ESET discovers Kr00K: Communications of a billion+ devices were at risk

BRATISLAVA, SAN FRANCISCO – February 26, 2020 – ESET researchers have discovered Kr00k (CVE-2019-15126), a previously unknown vulnerability in Wi-Fi chips used in many client devices, Wi-Fi access points and routers.

Kr00k is a vulnerability that causes the network communication of an affected device to be encrypted with an all-zero encryption key. In a successful attack, this allows an adversary to decrypt wireless network packets.

The discovery of Kr00k follows previous ESET research into the Amazon Echo being vulnerable to KRACKs (Key Reinstallation Attacks). Kr00k is related to KRACK, but is also fundamentally different. During the investigation into KRACK, ESET researchers identified Kr00k as one of the causes behind the “reinstallation” of an all-zero encryption key observed in tests for KRACK attacks. Subsequent to our research, most major device manufacturers have released patches.

Kr00k is particularly dangerous because it has affected over a billion Wi-Fi enabled devices – a conservative estimate.

ESET will publicly present its research into this vulnerability for the first time on February 26 at the RSA Conference 2020.

Kr00k affects all devices with Broadcom and Cypress Wi-Fi chips that remain unpatched. These are the most common Wi-Fi chips used in today’s client devices. Wi-Fi access points and routers are also affected by the vulnerability, making even environments with patched client devices vulnerable. ESET tested and confirmed that among the vulnerable devices were client devices by Amazon (Echo, Kindle), Apple (iPhone, iPad, MacBook), Google (Nexus), Samsung (Galaxy), Raspberry (Pi 3) and Xiaomi (Redmi), as well as access points by Asus and Huawei.

ESET responsibly disclosed the vulnerability to the chip manufacturers Broadcom and Cypress, who subsequently released patches. We also worked with the Industry Consortium for Advancement of Security on the Internet (ICASI) to ensure that all possibly affected parties – including affected device manufacturers using the vulnerable chips, as well as other possibly affected chip manufacturers – were aware of Kr00k. According to our information, devices by major manufacturers have now been patched.

“Kr00k manifests itself after Wi-Fi disassociations – which can happen naturally, for example due to a weak Wi-Fi signal, or may be manually triggered by an attacker. If an attack is successful, several kilobytes of potentially sensitive information can be exposed,” explains Miloš Čermák, the lead ESET researcher into the Kr00k vulnerability. “By repeatedly triggering disassociations, the attacker can capture a number of network packets with potentially sensitive data,” he adds.

Figure: An active attacker can trigger disassociations to capture and decrypt data.


“To protect yourself, as a user, make sure you have updated all your Wi-Fi capable devices, including phones, tablets, laptops, IoT smart devices, and Wi-Fi access points and routers, to the latest firmware version,” advises Robert Lipovský, an ESET researcher working with the Kr00k vulnerability research team. “Of great concern is that not only client devices, but also Wi-Fi access points and routers that have been affected by Kr00k. This greatly increases the attack surface, as an adversary can decrypt data that was transmitted by a vulnerable access point, which is often beyond your control, to your device, which doesn’t have to be vulnerable.”

For more technical details about Kr00k, read the white paper Kr00k – CVE-2019-15126 Serious vulnerability deep inside your Wi-Fi encryption and blogpost on WeLiveSecurity. Make sure to check out Kr00k in depth on its dedicated landing page and follow ESET Research on Twitter for the latest news from ESET Research.



About Version 2
Version 2 is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

ESET Deep Behavioral Inspection enables deeper monitoring of unknown & suspicious processes

BRATISLAVA, February 25, 2020 – Today, ESET released a white paper focusing on ESET Deep Behavioral Inspection (DBI) – the latest enhancement of the system specifically designed to perform advanced behavioral analysis and detection known as ESET Host-based Intrusion Prevention System (HIPS).

“Cyber criminals will go to great lengths to achieve their ultimate goal –stealing information, computing resources or money.  Apart  from social  engineering  techniques, they employ  technical tricks such  as obfuscation, encryption, and process injection, designed to help their code avoid detection by built-in as well as third-party security solutions,”explains ESET Security Awareness Specialist Ondrej Kubovič. “ESET DBI, together with  other  HIPS modules,represents an  important  protective layer that can detect and report these tricks and thus block malicious activity on the targeted system,”he adds.

