KRACK 攻撃の追加情報
KRACKの脆弱性は、11月のLifeGuardのアップデートによって解決されました。
KRACKアタックとは何ですか?
KRACK (Key Reinstallation Attacks) is a security vulnerability that affects the standard implementations of WPA and WPA2 Wi-Fi protocols. Zebra products for both Android and Microsoft are impacted.
These vulnerabilities could enable a proximate attacker (within Wi-Fi range of both the client device and the access point) to access and tamper with Wi-Fi packets over connections that are protected by WPA/WPA2 encryption. However, the attacker could not read or tamper with packets that are protected by a higher layer protocol such as SSL/TLS (i.e. https). Multiple conditions would need to be met in order for an attacker to exploit the vulnerability - the attacker would need to be within the physical proximity of the targeted user, and the user's device would need to have wireless networking enabled. The attacker would then need to execute a man-in-the-middle (MitM) attack to intercept traffic between the target computer and wireless access point. While the attacker can decrypt client-to-AP traffic, the attacker cannot inject arbitrary traffic into a WPA2-AES session and cannot get any authentication tokens or keys. There have been no reports of active user exploitation or abuse of this issue.
影響を受けている製品
KRACK may affect computers, mobile phones, and other IoT devices running both Android and Windows operating systems. If your device supports Wi-Fi, it is most likely affected.
Zebraは私が何をすることをお勧めしますか?
Zebra encourages customers update to develop and maintain a regular software maintenance program. Zebra is actively working with operating system and processor vendors to provide remediation in a timely manner.
Device specific updates can be located on the Spectre and Meltdown Security Vulnerability page. If your device is not listed on that page, contact Technical Support.
I'm not able to install the update immediately. What steps can I take?
パッチ以外の修復
- 802.11r を無効にすると、1 つの脆弱性の原因 (高速 BSS 遷移、別名 802.11r ローミング) を排除することで、攻撃を軽減できます。
- Enable Rogue Access Point Detection to mitigate the risks caused by the MitM attack. MitM attack is required prior because the 4th EAPOL message (part of the handshake) must be intercepted/prevented in order to allow retries of handshake message 3. This means that the attacker must spoof the MAC of the access point.
更新プログラムをダウンロードするためにZebra.comにログインするように求められるのはなぜですか?
モバイル コンピュータおよびスキャナの場合、有効な保証またはサービス契約を持つ登録済みのZebra.comユーザーは、更新プログラムを利用できます。
プリンターの場合、ファームウェアの更新は、登録Zebra.comユーザーが使用できます。
My mobile computer or scanner is not covered by a valid warranty or service contract. What steps can I take?
- 上記の修正プログラム以外を参照してください。
- 短期契約の購入に関する詳細については、テクニカルサポートにお問い合わせください。
I am logged into zebra.com. Why am I not able to download the update for the KRACK security vulnerability?
For mobile computers and scanners, the device must have a valid warranty or service contract. If you do not have a valid warranty or service contract, the update cannot be downloaded. Refer to question above for additional options.
有効な保証またはサービス契約を結んでいる場合、ダウンロードに失敗した場合は、Zebraのテクニカルサポートヘルプデスクにお問い合わせください。
プリンターファームウェアのダウンロードに失敗した場合は、Zebraのテクニカルサポートヘルプデスクにお問い合わせください。
Disclaimer: Zebra makes every attempt to release security updates on or about the time that Google releases its respective security bulletin. However, delivery time of security updates may vary depending on the region, product model, and third party software suppliers. Under some circumstances, the OS must be updated to the latest maintenance release prior to installing the security updates. Individual product updates will provide specific guidance.
特に明記されていない限り、これらの新たに報告された問題から積極的な顧客の搾取や悪用の報告はありません。
Zebraテクノロジーズ製品の潜在的なセキュリティ上の問題を認識していますか?