Kr00k is a serious Wi-Fi vulnerability which can trick a device to retransmit the last 32k of encrypted traffic with an encryption key of all zeros.
The flaw affects devices using Wi-Fi chips from Broadcom and Cypress including Apple devices, Amazon Echo and Google Nexus devices.
The bug can be triggered when a device disconnects from a Wi-Fi network (called disassociation in the protocol). When this happens the encryption key for that session is wiped and set all to zeros. However, any data that is still present in the chip’s transmission buffer (up to 32k of data) is retransmitted and because the encryption key is set to zeros the attacker can decrypt the data. The client device will then automatically attempt to re-associate with the Wi-Fi network and continue operating as normal.
An attacker can exploit this flaw by transmitting rogue dissociation commands to a client on the Wi-Fi network which will trigger the retransmission of the last data from the client in the clear. Since the disassociation commands are not encrypted or authenticated, it is a relatively trivial task for the attacker to transmit them. By forcing repeated disassociations the attacker could capture many buffers worth of data.
Tracked as CVE-2019-15126 many manufacturers have already issued patches for the vulnerability.
Discovered by researchers at ESET, the Kr00k vulnerability is described in detail in their white paper.
“We were very impressed with the service, I will say, the vulnerability found was one our previous organisation had not picked up, which does make you wonder if anything else was missed.”
Aim Ltd Chief Technology Officer (CTO)