Deep Behavioral Inspection,as one of the latest technological additions to the ESET HIPS framework,can be  found in  the  latest  edition of ESET products for both home and  business users. DBI includes new detection heuristics and enables an even   deeper user-mode monitoring of unknown,suspicious processes. This is accomplished via hooks created by DBI within unknown, potentially harmful processes and monitoring of their activity and requests to the operating system. If malicious behavior is detected, DBI mitigates the activity and informs the user. If the process is suspicious, but does not show clear signs of malicious behavior, HIPS can also use the data gathered by  DBI to run further analysis via its other modules.

ESET Host-based Intrusion Prevention System is a detection technology specifically  created to monitor and scan behavioral events from running processes, files and  registry keys,looking for  suspicious activity. It focuses on a variety of malicious behaviors used either to wreak havoc on a victim’s device or to avoid detection by security solutions. The list of HIPS modules includes:

  • Advanced Memory Scanner (AMS)
  • Exploit Blocker (EB)
  • Ransomware Shield(RS)
  • Deep Behavioral Inspection (DBI)

(Image below: Schematic of how DBI fits into the existing HIPS process monitoring layer)

For more details on the inner workings of ESET HIPS read the latest white paper, “ESET Deep Behavioral Inspection” on https://www.welivesecurity.com/. Make  sure  to follow ESET research on Twitter for the latest news from ESET Research.

 

 

About Version 2 Limited

Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

 

About ESET

For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint and mobile security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give consumers and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defences in realtime to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D centres worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003. For more information, visit https://www.eset.hk/ or follow us on Facebook.

 

 

About Version 2
Version 2 is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

MENDEL 3.5 NOW AVAILABLE

GREYCORTEX is happy to announce that we have released the latest version of our MENDEL network traffic analysis solution. Version 3.5.0 brings important features, improvements, and bug fixes. Among major features, you can find Central Event Management, which enables users to create multi-level appliance structure for exhaustive network overview, or data export into CSV format for more in-depth analysis or enriching other big data tools.

This version contains a number of major changes in the system. To ensure a smooth upgrade process and to provide support to all our partners and customers, we will be introducing this release gradually over the next 14 days.

NEW FEATURES

Data Export into CSV format

MENDEL users can now export data regarding hosts, network, flows, and even incidents into csv. format for further processing and creation of new network data visualizations.

Central Event Management

For customers or partners with larger deployments, MENDEL offers the ability to connect appliances using a multi-level structure; consisting of sensors, collectors, and a Central Event Management console. This provides a more comprehensive overview of the full network.

Validating SSL and TLS certificates

For encrypted communication, MENDEL detects expired or invalid SSL and TLS certificates and alerts the user.

ARP protocol parser

We have added the ability to parse the communications using the Address Resolution Protocol for even better processing of non-IP data.

ENHANCEMENTS

Operating system identification using L7 data

MENDEL is able to detect the operating system of the host more precisely, using an advanced data model based on Samba, DHCP, HTTP, SSH, and L3/L4 parameters, among others. Data is also presented within a new dashboard showing the top operating systems in the network for the chosen period.

Filtering data by additional values

We added the option to filter by additional variables, including operating system, interface, application, and port range.

New predefined dashboards

We have provided two new dashboards: Risks and Statistics; for our users to quickly and easily review the situation in their network.

Additional Enhancements:

  • Upgrade of system components
  • Printer tagging
  • Browser protocol parser
  • Sensor-Collector management
  • Enhanced TLS 1.3 protocol parser
  • Extended host/subnet lease time
  • Configurable display level
  • Decoding QoS/DSCP
  • System improvements
  • Network capture module improvements
  • GUI improvements
  • Localization improvements 

SCADA

MMS protocol processing

For the visualization of MMS protocol data and further analysis, we added MMS protocol processing.

Asset resources management

We added the ability to name, manage, and add new devices in the network.

DLMS/COSEM protocol parser

We added parsing for DLMS/COSEM, one of the most widely accepted international standards for utility meter data exchange.

OMRON FINS protocol parser

We added parsing for the OMRON FINS protocol, which can be used by a PLC program to transfer data and perform other services with a remote PLC connected on an ethernet network.

FIXED ISSUES

In general, our development team focused on improving user experience and reporting. As well as more improvements to user experience, system stability, and performance.

Please note that upgrading to version 3.5.0 will replace the system kernel and reboot the appliance.

We recommend having direct or remote access to the appliance in order to be able to restart it if necessary.



