dd-wrt patched against severe flaws in WPA2 / KRACK attack

Post new topic   Reply to topic    DD-WRT Forum Index -> General Questions
Goto page Previous  1, 2, 3, 4, 5, 6, 7, 8  Next
Author Message
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12812
Location: Netherlands

PostPosted: Sun Oct 22, 2017 8:41    Post subject: Reply with quote
gregmcc wrote:
Also not finding my router on the list. Tried a generic file but firmware upgrade failed.

This is the current firmware I'm on:

Router Model Netgear WG602 v4

Firmware Version DD-WRT v24-sp2 (08/07/10) micro - build 14896


Well that is a golden oldie, are you sure it can use a k2.6 build? Maybe it can only use K2.4 build which can be found at: ftp://ftp.dd-wrt.com/betas/2017/10-20-2017-r33555/broadcom/

for further reading start at: http://www.dd-wrt.com/wiki/index.php/Netgear_WG602_v3/4
It seems your router has only 2 MB nvram so only use a micro build

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
Sponsor
qwertyk
DD-WRT Novice


Joined: 21 Oct 2017
Posts: 5

PostPosted: Sun Oct 22, 2017 9:59    Post subject: Reply with quote
Same please
Asus WL500G Premium v2 date: 2017-09-07...
ghoti19
DD-WRT Novice


Joined: 21 Oct 2017
Posts: 5

PostPosted: Sun Oct 22, 2017 12:20    Post subject: Reply with quote
ghoti19 wrote:
ghoti19 wrote:
When I do a search for my router (Linksys E1000 v1) I find the following under that router in the database.

dd-wrt.v24-21061_NEWD-2_K2.6_mini_e1000v1.bin with a date of 2017-09-07

Since it is not dated after 2017-10-10 I figure that it has not been updated with the KRACK update.

Will this be updated in the near future?

I've looked through the list of routers contained in: ftp://ftp.dd-wrt.com/betas/2017/10-17-2017-r33525/ and can not find this router.

Any help on which (if any) file I should use would be greatly appreciated.


Think I might have found the answer myself by continuing to look.

Was just going through the 'additional information' link for that router and found the following:


Firmware version 33555 dated 10/20/17 runs on this router and is the second version that has the KRACK vulnerability fixed in WPA2 it is available here - tmittelstaedt 10/20/17

and links to the following file https://download1.dd-wrt.com/dd-wrtv2/downloads/betas/2017/10-20-2017-r33555/broadcom_K26/dd-wrt.v24-33555_NEWD-2_K2.6_std_nokaid_small.bin

so I guess I will give this a try.


That version (kinda) works. For generic router and AP it works fine, but it does not work as a Repeater Bridge (works in a wired configuration between two routers but not wirelessly) - any thoughts on a different firmware to try?
BrainSlayer
Site Admin


Joined: 06 Jun 2006
Posts: 7463
Location: Dresden, Germany

PostPosted: Sun Oct 22, 2017 14:47    Post subject: Reply with quote
all broadcom based chipsets are still affected by crackattack. only mediatek and qca/atheros and marvell based chipsets are fixed now. broadcom has not released a solution yet for the propertiery drivers. so be patient. i'm on it.

and additionally there is a solution for a ap side fix. see the new option "disable eapol retries" at wireless security (not visible on broadcom routers for sure)

_________________
"So you tried to use the computer and it started smoking? Sounds like a Mac to me.." - Louis Rossmann https://www.youtube.com/watch?v=eL_5YDRWqGE&t=60s
BrainSlayer
Site Admin


Joined: 06 Jun 2006
Posts: 7463
Location: Dresden, Germany

PostPosted: Sun Oct 22, 2017 18:33    Post subject: Reply with quote
i wrote now a own patch for all broadcom drivers which handles the problem. so broadcom routers will have krackattack fixed with next release
_________________
"So you tried to use the computer and it started smoking? Sounds like a Mac to me.." - Louis Rossmann https://www.youtube.com/watch?v=eL_5YDRWqGE&t=60s
Kalsta
DD-WRT Novice


Joined: 10 Jan 2013
Posts: 11
Location: Bathurst, NSW, Australia

PostPosted: Sun Oct 22, 2017 21:34    Post subject: Reply with quote
BrainSlayer wrote:
all broadcom based chipsets are still affected by crackattack. only mediatek and qca/atheros and marvell based chipsets are fixed now. broadcom has not released a solution yet for the propertiery drivers. so be patient. i'm on it.

and additionally there is a solution for a ap side fix. see the new option "disable eapol retries" at wireless security (not visible on broadcom routers for sure)


I'm assuming the new "undefined" option is the one (WRT1900ACSv2 version of r33555 build), or does that mean it's not supported on this version?



