<story><title>FragAttacks: new security vulnerabilities that affect wi-fi devices</title><url>https://www.fragattacks.com/</url></story><parent_chain><item><author>miles</author><text>From the industry response[1]:&lt;p&gt;&amp;gt;  &amp;quot;It’s important to note that there is presently no evidence of the vulnerabilities being used against Wi-Fi users maliciously and these issues are mitigated through routine device updates once updated firmware becomes available.&lt;p&gt;&amp;gt; &amp;quot;Like many previous vulnerabilities, FragAttacks has been academically well-researched and responsibly reported in a manner allowing the industry to proactively prepare and begin to roll out updates that fully eliminate the vulnerabilities. This set of vulnerabilities requires a potential attacker to be physically within range of the Wi-Fi network (or user device) in order to exploit it. This significantly reduces the likelihood of actual exploitation or attack.&amp;quot;&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.commscope.com&amp;#x2F;blog&amp;#x2F;2021&amp;#x2F;wi-fi-alliance-discloses-fragattacks&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.commscope.com&amp;#x2F;blog&amp;#x2F;2021&amp;#x2F;wi-fi-alliance-discloses...&lt;/a&gt;</text></item></parent_chain><comment><author>asclepi</author><text>I agree with the industry response here. KRACK was the same thing. The author finds a vulnerability that is &lt;i&gt;absolutely valid&lt;/i&gt; (no denying here), easy to exploit in a lab but very hard to exploit in practice. Back in the day, we did test our equipment for KRACK. We concluded that someone had to circumvent all our physical security barriers (challenging, but theoretically possible) to get close enough to an AP that would see sensitive stuff, had to know WHEN to do that, or at least plant a device that could easily be noticed, and they would still fail because we didn&amp;#x27;t have 802.11r enabled on those AP&amp;#x27;s.&lt;p&gt;Is it a concern? It depends on what you&amp;#x27;re doing. It is absolutely a concern if your corporation is handling ultra-sensitive information. However, you should also question your physical barriers in that case and whether you should use Wi-Fi at all for some aspects of your operation. Is it a concern for the vast majority of office workers or someone at home? Probably not; there would be easier ways to find a valid credit card number that don&amp;#x27;t involve the time and effort for a hacker to travel to your place where they could be discovered. There&amp;#x27;s no need to replace all your AP&amp;#x27;s with new hardware, although the Wi-Fi Alliance would love for you to do that.&lt;p&gt;Does this exploit warrant its own fancy name and domain name? As was the case for KRACK, I don&amp;#x27;t believe so. That should be reserved for vulnerabilities that have a severe impact AND are extremely trivial to exploit with no proximity requirements. If not, the fancy-name-vulns risk being deprived of their ability to get the attention that is required.</text></comment>
<story><title>FragAttacks: new security vulnerabilities that affect wi-fi devices</title><url>https://www.fragattacks.com/</url></story><parent_chain><item><author>miles</author><text>From the industry response[1]:&lt;p&gt;&amp;gt;  &amp;quot;It’s important to note that there is presently no evidence of the vulnerabilities being used against Wi-Fi users maliciously and these issues are mitigated through routine device updates once updated firmware becomes available.&lt;p&gt;&amp;gt; &amp;quot;Like many previous vulnerabilities, FragAttacks has been academically well-researched and responsibly reported in a manner allowing the industry to proactively prepare and begin to roll out updates that fully eliminate the vulnerabilities. This set of vulnerabilities requires a potential attacker to be physically within range of the Wi-Fi network (or user device) in order to exploit it. This significantly reduces the likelihood of actual exploitation or attack.&amp;quot;&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.commscope.com&amp;#x2F;blog&amp;#x2F;2021&amp;#x2F;wi-fi-alliance-discloses-fragattacks&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.commscope.com&amp;#x2F;blog&amp;#x2F;2021&amp;#x2F;wi-fi-alliance-discloses...&lt;/a&gt;</text></item></parent_chain><comment><author>tomaskafka</author><text>&amp;gt; This set of vulnerabilities requires a potential attacker to be physically within range of the Wi-Fi network&lt;p&gt;I have troubles imagining an attack on wifi protocol where this doesn&amp;#x27;t apply :).</text></comment>