Thursday, March 28, 2024

Wi-Fi Bug in Millions of Amazon Echo and Kindle Devices Let Attackers Steal Sensitive Details

The KRACK attack was published by two Belgian researchers in October 2017. The attacks are based on the weaknesses in the WPA2 protocol used in modern Wi-Fi devices.

The weakness can be exploited by the attackers using key reinstallation attacks if the victim resides within the network. Successful exploitation of the attack allows attackers to steal sensitive details such as credit card numbers, passwords, chat messages, emails, photos, and so on.

KRACK in Amazon Echo & Kindle

Amazon Echo and Kindle devices are so popular and they are used by Millions of users around the globe. ESET Smart Home researchers observed that Amazon Echo and Kindle devices are vulnerable to KRACK attacks.

Researchers tested the 1st generation of the Amazon Echo devices with original Amazon Alexa and the 8th generation of Amazon Kindle are vulnerable to two KRACK vulnerabilities.

With KRACK scripts, ESET researchers able to “replicate the reinstallation of the pairwise encryption key (PTK-TK) in the four-way handshake (CVE-2017-13077) and reinstallation of the group key (GTK) in the four-way handshake (CVE-2017-13078).”

According to the ESET team, the vulnerabilities let attackers to

  • Replay old packets to cause a DOS attack or interruptions.
  • Decrypt the data transmitted.
  • Attackers can also forge packets.
  • It can also intercept sensitive details such as passwords or session cookies.

The Amazon home assistant found to be vulnerable to other network vulnerabilities than KRACK. The vulnerability lets attackers launch a broadcast replay attack.

The vulnerabilities were reported to Amazon on October 23rd, 2018 and Amazon acknowledged the issue and on January 8th, 2019 ESET receives that Amazon can replicate the issue.

To fix the vulnerabilities Amazon distributing a new version of software application wpa_supplicant that responsible for correct authentication to the Wi-Fi network.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates

Website

Latest articles

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...

Beware of Free Android VPN Apps that Turn Your Device into Proxies

Cybersecurity experts have uncovered a cluster of Android VPN applications that covertly transform user...

ZENHAMMER – First Rowhammer Attack Impacting Zen-based AMD Platforms

Despite AMD's growing market share with Zen CPUs, Rowhammer attacks were absent due to...

Airbus to Acquire INFODAS to Strengthen its Cybersecurity Portfolio

Airbus Defence and Space plans to acquire INFODAS, a leading cybersecurity and IT solutions...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles