Hello, welcome to the Monday, October 8, 2018 edition of the Sansanet Storm Center's Stormcast.

My name is Johannes Ulrich, and I'm recording from Honolulu, Hawaii.

Just a quick update on the Bloomberg story regarding the rogue chips that allegedly were found on super micro motherboards. We have a few more

denials of the store including Department of Homeland Security did publish

press release stating that they're not aware of any implants like this. On the

other hand Bloomberg reconfirmed that even in light of all of these

denials that they're standing by their story. So really hard to tell. Again, don't panic. I wouldn't

go in and rip apart all of your servers. If this story is true, then likely only very specific organizations were targeted with these malicious chips.

Well, it was about a year ago that Matthew Vanhoeff did find the crack attack in WPA2 and well with WPA3 on the horizon now

Matthew did publish an update about his work about weaknesses in WPA2 what he found is

that there are a couple ways how mitigation of the crack attack is lagging. For example,

WNM, the wireless network management feature, which is a power safe feature that you find a lot

in mobile device and such, can be used to bypass some of the crack countermeasures. Secondly, also some of the patches being

deployed have been deficient and not really addressing the entire crack problem. Now

the patches have been improved and OS10 for example was an example here So if you're up to date, you should be okay.

He also showed how a new feature, that's Phil's or the fast initial link setup, can be used in order to again get back to the crack attack.

However, this particular feature has only been finalized in June of 2017

and hasn't really shown up yet in hardware. This feature is also more for direct contact

between clients, so probably not such a big issue at this point. In short, sometime next year, WPA-3 should be

arriving in the form of hardware. So we'll see what this will do. This should prevent the

crack attack and should in general make WPA more secure and also in some cases more usable.

So we'll see what it hacks people will come up with once this new standard is actually being used in the wild.

...