Security flaws in components, communications, or protocols most commonly used in the industry can have disastrous consequences. Experts in ethical hacking from security firm ESET reported the finding of a critical vulnerability in multiple WiFi chips that causes exposed devices to use an all-zero encryption key to encrypt some of the users’ communications. According to the report, successful exploitation of this flaw would allow a threat actor to decrypt some network packets transmitted via the vulnerable device.
The vulnerability, tracked as CVE-2019-15126, is present on devices
with Broadcom and Cypress WiFi chips with no updates. It should be noted that
these chips are the most used by manufacturers of WiFi-capable devices, such as
of Things (IoT) devices, laptops, tablets and more. The flaw was dubbed
by ESET researchers.
In addition, the flaw does not only affect
customer devices, but extends to Broadcom WiFi access points and chip routers, so
business and government environments could also be affected.
Regarding the affected devices, ethical hacking
specialists say that many of today’s most employed technology developments are
vulnerable to these flaws. Affected devices include manufacturers such as:
(Echo & Kindle)
(iPhone, iPad, MacBook)
The flaw affects WPA2-Personal and
WPA3-Enterprise protocols, with AES-CCMP encryption. According to the
researchers’ estimates, more than one billion actively used devices worldwide
would be exposed to the exploitation of KrØØk, and that’s just users’ devices;
the compromised access points’ calculation is still missing.
Ethical hacking specialists say this flaw is related to key reinstallation attacks (KRACK), detected a couple of years ago, albeit with some key differences. “Initially, we found that KrØØk was one of the possible causes of the KRACK attacks, thanks to the finding of a vulnerability in Amazon Echo,” the ESET report mentions.
The International Institute of Cyber Security (IICS)
mentions that the flaw was reported to affected manufacturers in a timely
manner, so updates must already have been installed on most vulnerable devices.
Users are encouraged to verify that there are no pending updates for their