KRACK 攻撃の追加情報

KRACK (Key Reinstallation Attacks) is a security vulnerability that affects the standard implementations of WPA and WPA2 Wi-Fi protocols. Zebra products for both Android and Microsoft are impacted.

These vulnerabilities could enable a proximate attacker (within Wi-Fi range of both the client device and the access point) to access and tamper with Wi-Fi packets over connections that are protected by WPA/WPA2 encryption. However, the attacker could not read or tamper with packets that are protected by a higher layer protocol such as SSL/TLS (i.e. https). Multiple conditions would need to be met in order for an attacker to exploit the vulnerability - the attacker would need to be within the physical proximity of the targeted user, and the user's device would need to have wireless networking enabled. The attacker would then need to execute a man-in-the-middle (MitM) attack to intercept traffic between the target computer and wireless access point. While the attacker can decrypt client-to-AP traffic, the attacker cannot inject arbitrary traffic into a WPA2-AES session and cannot get any authentication tokens or keys. There have been no reports of active user exploitation or abuse of this issue.
 

影響を受けている製品

KRACK may affect computers, mobile phones, and other IoT devices running both Android and Windows operating systems. If your device supports Wi-Fi, it is most likely affected.
 

Zebraは私が何をすることをお勧めしますか?

Zebra encourages customers update to develop and maintain a regular software maintenance program. Zebraは、オペレーティングシステムおよびプロセッサベンダーと積極的に協力して、タイムリーに修復を提供しています。

Device specific updates can be located on the Spectre and Meltdown Security Vulnerability page. If your device is not listed on that page, contact Technical Support. 

I'm not able to install the update immediately. What steps can I take?

パッチ以外の修復

1. 802.11r を無効にすると、1 つの脆弱性の原因 (高速 BSS 遷移、別名 802.11r ローミング) を排除することで、攻撃を軽減できます。
2. Enable Rogue Access Point Detection to mitigate the risks caused by the MitM attack. MitM attack is required prior because the 4th EAPOL message (part of the handshake) must be intercepted/prevented in order to allow retries of handshake message 3. This means that the attacker must spoof the MAC of the access point.

更新プログラムをダウンロードするためにZebra.comにログインするように求められるのはなぜですか?

モバイル コンピュータおよびスキャナの場合、有効な保証またはサービス契約を持つ登録済みのZebra.comユーザーは、更新プログラムを利用できます。

プリンターの場合、ファームウェアの更新は、登録Zebra.comユーザーが使用できます。
 

My mobile computer or scanner is not covered by a valid warranty or service contract. What steps can I take?

1. 上記の修正プログラム以外を参照してください。
2. 短期契約の購入に関する詳細については、テクニカルサポートにお問い合わせください。

I am logged into zebra.com. Why am I not able to download the update for the KRACK security vulnerability?

For mobile computers and scanners, the device must have a valid warranty or service contract. If you do not have a valid warranty or service contract, the update cannot be downloaded. Refer to question above for additional options.

有効な保証またはサービス契約を結んでいる場合、ダウンロードに失敗した場合は、Zebraのテクニカルサポートヘルプデスクにお問い合わせください。

プリンターファームウェアのダウンロードに失敗した場合は、Zebraのテクニカルサポートヘルプデスクにお問い合わせください。