FragAttacks: New Security Vulnerabilities Affecting WiFi Devices, 12 CVEs Issued

[phoronix]

Phoronix: FragAttacks: New Security Vulnerabilities Affecting WiFi Devices, 12 CVEs Issued

FragAttacks was made public on Tuesday as a set of new security vulnerabilities affecting WiFi devices. These are just not some driver-level bugs but rather three of the vulnerabilities are attributed as design flaws in the WiFi standard itself and in turn most devices on the market...

https://www.phoronix.com/scan.php?page=news_item&px=FragAttacks

[gigi]

within radio range of a victim can abuse these vulnerabilities to steal user information or attack devices.

all most all government law enforcement agencies and private sector happily "steal user information". i suspect very few who had grudge adopted "attack devices"

caused by widespread programming mistakes in Wi-Fi products.

its a norm now....

[jo-erlend]

Well, that's a little scary.

[jntesteves]

all most all government law enforcement agencies and private sector happily "steal user information". i suspect very few who had grudge adopted "attack devices"

You know it's not called "stealing" when you consent.

[Dr.N0]

You know it's not called "stealing" when you consent.

I agree, but can you really consent in those cases with the lack or obfuscation of information and the power dynamics at play?

[loganj]

why does it feels like its more like a normal spam mail attack than a wireless attack?

[birdie]

Nothing that can affect me even if I disable WPA2 on my WiFi router completely and turn it into an open access point.

For DNS I've been using DOT/DOH for many years now.
I barely visit any HTTP websites - In fact I don't remember the last time I visited an HTTP website.

I don't use any plain text Internet protocols either. And this attack doesn't allow you to guess a WiFi password though if the user accesses their WiFi router via HTTP, you can potentially hack the device - only most users rarely if ever do that.

[alcalde]

all most all government law enforcement agencies and private sector happily "steal user information".

1. Biden won the election.
2. The Earth is not flat.
3. Non-dictatorships don't "steal user information".

If you have evidence of information being stolen, please forward it to your attorney general immediately for investigation and prosecution.

[kozman]

Joy. Another thing to worry about. And how many billion WiFi devices are out there with EOL long in the rear view mirror and no Merlin or other homebrew alternative to fix it? Even if they fix it, this is the new Spectre. Everyone and their mom is now going to be digging even deeper to find / fix the vulns not yet discovered / disclosed. But do you hear that? That's the sound of thousands of cash registers ringing with users panic upgrading in *hope* that the vendor can fix this. =\

[extremesquared]

...forward it to your attorney general immediately for investigation and prosecution.

In the US, most AGs are elected by the same voting pool that elects mayors. Expectation of corruption for these two positions is so high that our society has transitioned from being angry about it to lampooning the consistency of it.