Researchers at security firm ESET have discovered a security vulnerability in WiFi chips that could enable attackers to snoop on targets' encrypted WiFi traffic.
The details of the flaw were publically disclosed by the researchers this week at the RSA security conference being in San Francisco, California.
It could be impacting nearly one billion devices, from home routers to iPhones and Amazon's Echo, although researchers said they have not yet spotted any attacks in the wild exploiting the vulnerability.
Moreover, the bug cannot be used to break HTTPS and TLS protocols, which provide an additional encryption layer for communications. However, KrØØk offers plenty of opportunities for attackers to interrupt WiFi data.
In vulnerable devices, the flaw disables the encryption key used to secure part of the user's communications over wireless standards. As a result, the device starts using an all-zero encryption key (string of zeros) to encrypt the communication.
Moreover, a miscreant doesn't need to be logged into the wireless network of the target device to exploit the vulnerability. If successful, the attack enables the adversary to take repeated snapshots of the device's wireless traffic, which may contain personal data, URLs of requested websites, email, IP address, and so on.
The test carried out by the researchers revealed that prior to patching, some client devices by Samsung (Galaxy), Apple (iPad, iPhone, MacBook), Amazon (Echo, Kindle), Google (Nexus), Xiaomi (RedMi), Raspberry (Pi 3), as well as some access points by Huawei and Asus, were vulnerable to the flaw.
The researcher said they responsibly disclosed the flaw to Cypress and Broadcom, who released patches during an extended disclosure period.
"According to our information, patches for devices by major manufacturers have been released by now," the researchers said.
"To protect yourself, as a user, make sure you have applied the latest available updates to your WiFi-capable devices, including phones, tablets, laptops, IoT devices, and Wi-Fi access points and routers."
However, researchers at security firm Tripwire suggested that it wasn't anything to be too concerned about.
"This attack has some similarity to the KRACK attack which took the infosec community by surprise in 2017," said Craig Young, principal security researcher at Tripwire.
He continued: "Both attacks can potentially allow nearby attackers to gain access to information which should have only been sent after being securely encrypted. In the case of Kr00k, the researchers found that the affected wireless NIC implementations would insecurely send queued data after being disassociated from the network.
"At the end of the day though, although this is a very interesting attack, it is not something to lose sleep over. As shown in the Kr00k publication, most of the sensitive data attackers are likely to obtain is going to additionally be encrypted by TLS as it should be. Vulnerabilities like KRACK, Kr00k, or Dragonblood are all excellent reminders of why HTTPS Everywhere is important."
IT systems at Redcar and Cleveland Borough Council have been down for three weeks
Ecommerce platform compromised by eight different skimmers hosted accounts for a number of high-profile organisations
UK plays host to 149 unpatched Pulse Secure VPN servers vulnerable to flaw favoured by Iranian state-backed hackers
Unsigned firmware in peripherals could allow attackers to target HP, Lenovo and Dell computers, researchers warn
Enterprises must assess the 'firmware posture' of new devices during procurement
UK accuses Russia of being behind a string of cyber attacks on neighbouring states