Security researchers discovered a critical flaw in Wi-Fi chips made by Broadcom and Cypress Semiconductor that were used in Apple devices.
The discovery was presented at the RSA security conference in San Francisco this morning, revealing that billions of devices could have been affected. Attackers could use the vulnerability to decrypt private data sent over the air. Most manufacturers have already released a patch to fix the issue, but it’s unclear how many of the devices have been updated.
The following Apple devices were affected:
-
- iPad mini 2
- iPhone 6
- iPhone 6s
M
- iPhone 8
- iPhone XR
- MacBook Air Retina 13-inch 2018
Apple says it released fixes for the bug back in October for iOS, iPadOS and macOS.
Amazon Echos and Kindles, Samsung phones, Google phones and the Raspberry Pi 3 are also among the list of devices found with the vulnerability. Eset, the security company that found the flaw, named it Kr00k and said it mostly affects Cypress’ and Broadcom’s FullMAC WLAN chips.
What is Kr00k?
Kr00k, tracked by the tag CVE-2019-15126, causes devices to use an all-zero encryption key that leaves packets transmitted over Wi-Fi vulnerable to attack. The bug exploits wireless devices as the dissociate from a wireless access point. Devices that have the vulnerability use the all-zero encryption key and send any unsent data in a transmit buffer over the air.
The Kr00k flaw would only come into play when you turn your iPhone’s Wi-Fi off, or when roaming from one Wi-Fi access point to another. As Ars Technica explains, even though the scope of Kr00k is alarming, it probably wouldn’t be an effective way of stealing passwords and other information because you’d have to time the attack perfectly and there’s not a ton of data sent in those packets.
One concerning aspect of Kr00k is that it affects Asus and Huawei routers. Even if you’ve patched your affected Apple device, you might still be vulnerable to attacks thanks to the Wi-Fi router you’re connected to.
If you have any of the Apple devices listed above and haven’t updated your software in a few months, you should definitely hit that update button in the Settings.
