Page 2 of 2 FirstFirst 1 2
Results 11 to 17 of 17
  1. #11
    TeamROG Moderator Array xeromist PC Specs
    xeromist PC Specs
    Laptop (Model)G73JH, Lenovo Y500 SLI
    MotherboardASUS Maximus IV GENE-Z
    ProcessorIntel 2600K
    Memory (part number)16GB DDR3 1600
    Graphics Card #1GTX980
    MonitorBenQ BL3200PT
    Storage #1Patriot PyroSE SSD
    CPU CoolerCustom WC loop
    Casecustom Antec 900
    Power SupplyCorsair HX1000
    Keyboard Logitech Orion Spark
    Mouse Logitech MX500
    Headset Plantronics 777 with Oregon Aero upgrade
    xeromist's Avatar
    Join Date
    Jul 2010
    Reputation
    245
    Posts
    6,947

    Quote Originally Posted by Korth View Post
    I think attempts are always made to keep platform security vulnerabilities under the radar.
    Not exactly. The whole point of coordinated disclosure is to make vulnerabilities public. It just does it in a "responsible" way that provides a reasonable opportunity for vendors to patch before disclosure. The fact that you don't see it on the evening news isn't due to any attempt to sweep it under the rug, just that the average person finds IT security boring. It doesn't sell advertisements unless it's particularly dramatic like Equifax. Even then it's dumbed down quite a bit.

    And I guarantee that the current system isn't keeping any blackhats in the dark. Even once patches are available blackhats know that people won't patch. Exploits are often developed by reverse engineering patches. Obviously a zero-day is the holy grail but an existing vulnerability with low patch application isn't bad.
    * Support disease research with Folding@Home *

    < < < Click the drop-down above my avatar for my PC specs!

  2. #12
    ROG Guru: Black Belt Array Korth PC Specs
    Korth PC Specs
    MotherboardASUS X99 R5E (BIOS2101/1902)
    ProcessorHaswell-EP E5-1680-3 SR20H/R2 (4.4GHz)
    Memory (part number)Vengeance LPX 4x8GB SS DDR4-3000 (CMK32GX4M4C3000C15)
    Graphics Card #1NVIDIA Quadro GP100GL/16GB, 16xPCIe3, NVLink1 (SLI-HB)
    Graphics Card #2NVIDIA Quadro GP100GL/16GB, 16xPCIe3, NVLink1 (SLI-HB)
    Sound CardJDS Labs O2+ODAC (RevB), USB2 UAC1
    MonitorASUS PG278Q
    Storage #1Samsung 850 PRO 512GB SSDs, 4xSATA3 RAID0
    Storage #2Comay BladeDrive E28 3200GB SSD, 8xPCIe2
    CPU CoolerRaijintek NEMESIS/TISIS, AS5, 2xNH-A14
    CaseObsidian 750D (original), 6xNH-A14
    Power SupplyZalman/FSP ZM1250 Platinum
    Headset Pilot P51 PTT *modded*
    OS Arch, Gentoo, Win7x64, Win10x64
    Network RouterActiontec T3200M VDSL2 Gateway
    Accessory #1 TP-Link AC1900 Archer T9E, 1xPCIe
    Accessory #2 ASUS/Infineon SLB9635 TPM (TT1.2/FW3.19)
    Accessory #3 ASUS OC Panel I (FW0501)
    Korth's Avatar
    Join Date
    Mar 2015
    Reputation
    152
    Posts
    2,641

    @haihane -

    Put out the spark by pouring gasoline on it ... counterintuitive but I agree it can sometimes prove highly effective at motivating results. The momentum of psychological imperative. Ready Fire Aim philosophy. I'm not entirely convinced it's a good approach for every situation, it carries a slight wafting whiff of anti-intellectualism, lol.

    But I don't think it's an approach which would convince large organizations. They always resist relinquishing control to the dirty uneducated mob, lol. Got a security breach, don't call in the helicopters and dogs and searchlights ... instead call in something more subtle like Bond, James Bond.
    "All opinions are not equal. Some are a very great deal more robust, sophisticated and well supported in logic and argument than others." - Douglas Adams

    [/Korth]

  3. #13
    TeamROG Moderator Array xeromist PC Specs
    xeromist PC Specs
    Laptop (Model)G73JH, Lenovo Y500 SLI
    MotherboardASUS Maximus IV GENE-Z
    ProcessorIntel 2600K
    Memory (part number)16GB DDR3 1600
    Graphics Card #1GTX980
    MonitorBenQ BL3200PT
    Storage #1Patriot PyroSE SSD
    CPU CoolerCustom WC loop
    Casecustom Antec 900
    Power SupplyCorsair HX1000
    Keyboard Logitech Orion Spark
    Mouse Logitech MX500
    Headset Plantronics 777 with Oregon Aero upgrade
    xeromist's Avatar
    Join Date
    Jul 2010
    Reputation
    245
    Posts
    6,947

    Quote Originally Posted by Korth View Post
    Put out the spark by pouring gasoline on it
    That's not the only reason. There's an ongoing debate about the most responsible way to deal with vulnerabilities. There are many who believe the public has a right to know as soon as a vulnerability is discovered. That way people can adapt and avoid while a patch is developed. Imagine getting breached and then finding out the vendor knew but didn't warn you. That would be frustrating to say the least.

    Immediate disclosure ignores nuance and human behavior though. It might work for something like a browser flaw that can be avoided by changing browsers but is impractical for something like an OS flaw where most people don't have the wherewithal to switch. And practically speaking people won't even change browsers because they are mostly unaware or just stubborn. So in an imperfect world full of security illiterates coordinated disclosure is probably as good as it gets.
    * Support disease research with Folding@Home *

    < < < Click the drop-down above my avatar for my PC specs!

