1. InfoconDB
  2. Black Hat
  3. Black Hat Asia 2020 Virtual
  4. Kr00k: How KRACKing Amazon Echo Exposed a Billion+ Vulnerable Wi-Fi Devices

Kr00k: How KRACKing Amazon Echo Exposed a Billion+ Vulnerable Wi-Fi Devices

Presented at Black Hat Asia 2020 Virtual, Oct. 2, 2020, 2:20 p.m. (40 minutes).

We have identified serious security weaknesses in chipsets used by a significant number of Wi-Fi capable devices. Specifically, we discovered that FullMAC Wi-Fi chipsets by Broadcom/Cypress – and possibly other manufacturers – are vulnerable to encrypting packets in a WPA2-protected network with an all-zero encryption key. In a successful attack, this allows an adversary to decrypt some wireless network packets. The number of affected devices is likely over a billion including devices by Apple, Samsung, Amazon, and others that use the vulnerable chipsets.

The chipset-level, all-zero-key vulnerability has been assigned CVE-2019-15126. For easier reference and distinction from previous research, we dubbed it Kr00k.

Our research began with the discovery that some versions of the popular Amazon Echo and Kindle devices were vulnerable to Key Reinstallation Attacks (KRACK). After reporting that to Amazon, we investigated further, also looking into the all-zero encryption key modification of KRACK. Further vulnerable devices were discovered, reported and patched by the vendor.

But the most significant finding was that the crux is not in software, but in the hardware – the Wi-Fi chipsets themselves. Hence, the issue affects a much wider range of devices. We will detail our responsible disclosure process and how we successfully cooperated with Amazon while it prepared patches.

The presentation will include technical details and a demonstration, where we will show how we were able to trigger a reassociation to set an all-zero encryption key and decrypt intercepted packets.

We will also discuss the potential impact of these vulnerabilities, along with the limitations of exploiting them.


Presenters:

  • Stefan Svorencik - Senior Detection Engineer, ESET
    Stefan Svorencik is a Senior Detection Engineer in ESET's Security Research Laboratory, with more than 10 years experience with malware, vulnerability, and exploit research. He currently leads the Experimental Research and Detection Team at ESET headquarters in Bratislava, which focuses on vulnerability research and advanced detection methods.
  • Robert Lipovsky - Senior Malware Researcher, ESET
    Robert Lipovsky is a Senior Malware Researcher for ESET, with 12 years' experience in cybersecurity. He is responsible for threat intelligence and malware analysis and leads the Malware Research Team at ESET headquarters in Bratislava. He is a regular speaker at security conferences, including Black Hat USA, RSAC, Virus Bulletin, Gartner Security & Risk Management Summit, Hacktivity, c0c0n, Code Blue, AVAR, and various NATO-organized conferences. He also teaches reverse engineering at the Slovak University of Technology – his alma mater, and at Comenius University. When not bound to a keyboard, he enjoys traveling, playing guitar and flying single-engine airplanes.

Links:

Similar Presentations: