« previous next »
Pages: [1] 2   Go Down

Author Topic: Vera vulnerable to Wi-Fi Krack exploit?  (Read 2463 times)

Offline anthonyris

  • Sr. Member
  • ****
  • Posts: 250
  • Karma: +6/-1
Vera vulnerable to Wi-Fi Krack exploit?
« on: October 17, 2017, 11:38:25 pm »
I must assume the MCV folks are aware of the Wi-Fi issue. Any news on a patch?
Logged
Vera3x2, Leviton, GE dimmers, relays and lamp modules, Sonos, Nests...

Offline BOFH

  • Sr. Hero Member
  • ******
  • Posts: 2409
  • Karma: +112/-140
Re: Vera vulnerable to Wi-Fi Krack exploit?
« Reply #1 on: October 18, 2017, 08:39:15 am »
The issue is not so much with Vera as it is with the WPA/WPA2 encryption protocol. Which is part of the underlaying OpenWRT OS that MIOS runs on.
Logged
Vera3 UI5 UI7 Edge Plus
Trane TZEMT400AB32 | Schlage BE369 FE599 | GE 45601 45602 45603 45604 45606 45609 45631 | Intermatic HA01C HA03C HA05C HA07C CA600 CA3000 | Aeon DSC06106 | Telguard GDC1 | Foscam FI8910W FI8905W FI9821W | D-Link 930L | Wanscam JW0011 | ZModo ZPIBH13W

Offline akbooer

  • Beta Testers
  • Master Member
  • *****
  • Posts: 6337
  • Karma: +288/-70
  • "Less is more"
Re: Vera vulnerable to Wi-Fi Krack exploit?
« Reply #2 on: October 18, 2017, 09:00:54 am »
TBH, this is really the least of your worries with Vera, because of the very sloppy approach to secure handling of data and the inherent vulnerabilities of UPnP.
Logged
3x Vera Lite-UI5/Edge-UI7, 25x Fibaro, 23x TKB, 9x MiniMote, 2x NorthQ Power, 2x Netatmo, 1x Foscam FI9831P, 9x Philips Hue,
Razberry, MySensors Arduino, HomeWave, AltUI, AltHue, DataYours, Grafana, openLuup, ZWay, ZeroBrane Studio.

Offline RichardTSchaefer

  • Community Beta
  • Master Member
  • ******
  • Posts: 10091
  • Karma: +764/-143
Re: Vera vulnerable to Wi-Fi Krack exploit?
« Reply #3 on: October 18, 2017, 11:04:08 am »
The fix is for clients that attach to a WIFI hotspot ...
If you connect your Vera via WIFI you are vulnerable ... Use a wired connection!
There are LOTS of wifi devices in my house ... that I doubt I can get software updates for.
The software in Vera is VERY OLD ...
It's based on the OpenWRT Barrier Breaker release from the end of 2014.



Logged

Offline futzle

  • Beta Testers
  • Master Member
  • *****
  • Posts: 3260
  • Karma: +192/-9
Re: Vera vulnerable to Wi-Fi Krack exploit?
« Reply #4 on: October 18, 2017, 05:19:10 pm »
The latest OpenWrt (15.05.1) is also vulnerable to KRACK. You would need to move to the fork of OpenWrt, LEDE, release 17.01.4, to have the version of hostapd/wpad/wpa-supplicant that is patched against KRACK.

