In response to the WPA2 vulnerability made public last week, a new firmware patching ST’s SPWF04 Wi-Fi module will be available for download on the company’s website in a couple of weeks. We will also update this post as soon as the file is available and we invite our community and partners to check the Life.Augmented Blog for more information.
The news of the security flaw shook the tech community because it opened millions of devices to attacks, and its effects will resonate for years to come. “We’re probably still going to find vulnerable devices 20 years from now” according to a security researcher interviewed by Wired. However, given ST’s dedication to security, it is no surprise that the company developed a fix less than 24 hours after the announcement and that all its customers will have access to it shortly, pending final testing procedures.
What’s Wrong and How Bad Is It?
Dubbed KRACK, or Key Reinstallation AttaCK, the vulnerability is a proof-of-concept published by Mathy Vanhoef and Frank Piessens, scholars at the University of Leuven, Belgium. At its core, it relies on multiple flaws found in WPA2’s four-way handshake, a procedure that uses four messages to define the shared encryption key the access point and client device will use during their exchanges. Utilizing a man-in-the-middle attack, hackers can fool the access point into thinking the client hasn’t received the third message that’s responsible for installing the key on the client device. As a result, the client will keep on reinstalling an already used key, compromising the security of the exchanges between the user terminal and the access point.
Because attackers can force the system to use the same key, they can start to determine what it is and use it to decrypt packets traveling on the network, or even inject data, unbeknownst to the client. For instance, users could be vulnerable to hackers intercepting financial data and diverting transactions to their bank accounts. Because the flaw is in the Wi-Fi protocol itself, all devices on the network are potentially vulnerable. However, Wi-Fi clients are more at risk because of the potential damage users could suffer from traffic manipulation.
How to Protect Yourself?
- Update all devices. The new SPWF04 firmware will be available very soon, but customers must still deploy it to their end users as quickly as possible to take advantage of it. This typically means integrating the new microcode in the company’s codebase and deploying it to the end users by either physically connecting the device to install the new software or using an Over-The-Air (OTA) update. Indeed, thanks to the SPWF04 integrated TCP/IP stack, every module could connect to a remote web server and automatically download the patched code via a secure TLS layer as long as the device’s manufacturer built the feature in its application. Furthermore, it’s also important to teach the public that all terminals on the network must receive a patch, not just the client device using the ST module.
- Use multiple layers of encryption. As explained above, KRACK intercepts and decrypts the packets transmitted on the network. However, if the content residing in the packets is itself encrypted, hackers won’t be able to read it. Using HTTPS (HTTP over TLS layer) or a secure VPN could prove highly useful. These solutions aren’t silver bullets as they have their issues, but they could be an essential part of the security policy of a company.
- Segment your networks. Smart industries and businesses should use multiple networks. Creating silos reduces the risk of massive leaks if one of them fails. It may also be essential to use different network protocols (Ethernet, sub-gigahertz, Bluetooth Mesh), to rely on other options when one is no longer reliable.
- Control who can access your Wi-Fi network. KRACK requires hackers to be near a network to intercept it. Companies should thus monitor, as much as possible, the people on the premises and limit the geographical availability of the system.
How Not to Panic?
Companies and end users must keep using WPA2 and a strong password. As we’ve seen above, KRACK can decrypt packets without knowing the Wi-Fi password or any shared key exchanged during the handshake. As a result, changing a password won’t protect a network against it. However, it’s still better to use a WPA2 connection than all the other methods available today, and a long and intricate password is always better than something that’s easily hackable through social engineering or brute force.- Assess the sensitivity of the information transmitted and respond accordingly. Some IoT devices transmit trivial details, like the status of a lightbulb, or the temperature of a room. In these situations, an attack is less likely, as the information is not worth the trouble to get it, and although a patch is still essential, a vulnerable device will not trouble the vast majority of users. However, in more sensitive cases, like connected security cameras, it’s important that the end user receives an alert explaining the risks, and that companies quickly deploy a patch.
Why the SPWF04 Is the Smarter Choice?
KRACK reminds us of one important principle: never rely on a single security protocol to secure your information, which is why the SPWF04 module is such a smart choice. As we already explained on the blog, the Wi-Fi module is optimized for security, thanks to a crypto-core accelerating AES–256 operations as well as many other cryptographic algorithms. The firmware also includes an SSL/TLS stack developed by a third-party and available freely to all customers using the SPWF04 since there are no licensing fees. This setup also ensures that if a flaw is found in the protocol, ST can quickly move to a new version and make it quickly available to all its clients. Furthermore, a MicroPython scripting engine helps engineers develop secure and feature-rich applications that can run on the module itself, thanks to its STM32F439 microcontroller (MCU).
There are also so many other security initiatives at ST. MCUs, such as the STM32H7, include great cryptographic accelerators to reduce the impact associated with these types of calculations, and ST just released Telemaco3P, its first Telematics processor with a Hardware Security Module (HSM). The company even offers libraries, like Cryptolib, to help engineers implement cryptographic methods and certify their products. Ultimately, security remains an extremely high priority for ST, which explains why the SPWF04 patch is coming so soon, and why the company will also provide a new firmware for its first Wi-Fi module, the SPWF01, launched in 2013, thus ensuring that all its Wi-Fi board can withstand an attack. The new microcode for the older module will be available for download early 2018.