2017-10-23_0821.png
 Description:
 Filesize:  23.96 KB
 Viewed:  14751 Time(s)

2017-10-23_0821.png


pigtail
DD-WRT Novice


Joined: 26 Oct 2015
Posts: 22

PostPosted: Mon Oct 23, 2017 6:56    Post subject: Reply with quote
Kalsta wrote:
I'm assuming the new "undefined" option is the one (WRT1900ACSv2 version of r33555 build), or does that mean it's not supported on this version?


please go to the link below and know you are not the only one.
https://www.dd-wrt.com/phpBB2/viewtopic.php?t=311799


... but i thought restore from setting files after fw upgrade is NOT recommended. why does everyone seem to do this?
eponymous_one
DD-WRT Novice


Joined: 27 Feb 2013
Posts: 8

PostPosted: Mon Oct 23, 2017 7:25    Post subject: Reply with quote
Quote:
only mediatek and qca/atheros and marvell based chipsets are fixed now.


BrainSlayer, since MediaTek bought Ralink, does that mean version 33555 fixes Ralink chipests as well or do we need to wait? I've just updated my DIR-615 D2 (Ralink) to 33555 and I'm now unsure if it's patched against KRACK.
tedm
DD-WRT Guru


Joined: 13 Mar 2009
Posts: 554

PostPosted: Mon Oct 23, 2017 8:58    Post subject: Linksys E1000 v1 and other old devices Reply with quote
ghoti19, thanks for posting that! I have a pile of different models of devices and when the fixed firmware came out I flashed all of them and reported the results into the wiki specifically for people like you who needed a quick answer. But I had no time to put all of them through their paces I just wanted to find out if they would brick or not (and some did that I had to debrick) Please do file a bug on this or update one if there is one! Or at least post into the Broadcom-specific forum.

Folks, there's a HUGE opportunity here for dd-wrt since there are going to be MANY router manufacturers who will punt on this issue and pretend to play dumb with older devices.

A great many corporations have IT policies that -mandate- equipment with known security flaws to be retired - if it cannot be updated, it is required to be replaced. Any company, like a bank, medical facility, or anything of that nature, which is subject to periodic security audits has absolutely no choice on this EVEN IF they can configure a device with a flaw to NOT engage the flaw.

Yes, we all know that routers that are not configured for fast roaming or repeater mode aren't vulnerable and the attacker has to be practically on top of the wireless connection to attack. But this makes ZERO difference to a security auditor they will insist on replacement - if the device has the configuration option in it to turn on client mode or fast roaming, out it goes if there is no firmware update for it. And for a great many of these devices there NEVER will be. IT managers will be discovering this during their next security audit.

And there's more, too. IT people in many companies have been fighting with users bringing in little routers and setting up private little wifi networks for their phones and such instead of using the IT-run-but-controlled corporate wifi net. The users got away with it because their bosses went to bat for them against IT and since everyone has wifi in their house they think it's secure with a long password on it. So far these users have been getting away with it in many places. But now the IT people will be able to wave around "KRACK vulnerability" with enough technical terms to scare your average CEO and they will be getting compliance and those nets will get shut down.

All of this adds up to a flood of used orphan routers on the secondary market. It will also have a lot of IT people looking to preserve hardware investment. You might think that an IT person with 4 Linksys E1000's in service in various places would be more than happy to drop $400 into 4 brand new APs. But that means he's absolutely going to have people out there with weird devices that connected fine to the old radios that have problems with the new ones. So he's absolutely going to want to keep those E1000's (or other old routers) in service if he can.

dd-wrt is well positioned to take advantage of this. OpenWRT is just too complex for the average system admin to install. Now is the time to really concentrate on backwards compatibility for older devices I think. The focus for the next few years isn't going to be on the latest AC-whatever wifi routers it's going to be on how do I preserve the institutional investment in a wifi network that has been running stable and fine that nobody has been complaining about.

Realize that there is not a SINGLE commercial router in the warehouse or on the shelf in a retailer that is patched. An IT person cannot go to their supplier and order 10 new APs to replace the 10 they have in service that they have just been told are vulnerable. EVERYTHING will have to be firmware updated before it's put into service. So you might as well firmware update your existing gear if a forklift replacement is going to also have to be firmware updated, you won't save a bit of time just buying new devices since they will all be vulnerable anyway.