I don?t see Vera doing this TBH.
Logged

Offline BOFH

  • Sr. Hero Member
  • ******
  • Posts: 2409
  • Karma: +112/-140
Re: Vera vulnerable to Wi-Fi Krack exploit?
« Reply #5 on: October 18, 2017, 05:43:55 pm »
I have WiFi switched off on my Vera's as I have an existing WiFi setup already. Running DD-WRT so I'm keeping an eye out for a patched version of that.  It has a whitelisted MAC table, which although not foolproof (MAC spoof anyone) will make it a bit more time-consuming. Hopefully giving my IDS enough time to catch on and have it tell the gateway to drop the LAN port for the WiFi network and send me an alert.
Logged
Vera3 UI5 UI7 Edge Plus
Trane TZEMT400AB32 | Schlage BE369 FE599 | GE 45601 45602 45603 45604 45606 45609 45631 | Intermatic HA01C HA03C HA05C HA07C CA600 CA3000 | Aeon DSC06106 | Telguard GDC1 | Foscam FI8910W FI8905W FI9821W | D-Link 930L | Wanscam JW0011 | ZModo ZPIBH13W

Offline Alex Waverley

  • Jr. Member
  • **
  • Posts: 62
  • Karma: +4/-0
Re: Vera vulnerable to Wi-Fi Krack exploit?
« Reply #6 on: October 18, 2017, 11:04:24 pm »
I wouldn't stress out too much. How valuable is the information that is being sent to and from Vera via wifi? Valuable enough for someone to take the trouble of sitting within range of your wifi connection to monitor and intercept it? I hope not. VERA and products like it are toys and should never be used for anything beyond the trivial.

I don't send any information that is worth a plug nickel to anyone via wifi .  I have a few devices that can initiate scenes, but that's about it. S.P.E.C.T.R.E. or T.H.R.U.S.H. would be profoundly disappointed in the extortion opportunities provided by gaining control of my kitchen light. In other words,  the best security system is not being a valuable target in the first place.
Logged
Please hold your applause until I have concluded my remarks.

Offline BOFH

  • Sr. Hero Member
  • ******
  • Posts: 2409
  • Karma: +112/-140
Re: Vera vulnerable to Wi-Fi Krack exploit?
« Reply #7 on: October 19, 2017, 09:09:22 am »
I'm not really worried. As I said Vera's WiFi is off. As for my WiFi network, I'm hoping for a patch for DD-WRT soon so I can plug the hole but I'm not sweating it. If someone sits on the street in front of my house in a car, my K9 security system will detect that and alert. Since I have a camera on them, I'm pretty sure I will notice their behaviour. I also have a camera aimed down my drive so I would be able to see Mr. or Mrs.B. Hat and catch them in the act. :-) Easy enough to SSH into my home server and drop the WiFi LAN port to stop their game.
Logged
Vera3 UI5 UI7 Edge Plus
Trane TZEMT400AB32 | Schlage BE369 FE599 | GE 45601 45602 45603 45604 45606 45609 45631 | Intermatic HA01C HA03C HA05C HA07C CA600 CA3000 | Aeon DSC06106 | Telguard GDC1 | Foscam FI8910W FI8905W FI9821W | D-Link 930L | Wanscam JW0011 | ZModo ZPIBH13W

Offline akbooer

  • Beta Testers
  • Master Member
  • *****
  • Posts: 6337
  • Karma: +288/-70
  • "Less is more"
Re: Vera vulnerable to Wi-Fi Krack exploit?
« Reply #8 on: October 19, 2017, 09:46:17 am »
Quote
How valuable is the information that is being sent to and from Vera via wifi? Valuable enough for someone to take the trouble of sitting within range of your wifi connection to monitor and intercept it? I hope not.

Probably more than enough to tell whether you're in or out...
Logged
3x Vera Lite-UI5/Edge-UI7, 25x Fibaro, 23x TKB, 9x MiniMote, 2x NorthQ Power, 2x Netatmo, 1x Foscam FI9831P, 9x Philips Hue,
Razberry, MySensors Arduino, HomeWave, AltUI, AltHue, DataYours, Grafana, openLuup, ZWay, ZeroBrane Studio.

Offline aa6vh

  • Hero Member
  • *****
  • Posts: 637
  • Karma: +15/-0
Re: Vera vulnerable to Wi-Fi Krack exploit?
« Reply #9 on: October 19, 2017, 10:45:20 am »
Quote from: akbooer on October 19, 2017, 09:46:17 am
Probably more than enough to tell whether you're in or out...