  4. #14
    ROG Guru: Black Belt Array Korth PC Specs
    Korth PC Specs
    MotherboardASUS X99 R5E (BIOS2101/1902)
    ProcessorHaswell-EP E5-1680-3 SR20H/R2 (4.4GHz)
    Memory (part number)Vengeance LPX 4x8GB SS DDR4-3000 (CMK32GX4M4C3000C15)
    Graphics Card #1NVIDIA Quadro GP100GL/16GB, 16xPCIe3, NVLink1 (SLI-HB)
    Graphics Card #2NVIDIA Quadro GP100GL/16GB, 16xPCIe3, NVLink1 (SLI-HB)
    Sound CardJDS Labs O2+ODAC (RevB), USB2 UAC1
    MonitorASUS PG278Q
    Storage #1Samsung 850 PRO 512GB SSDs, 4xSATA3 RAID0
    Storage #2Comay BladeDrive E28 3200GB SSD, 8xPCIe2
    CPU CoolerRaijintek NEMESIS/TISIS, AS5, 2xNH-A14
    CaseObsidian 750D (original), 6xNH-A14
    Power SupplyZalman/FSP ZM1250 Platinum
    Headset Pilot P51 PTT *modded*
    OS Arch, Gentoo, Win7x64, Win10x64
    Network RouterActiontec T3200M VDSL2 Gateway
    Accessory #1 TP-Link AC1900 Archer T9E, 1xPCIe
    Accessory #2 ASUS/Infineon SLB9635 TPM (TT1.2/FW3.19)
    Accessory #3 ASUS OC Panel I (FW0501)
    Korth's Avatar
    Join Date
    Mar 2015
    Reputation
    152
    Posts
    2,641

    That seems like a controversial debate over ethics, freedoms, and censorship. Not technology, business, or security.

    Coordinated disclosure does seem wise and necessary and productive. When disclosed to experts who are positioned to properly address things. Not when disclosed to windowscentral and androidcentral and macrumours, lol. Even freedom has its limits, your freedom usually ends where the other guy's freedom starts ... I'd personally feel more "secure" knowing that the people who "need to know" are able to know while the people who want to hack my network are kept in the dark, it just seems like the more sensible and responsible and actually *secure* approach to security.

    The blackhats do outnumber the whitehats after all.
    "All opinions are not equal. Some are a very great deal more robust, sophisticated and well supported in logic and argument than others." - Douglas Adams

    [/Korth]

  5. #15
    ROG Enthusiast Array
    Join Date
    Aug 2012
    Reputation
    20
    Posts
    53

    As my understanding it mainly affect client, except the CVE 2017-13082 (related to 802.11r) affect an AP, so if the router don't work as a client, or don't use 802.11r I think it will be safe.
    Please correct me if I am wrong.

  6. #16
    ROG Member Array
    Join Date
    Nov 2012
    Reputation
    10
    Posts
    17

    KRACK has multiple CVE vulnerabilities associated with it. Patch everything, especially devices, access points, and notably android . The best article for overall information out there will be on krebsonsecurity.com ...this has some really good, well written information

    https://krebsonsecurity.com/2017/10/...rity-weakness/

    This is from US CERT on KRACK

    The following CVE IDs have been assigned to document these vulnerabilities in the WPA2 protocol:
    CVE-2017-13077: reinstallation of the pairwise key in the Four-way handshake
    CVE-2017-13078: reinstallation of the group key in the Four-way handshake
    CVE-2017-13079: reinstallation of the integrity group key in the Four-way handshake
    CVE-2017-13080: reinstallation of the group key in the Group Key handshake
    CVE-2017-13081: reinstallation of the integrity group key in the Group Key handshake
    CVE-2017-13082: accepting a retransmitted Fast BSS Transition Reassociation Request and reinstalling the pairwise key while processing it
    CVE-2017-13084: reinstallation of the STK key in the PeerKey handshake
    CVE-2017-13086: reinstallation of the Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) key in the TDLS handshake
    CVE-2017-13087: reinstallation of the group key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame
    CVE-2017-13088: reinstallation of the integrity group key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame

    All of these weaknesses will start showing up in devices. Anything with a nic and an ip address essentially using wifi could be vulnerable. The only way to really know comprehensively is run a vulnerability scan and see what pops up...download a free copy of nessus vulnerability scanning software. IOT devices, your tv, refrigerator, nest camera system, will end up being vulnerable to this too...and many will never get patched.
    Last edited by gqchicago; 10-19-2017 at 12:06 AM.

  7. #17
    Administrator Array MasterC@ASUS's Avatar
    Join Date
    Aug 2014
    Reputation
    95
    Posts
    1,235

    Quote Originally Posted by arabesc View Post
    What is the ASUS position on the KRACK exploit?
    Are ASUS routers vulnerable to it? Are you going to provide fixes?
    Hi arabesc,

    ASUS is aware of the recent WPA2 vulnerability issue. We take security and your privacy seriously, so we are working towards a solution as quickly as possible. In the meantime, we want to help clarify the severity of the potential threat, and let our valued customers know the appropriate steps to take in order to avoid being compromised.

    Your devices are only vulnerable if an attacker is in physical proximity to your wireless network. We are co-working with chipset vendors and will release patched firmware for affected routers soon. Before new firmware is released, here are a few ways to stay safe:
    (1) Only visit HTTPS websites.
    (2) Keep your operating system and antivirus software up-to-date.
    (3) When in doubt, be safe and use your cellular network or a wired connection (Ethernet) to access the internet.

Page 2 of 2 FirstFirst 1 2

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •