Kr00k (also written as KrØØk) is a security vulnerability that allows some
WPA2
Wi-Fi Protected Access (WPA), Wi-Fi Protected Access II (WPA2), and Wi-Fi Protected Access 3 (WPA3) are the three security and security certification programs developed after 2000 by the Wi-Fi Alliance to secure wireless computer networks. The All ...
encrypted WiFi traffic to be decrypted.
The vulnerability was originally discovered by security company
ESET in 2019 and assigned on August 17, 2019. ESET estimates that this vulnerability affects over a billion devices.
[https://www.welivesecurity.com/wp-content/uploads/2020/02/ESET_Kr00k.pdf ]
Discovery
Kr00k was discovered by ESET Experimental Research and Detection Team, most prominently ESET security researcher Miloš Čermák.
It was named Kr00k by Robert Lipovsky and
Stefan Svorencik. It was discovered when trying variations of the
KRACK
KRACK ("Key Reinstallation Attack") is a replay attack (a type of exploitable flaw) on the Wi-Fi Protected Access protocol that secures Wi-Fi connections. It was discovered in 2016 by the Belgian researchers Mathy Vanhoef and Frank Piessens o ...
attack.
Initially found in chips made by
Broadcom and
Cypress
Cypress is a common name for various coniferous trees or shrubs of northern temperate regions that belong to the family Cupressaceae. The word ''cypress'' is derived from Old French ''cipres'', which was imported from Latin ''cypressus'', the ...
, similar vulnerabilities have been found in other implementations, including those by
Qualcomm
Qualcomm () is an American multinational corporation headquartered in San Diego, California, and incorporated in Delaware. It creates semiconductors, software, and services related to wireless technology. It owns patents critical to the 5G, 4 ...
and
MediaTek.
Patches
The vulnerability is known to be patched in:
*
iOS 13.2 and
iPadOS 13.2 - October 28, 2019
*
macOS Catalina 10.15.1, Security Update 2019–001, and Security Update 2019-006 - October 29, 2019
Vulnerable devices
During their research, ESET confirmed over a dozen popular devices were vulnerable.
has found several of their devices to be vulnerable and are working on patches. They are tracking the issue with advisory id cisco-sa-20200226-wi-fi-info-disclosure.
Known vulnerable devices include:
*
Amazon Echo 2nd gen
*
Amazon Kindle
Amazon Kindle is a series of e-readers designed and marketed by Amazon. Amazon Kindle devices enable users to browse, buy, download, and read e-books, newspapers, magazines and other digital media via wireless networking to the Kindle Store. ...
8th gen
*
Apple iPad mini 2
*
Apple iPhone 6
The iPhone 6 and iPhone 6 Plus are smartphones that were designed and marketed by Apple Inc. They are the eighth generation of the iPhone, succeeding the iPhone 5, iPhone 5C and iPhone 5S, and were announced on September 9, 2014, and rel ...
,
6S,
8,
XR
*
Apple MacBook Air Retina 13-inch 2018
*
Asus wireless routers (RT-AC1200G+, RT-AC68U), but fixed in firmware Version 3.0.0.4.382.5161220 during March 2020
*
Google Nexus 5
*
Google Nexus 6
The Nexus 6 (codenamed Shamu) is a phablet co-developed by Google and Motorola Mobility that runs the Android operating system. The successor to the Nexus 5, it is the sixth smartphone in the Google Nexus series, a family of Android consu ...
*
Google Nexus 6P
*
Raspberry Pi 3
Raspberry Pi () is a series of small single-board computers (SBCs) developed in the United Kingdom by the Raspberry Pi Foundation in association with Broadcom. The Raspberry Pi project originally leaned towards the promotion of teaching basi ...
*
Samsung Galaxy S4 (GT-I9505)
*
Samsung Galaxy S8
The Samsung Galaxy S8 and Samsung Galaxy S8+ are Android smartphones produced by Samsung Electronics as the eighth generation of the Samsung Galaxy S series. The S8 and S8+ were unveiled on 29 March 2017 and directly succeeded the Samsung Gala ...
*
Xiaomi Redmi 3S
Corporation (; ), commonly known as Xiaomi and registered as Xiaomi Inc., is a Chinese designer and manufacturer of consumer electronics and related software, home appliances, and household items. Behind Samsung, it is the second large ...
References
{{Hacking in the 2010s
Computer security exploits
Hardware bugs
Wi-Fi
Computer-related introductions in 2019
Telecommunications-related introductions in 2019