Or they could just knock on the door....  (and yes, that has happened to me.)

All of the local bad guys that I am aware of do not have the smarts to perform computer hacking.
Logged

Offline BOFH

  • Sr. Hero Member
  • ******
  • Posts: 2409
  • Karma: +112/-140
Re: Vera vulnerable to Wi-Fi Krack exploit?
« Reply #10 on: October 19, 2017, 12:38:33 pm »
Like I said, I have a K9 security system which is quite capable of handling physical break-ins.  8)
Logged
Vera3 UI5 UI7 Edge Plus
Trane TZEMT400AB32 | Schlage BE369 FE599 | GE 45601 45602 45603 45604 45606 45609 45631 | Intermatic HA01C HA03C HA05C HA07C CA600 CA3000 | Aeon DSC06106 | Telguard GDC1 | Foscam FI8910W FI8905W FI9821W | D-Link 930L | Wanscam JW0011 | ZModo ZPIBH13W

Offline Sorin

  • Administrator
  • Hero Member
  • *****
  • Posts: 1114
  • Karma: +99/-11
Re: Vera vulnerable to Wi-Fi Krack exploit?
« Reply #11 on: October 19, 2017, 02:39:54 pm »
Hello guys, wanted to ping in, and tell that, this is looked for as I speak.

« Last Edit: October 19, 2017, 05:02:20 pm by John M. »
Logged
Sorin M. ▾ Community Manager
Vera Control, Ltd. ▾ Smarter Home Control  ▾ support@getvera.com ▾www.getvera.com ▾ +1 (866) 966-2272

HOURS OF OPERATION for Customer Care Department - 24/7

Offline RichardTSchaefer

  • Community Beta
  • Master Member
  • ******
  • Posts: 10091
  • Karma: +764/-143
Re: Vera vulnerable to Wi-Fi Krack exploit?
« Reply #12 on: October 19, 2017, 05:00:39 pm »
@BOFH ...
Have your trained your K9s for cyber security ?
Logged

Offline BOFH

  • Sr. Hero Member
  • ******
  • Posts: 2409
  • Karma: +112/-140
Re: Vera vulnerable to Wi-Fi Krack exploit?
« Reply #13 on: October 19, 2017, 06:41:59 pm »
@Richard: Now there's an idea... For now they just handle the physical side. I wonder if Alexa understands dog so they could bark at her to get stuff done. :)
Logged
Vera3 UI5 UI7 Edge Plus
Trane TZEMT400AB32 | Schlage BE369 FE599 | GE 45601 45602 45603 45604 45606 45609 45631 | Intermatic HA01C HA03C HA05C HA07C CA600 CA3000 | Aeon DSC06106 | Telguard GDC1 | Foscam FI8910W FI8905W FI9821W | D-Link 930L | Wanscam JW0011 | ZModo ZPIBH13W

Offline Alex Waverley

  • Jr. Member
  • **
  • Posts: 62
  • Karma: +4/-0
Re: Vera vulnerable to Wi-Fi Krack exploit?
« Reply #14 on: October 20, 2017, 05:50:15 pm »
Quote from: akbooer on October 19, 2017, 09:46:17 am
Quote
How valuable is the information that is being sent to and from Vera via wifi? Valuable enough for someone to take the trouble of sitting within range of your wifi connection to monitor and intercept it? I hope not.

Probably more than enough to tell whether you're in or out...

It shouldn't be. I keep my security system and automation devices separated. Same with my cameras. Vera can close my garage door but the trigger runs through a reed switch so it it physically isolated if the door is closed. My cameras are hard-wired on an isolated subnet and I use a physical contact closure to activate panic lighting via the alarm. Vera and products like it are not security or life safety devices and should not be relied upon for critical functions.

Just my two cents. Which I intend to keep safe.
Logged
Please hold your applause until I have concluded my remarks.
Pages: [1] 2   Go Up
« previous next »