"KRACK" and Router Software

[zzz00m]

Then why did some routers got the fix and some didn't even when only client are affected.

Well if you read the link to the Netgear security advisory, they stated the router fix was for a bridge mode vulnerability in routers. The routers are only vulnerable in this manner. That is where routers connect to routers, and a WPA-2 handshake occurs.

NETGEAR is aware of WPA-2 security vulnerabilities that affect NETGEAR products that connect to WiFi networks as clients.

Routers and gateways are only affected when in bridge mode (which is not enabled by default and not used by most customers).

They go on to list other devices with vulnerabilities, such as wifi adapters, wireless access points, etc. Some of these devices have firmware fixes available, many do not.

 

[Vasudev]

Well if you read the link to the Netgear security advisory, they stated the router fix was for a bridge mode vulnerability in routers. The routers are only vulnerable in this manner. That is where routers connect to routers, and a WPA-2 handshake occurs.

But Netgear said, by default their routers have bridge mode disabled regardless of how old or new the device it is.

 

[zzz00m]

But Netgear said, by default their routers have bridge mode disabled regardless of how old or new the device it is.

Nevertheless, that is the vulnerability that their router "fix" was issued for. Bottom line is that the router is the least of the problem, as far as I can see. The solution lies in patching the many WPA-2 client devices scattered around the world.

The way the exploit works is the attacker sets up a rogue network using your 'ssid' in range of your network, and tricks your device into connecting to it. This attack bypasses your router, so patching your router will not prevent this.

KRACK Attack Threatens All Wi-Fi Networks: What to Do

The attack is mostly against client devices, including laptops, Wi-Fi enabled desktops, smartphones, tablets and smart-home devices. It's more important that client devices get patched than routers get patched, although patching the routers wouldn't hurt.

The KRACK attack doesn't require knowing your Wi-Fi password, and doesn't even access it. Rather, the main line of attack involves setting up a rogue network in range of the real one, using the same network name so that some devices connect to the rogue network instead.