KRACK 공격 추가 정보
11월 LifeGuard 업데이트로 해결된 KRACK 취약점.
KRACK 공격이란?
KRACK (Key Reinstallation Attacks) is a security vulnerability that affects the standard implementations of WPA and WPA2 Wi-Fi protocols. Zebra products for both Android and Microsoft are impacted.
These vulnerabilities could enable a proximate attacker (within Wi-Fi range of both the client device and the access point) to access and tamper with Wi-Fi packets over connections that are protected by WPA/WPA2 encryption. However, the attacker could not read or tamper with packets that are protected by a higher layer protocol such as SSL/TLS (i.e. https). Multiple conditions would need to be met in order for an attacker to exploit the vulnerability - the attacker would need to be within the physical proximity of the targeted user, and the user's device would need to have wireless networking enabled. The attacker would then need to execute a man-in-the-middle (MitM) attack to intercept traffic between the target computer and wireless access point. While the attacker can decrypt client-to-AP traffic, the attacker cannot inject arbitrary traffic into a WPA2-AES session and cannot get any authentication tokens or keys. There have been no reports of active user exploitation or abuse of this issue.
어떤 제품이 영향을 받는가요?
KRACK may affect computers, mobile phones, and other IoT devices running both Android and Windows operating systems. If your device supports Wi-Fi, it is most likely affected.
Zebra는 무엇을 권장하나요?
Zebra encourages customers update to develop and maintain a regular software maintenance program. Zebra is actively working with operating system and processor vendors to provide remediation in a timely manner.
Device specific updates can be located on the Spectre and Meltdown Security Vulnerability page. If your device is not listed on that page, contact Technical Support.
I'm not able to install the update immediately. What steps can I take?
패치 가 아닌 수정
- 802.11r을 사용하지 않도록 설정하면 하나의 취약점 소스(802.11r 로밍이라고도 함)를 제거하여 공격을 완화할 수 있습니다.
- Enable Rogue Access Point Detection to mitigate the risks caused by the MitM attack. MitM attack is required prior because the 4th EAPOL message (part of the handshake) must be intercepted/prevented in order to allow retries of handshake message 3. This means that the attacker must spoof the MAC of the access point.
업데이트를 다운로드하기 위해 Zebra.com 로그인하라는 메시지가 표시됩니다.
모바일 컴퓨터 및 스캐너의 경우 유효한 보증 또는 서비스 계약을 체결한 등록된 Zebra.com 사용자에게 업데이트를 사용할 수 있습니다.
프린터의 경우 등록된 Zebra.com 사용자가 펌웨어 업데이트를 사용할 수 있습니다.
My mobile computer or scanner is not covered by a valid warranty or service contract. What steps can I take?
- 위의 패치 적용 불가 수정을 참조하십시오.
- 단기 계약 구매에 대한 자세한 내용은 기술 지원에 문의하십시오.
I am logged into zebra.com. Why am I not able to download the update for the KRACK security vulnerability?
For mobile computers and scanners, the device must have a valid warranty or service contract. If you do not have a valid warranty or service contract, the update cannot be downloaded. Refer to question above for additional options.
유효한 보증 또는 서비스 계약이 있고 다운로드가 실패한 경우 Zebra 기술 지원 지원 데스크에 문의하십시오.
프린터 펌웨어 다운로드 실패는 Zebra 기술 지원 도움말 데스크에 문의하십시오.
Disclaimer: Zebra makes every attempt to release security updates on or about the time that Google releases its respective security bulletin. However, delivery time of security updates may vary depending on the region, product model, and third party software suppliers. Under some circumstances, the OS must be updated to the latest maintenance release prior to installing the security updates. Individual product updates will provide specific guidance.
달리 명시되지 않는 한, 새로 보고된 문제로부터 의한 적극적인 고객 착취 또는 남용에 대한 보고는 없었습니다.
Zebra Technologies 제품의 잠재적인 보안 문제를 알고 있습니까?