Beyond KrØØk: Even more Wi‑Fi chips vulnerable to eavesdropping

It’s still serious. For example, consider the potential for industrial espionage. Want to steal some trade secrets? Grab a cantenna and set up shop next door.

While your part about limited retrievability is reasonable right now (though as always the fear is that attacks only ever get worse), I'd take some issue with being blasé about this bit:

>Furthermore, the bug cannot be used part of automated botnet attacks, requires physical proximity

I think that needs some real qualifiers. A high percentage of the population, and an even higher percentage of valuable targets, lie within fairly dense urban areas. One of the whole challenges with WiFi there is that there are zero places that don't have many overlapping WiFi networks. That kind of density in turn definitely raise the potential for automation if a widespread enough bug was found that could be used as part of a takeover chain. There are a lot of unpatched systems/IOT/etc out there, so "physical proximity" is a phrase that has to be considered closely. Anyone would have to evaluate not merely their own networks but if they're sure that none of their neighbors have any vulnerable devices, and none of their neighbors' neighbors, that nobody walking by or visiting or visiting within range or the like has been owned, etc. Kr00k by itself may not be enough, but these days lone bugs are almost never enough even locally, full RCEs/rooting and such usually are a chain of exploits where any single one wasn't a real threat, but each brings attackers past one more safeguard.

FWIW, self-propagation in high density areas has been considered and started to see some interesting public research (who knows what state actors are up to with it) over the last few years. An example from 2018 was "IoT Goes Nuclear: Creating a ZigBee Chain Reaction" [0], which focused on the ZigBee protocol.

I do think WiFi is fundamentally better, it has had more development, faced more scrutiny, and in general is part of regular networks that we have far more mature tools and techniques to monitor and secure. Again, I'm not arguing this is something to panic over specifically, but even 'minor' exploits like this shouldn't be left hanging about and should get patches reasonably promptly and upgraded as opportunity allows. "Requires physical proximity" isn't always straightforward.

----

0: https://eyalro.net/project/iotworm.html

I dunno. It certainly feels like I have to edit my server configs at least every year to make something or other stop complaining about the TLS parameters not being secure enough.