About Version 2
Version 2 is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About GREYCORTEX
GREYCORTEX uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

MENDEL, GREYCORTEX’s network traffic analysis solution, helps corporations, governments, and the critical infrastructure sector protect their futures by detecting cyber threats to sensitive data, networks, trade secrets, and reputations, which other network security products miss.

MENDEL is based on 10 years of extensive academic research and is designed using the same technology which was successful in four US-based NIST Challenges.

為防疫加油！訊連科技捐贈臺灣大學「U 簡報」及「U 會議」 透過遠距教學及視訊會議，讓學習不中斷

【2020年2月21日，台北訊】新型冠狀病毒（COVID-19）疫情在亞洲各國持續升溫，多媒體領導廠商訊連科技（5203.TW）宣布與國立臺灣大學數位學習中心合作，捐贈等值兩百萬台幣之「U 簡報」及「U 會議」服務，協助臺大打造遠距教學直播及視訊會議上課平台，讓無法返校就學的學生於防疫期間，透過網路直播參與課程，並透過視訊方式進行課堂討論。

臺灣大學數位學習中心於2017年成立，成立宗旨係結合傳統教育與數位學習的優勢、加速研發優質且專業的數位學習內容，提供創新學習服務模式，並提升高教公共性。新型冠狀病毒疫情於國際間逐漸升溫，其中亞洲各國影響最鉅。針對於開學期間無法返校參與課程的學生，臺大積極尋找數位化的教學工具，期能透過同步（直播或視訊討論）與非同步遠距教學形式保障學生受教權利。

「臺灣大學有超過3萬名學生及5千名國際學生，新型冠狀病毒疫情影響許多學生返校就學之計劃。」臺灣大學表示：「感謝訊連科技提供的『U簡報』及『U會議』服務，透過直播及視訊會議，可為教師及學生於防疫時期，打造即時、高效的線上教學方式。」

訊連科技「U 簡報」可提供高達500人同時上課的線上直播。教師端可透過個人電腦，整合簡報、視訊、語音及白板進行課程直播。學生端可使用個人電腦或手機觀看課程直播，並於課程中利用文字討論區進行提問互動。訊連科技「U 會議」的線上會議室可提供高達100人參與會議，適合進行小班教學或透過螢幕分享方式進行小組討論。

「訊連『U簡報』設計的理念是提供講師輕鬆上手、學生容易觀看及提問的使用經驗，透過網路直播，打破實體授課的地理限制。」訊連科技黃肇雄執行長表示：「防疫是台灣各界齊心努力的課題，訊連很榮幸能為防疫盡一份心力，協助臺大在防疫時期，使用遠距教學及視訊會議來解決學生無法返校就學的難題。」

此次訊連科技採捐贈方式，提供台灣大學等值兩百萬台幣的「U 簡報」及「U 會議」服務。此外，訊連科技也推出「U 校園防疫免費專案」，即日起至2020年7月31日止，各大專院校可於U官方網站提出申請。

關於訊連科技U整合通訊服務 訊連科技「U 簡報」、「U 會議」及「U 通訊」整合了遠距直播、視訊會議及即時通訊等功能，為企業及教育機構打造即時、跨國界、跨平台、行動優先、高影音品質之新世代視訊溝通服務。更多資訊，請洽：https://u.cyberlink.com/


關於Version 2
Version 2 是亞洲最有活力的IT公司之一，公司發展及代理各種不同的互聯網、資訊科技、多媒體產品，其中包括通訊系統、安全、網絡、多媒體及消費市場產品。透過公司龐大的網絡、銷售點、分銷商及合作夥伴，Version 2 提供廣被市場讚賞的產品及服務。Version 2 的銷售網絡包括中國大陸、香港、澳門、臺灣、新加坡等地區，客戶來自各行各業，包括全球1000大跨國企業、上市公司、公用機構、政府部門、無數成功的中小企及來自亞洲各城市的消費市場客戶。

關於CyberLink
訊連科技創立於1996年，擁有頂尖視訊與音訊技術的影音軟體公司，專精於數位影音軟體及多媒體串流應用解決方案產品研發，並以「抓準技術板塊，擴大全球行銷布局」的策略，深根台灣、佈局全球，展現亮麗的成績。訊連科技以先進的技術提供完美的高解析影音播放效果、以尖端的科技提供完整的高解析度擷取、編輯、製片及燒錄功能且完整支援各種高解析度影片及音訊格式。產品包括：「威力導演」、「PowerDVD」、「威力製片」、「威力酷燒」等。