And the ability to protect vulnerable clients by an option in the router - THAT is absolute GOLD. It is worth a story in the trade rags and it can bring a lot more attention to dd-wrt.

That attention can be used as a club to convince router makers to yield up technical specs that will allow us to support more devices. The mainline router makers will be very leery of putting an option in their code to disconnect clients since that will be a non-compliant WPA2 implementation and it may get the standards bodies like the wifi consortium on their neck. But they might be quite happy to tell customers who call in saying they want such an ability to load dd-wrt. I imagine Buffalo is probably more lit up about this right now than a 16 year old on her first prom date. A mainline router maker could advertise dd-wrt compatibility and explain to an IT system admin with a building full of Android devices that well while we don't support a workaround for your devices these dd-wrt guys over here have this unofficial workaround.

We'll see how all this plays out but I think that there's a heck of a lot of political implications on this that people haven't even begun to think about.
Kalsta
DD-WRT Novice


Joined: 10 Jan 2013
Posts: 11
Location: Bathurst, NSW, Australia

PostPosted: Mon Oct 23, 2017 20:23    Post subject: Reply with quote
pigtail wrote:
Kalsta wrote:
I'm assuming the new "undefined" option is the one (WRT1900ACSv2 version of r33555 build), or does that mean it's not supported on this version?


please go to the link below and know you are not the only one.
https://www.dd-wrt.com/phpBB2/viewtopic.php?t=311799


Thanks pigtail, like others in that forum, mine corrected itself without any further intervention from myself.

pigtail wrote:
... but i thought restore from setting files after fw upgrade is NOT recommended. why does everyone seem to do this?


I followed the instructions in this thread here: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=311117, and simply upgraded the firmware which preserves your settings.

Thanks to BrainSlayer for sorting this out so quickly for us!

Cheers,

Kal



2017-10-24_0715.png
 Description:
 Filesize:  23.65 KB
 Viewed:  14497 Time(s)

2017-10-24_0715.png


dalponis
DD-WRT Novice


Joined: 27 Sep 2007
Posts: 19
Location: Ontario, Canada

PostPosted: Tue Oct 24, 2017 15:00    Post subject: Reply with quote
I've got a bunch of Broadcom Linksys routers eagerly awaiting the newest firmware. Smile

Thanks BrainSlayer.

_________________
http://www.uniquehardware.ca
http://forums.uniquehardware.ca
When the average just isn't quite enough... - Trevor "Dalponis" Welsh
MHzTweaker
DD-WRT Novice


Joined: 07 Jul 2013
Posts: 12

PostPosted: Wed Oct 25, 2017 20:23    Post subject: Reply with quote
So the new firmware r33607 is out.

I landed here because I have 3 routers configured as access points

Netgear R7000
Linksys WRT1900AC
TP Link Archer C9 v1

I suppose I will try updating the Linksys first to avoid a KRACK ATTACK
Spc.
DD-WRT User


Joined: 29 Mar 2007
Posts: 74

PostPosted: Wed Oct 25, 2017 22:36    Post subject: Reply with quote
New build 33607 doesn't work on Linksys E4200.
When i set my frequency to different channel both radios stop working.
useeone
DD-WRT Novice


Joined: 11 Jun 2012
Posts: 7

PostPosted: Wed Oct 25, 2017 23:56    Post subject: Reply with quote
I've managed to get build r33607 onto my Linksys E1200 v2, but I don't see any options to enable the fix, or is it hardcode enabled?

Also will this mean clients (say, an Android phone that's not been patched) connects to this router, it'll be safe from the crackattack?
Spc.
DD-WRT User


Joined: 29 Mar 2007
Posts: 74

PostPosted: Thu Oct 26, 2017 5:06    Post subject: Reply with quote
useeone wrote:
I've managed to get build r33607 onto my Linksys E1200 v2, but I don't see any options to enable the fix, or is it hardcode enabled?

Also will this mean clients (say, an Android phone that's not been patched) connects to this router, it'll be safe from the crackattack?

I also don't see the option on Asus RT-AC68U or Linksys E4200.
Goto page Previous  1, 2, 3, 4, 5, 6, 7, 8  Next Display posts from previous:    Page 5 of 8
Post new topic   Reply to topic    DD-WRT Forum Index -> General Questions All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum