Connect with us

Hi, what are you looking for?


Data Protection

Kr00k Vulnerability Exposed Data From Over a Billion Wi-Fi Devices

A new vulnerability, which may have affected over one billion Wi-Fi-capable devices before patches were released, could have allowed hackers to obtain sensitive information from wireless communications, cybersecurity firm ESET revealed on Wednesday.

A new vulnerability, which may have affected over one billion Wi-Fi-capable devices before patches were released, could have allowed hackers to obtain sensitive information from wireless communications, cybersecurity firm ESET revealed on Wednesday.

Dubbed Kr00k and tracked as CVE-2019-15126, the vulnerability caused devices to use an all-zero encryption key to encrypt part of a user’s communications, allowing an attacker to decrypt some wireless network packets transmitted by affected devices.

The vulnerability is related to the notorious KRACK (Key Reinstallation Attacks) discovered in 2017 and it was identified by ESET researchers during their analysis into KRACK, but the company has pointed out that there are some significant differences.Kr00k

Kr00k impacts devices using some Wi-Fi chips made by Broadcom and Cypress. The vulnerability has been found to affect smartphones, tablets, laptops, IoT devices, routers and access points made by Amazon, Apple, Google, Samsung, Raspberry Pi Foundation, Xiaomi, Asus, and Huawei.

ESET has also tested devices that use Wi-Fi chips from Qualcomm, Ralink, Realtek and Mediatek, but could not reproduce the attack. However, the company says it’s possible that some chips they have not tested could be vulnerable.

The cybersecurity firm reported its findings to Broadcom and Cypress in the summer of 2019 and the vendors have released patches. Many of the affected end-user devices have already received the patches. Before the patches were deployed, ESET estimates that over one billion devices were vulnerable to Kr00k attacks.

The Kr00k vulnerability can be triggered following a disassociation — when a device is disconnected from a Wi-Fi network due to signal interference, switching access points, or disabling of the Wi-Fi feature on the device.

“Once a station’s WLAN session gets disassociated, the session key (TK) stored in the Wireless Network Interface Controller’s (WNIC) Wi-Fi chip is cleared in memory – set to zero. This is expected behavior, as no further data is supposed to be transmitted after the disassociation,” ESET explained. “However, we discovered that all data frames that were left in the chip’s Tx (transmit) buffer were transmitted after being encrypted with this all-zero key.”

Advertisement. Scroll to continue reading.

Following a reassociation, an attacker in proximity of the targeted Wi-Fi connection can capture these data frames — even if they are not connected to the targeted WLAN by using a wireless network interface controller (WNIC) in monitor mode — and decrypt them. This way they can obtain several kilobytes of potentially sensitive information.

ESET says an attacker can manually trigger disassociations and reassociations to capture more data frames and increase their chances of obtaining sensitive information.

The company has pointed out that communications protected by TLS cannot be recovered using this attack.

Additional details are available in ESET’s research paper. The company presented its findings at the RSA Conference in San Francisco.

Related: Critical Vulnerabilities Impact Ruckus Wi-Fi Routers

Related: Wi-Fi Flaws Expose iPhone, Nexus Phones to Attacks

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join security experts as they discuss ZTNA’s untapped potential to both reduce cyber risk and empower the business.


Join Microsoft and Finite State for a webinar that will introduce a new strategy for securing the software supply chain.


Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Protection

The cryptopocalypse is the point at which quantum computing becomes powerful enough to use Shor’s algorithm to crack PKI encryption.

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Artificial Intelligence

The CRYSTALS-Kyber public-key encryption and key encapsulation mechanism recommended by NIST for post-quantum cryptography has been broken using AI combined with side channel attacks.

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...


The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.