical flaw in the widely-used RSA encryption library, also announced today. Dan Goodin, Ars Technica:

The weakness allows attackers to calculate the private portion of any vulnerable key using nothing more than the corresponding public portion. Hackers can then use the private key to impersonate key owners, decrypt sensitive data, sneak malicious code into digitally signed software, and bypass protections that prevent accessing or tampering with stolen PCs. The five-year-old flaw is also troubling because it’s located in code that complies with two internationally recognized security certification standards that are binding on many governments, contractors, and companies around the world. The code library was developed by German chipmaker Infineon and has been generating weak keys since 2012 at the latest.

This bug isn’t receiving anywhere near the same attention as KRACK, despite RSA being used to generate some — not all — keys for PGP and GitHub, and potentially all keys for Microsoft BitLocker and identity cards for Estonia and Slovakia.

I get why security researchers are dialling up the campaigns behind major vulnerabilities. CVE numbers aren’t interesting or explanatory, and the explanations that are attached are esoteric and precise, but not very helpful for less-technical readers. A catchy name gives a vulnerability — or, in this case, a set of vulnerabilities — an identity, helps educate consumers about the risks of having unpatched software, and gives researchers an opportunity to take public credit for their work. But, I think the histrionics that increasingly come with these vulnerabilities somewhat cheapens their effect, and potentially allows other very serious exploits to escape public attention.