Child Item

Site Totals

61410 Questions Answered 270 Categories

KRACK WiFi Bug and JetPacks

BobLloyd2017

I just completed a chat with support. Accordingly the Jetpack MiFi 6620L does not need a firmware/software patch as the KRACK bug is not applicable to this device. I'm unsure about that answer from support and I'm hopeful someone here can provide additional details. We use these in a highly regulated environment and I need to be 100% sure we are not at risk when using this device.

Comments

7e18n1

You are most definitely at risk! As pointed out in another thread, Verizon does not make any of the devices impacted by the Krack Exploit. It is not Verizon's responsibility to fix them. That task falls upon the OEM that made the device in question and if and when they do something about it, time will only tell.

If the issue concerns you then disable Wi-Fi and stop using it. You can use a VPN to keep you data secure, but it doesn't stop the Krack exploit.

https://www.krackattacks.com/

John_Getzke

> I just completed a chat with support. Accordingly the Jetpack MiFi 6620L does not need a firmware/software patch as the KRACK bug is not applicable to this device.

This contradicts all of the information that is available about the vulnerability from what I have seen so far. I feel the support person you spoke to is misinformed or being taken out of context.

If you want to take the word of the support person then try to find for us some kind of documentation that we can share with the rest of the community. The only way the KRACK exploit would not apply would be if you were using the USB tethering feature and disabling WiFi on the MiFi. No WiFi, No exploit. This might be where the support persons response could be taken out of context due to a lack of details leading up to that statement.

Road_Trip

People need to turn up the heat on Verizon and other providers on this. This is turning into legal and moral breach of contract. The KRACK bug which absolutely does affect every, single, WPA2 WiFI device on the planet was announced back in mid October 2017. We are now closing in on 4 MONTHS of waiting. A huge percentage - I bet something like 90% of the other mobile devices these providers have sold on the planet have had patches released. All of these other devices provided some other value based on cellular data and WiFi is a sidebar. Patches were rushed out.

What is very concerning about the hotspots is (a) they provide no other value than WiFI, (b) tend to get used in very public places where they can easily be attacked and (c) have just as long of contracts as the above devices.

I'm now at 4 months of paying Verizon for a paperweight under a contract that I can't get out of economically. I've called several times and 1st level support has NO AWARENESS OF THIS PROBLEM - 4 MONTHS LATER. Advanced support has given me a small credit.

My intent is to never ever pay more than 2 months for a device under contract that I can't use safely. Two months has proven to be a reasonable amount of time, for other vendors. I would strongly encourage others in similar situations to start to push back on paying monthly for these devices. This kind of abject failure, is the stuff that class actions are made of.

So before I'm flamed, let's get some truth out there:

(a) Yes, Novatel makes the hardware and the software. They did that under a contract with Verizon. Verizon is the one that is keeping me under contract for a device flaw that their subcontractor is responsible for. I don't care who in the manufacturing chain is responsible, Verizon is the one charging me

(b) No, there is no other value provided by a hotspot. It's a cellular radio on one side and WiFi router on the other

(c) No, KRACK is not fixed by having the connecting device patched. Both the device and the router have to be patched. Read for crying out loud - it's out there and has been picked up by all the majors.

(d) No, it's not a legacy device for which support has ended. I'm still under contract and have to pay to get out. The vendor can't expect the contract to be valid - this is a broken trust

(e) Yes, at 4 months, without even a policy made available to support staff, it shows bad intent. Head in sand at best

(f) Yes, there is damage. I bought the device because I needed it to run my business. Not having this mobile WiFi, cellular connected network is hurting my company's ability to get work done. Yes I have had to pay for something I can’t use based on a broken promise it would be kept up-to-date

(g) No, there is no evidence that the new models currently being sold and contracted have been patched, new damage happening to new customers

(f) No switching to WEP encryption is not a solution. There have been network frame based 30sec cracks for WEP encryption for years. WEP = zero encryption, WPA2 = even less time to get hacked.

My workaround: Turn on hotspot on a patched tablet which has a much larger battery than the phone. Carry an external battery for the tablet. Buz kill: I can’t find out for sure that Apple has fixed KRACK in their hotspot/router software. I know they have fixed for the device to join a WiFi network. Back to no mobile WiFi….

So let's band together to get one of a couple viable options to happen:

(a) Strongly preferred, via customer pressure, Verizon get's this fixed

(b) Verizon stops charging us and releases all hotspot contracts. If you want to go month to month and pay for a compromised device then the responsibility for any damage switches to you. That's ok, you may have a reasonable use case.

Please, this is one case where it looks like it is not going to happen without customer pressure. There is no reason you should be giving out your personal secrets such as your bank sign on, or your company’s secrets to all your best friends at the coffee shop or airport. If you keep using these devices, then you might as well hand out print outs. At least you will know who you have given the above too.

Verizon if you take this post down. It will show up in many other open forums and it will show bad intent on bad intent. You are better off responding. If you show you are trying and have a plan to make people whole, then they will go from angry at you to being on your side for the difficult position this vulnerability has put you in. Your hotspot business will take a considerable hit for a while, but you will win in the long run.

tabithaj_vzw

I've sent you a private message here in the forum. Please check your inbox at <https://community.verizonwireless.com/inbox> to discuss further details about your concern.

TabithaJ_VZW Follow us on TWITTER @VZWSupport If my response answered your question please click the Correct Answer button under my response. This ensures others can benefit from our conversation. Thanks in advance for your help with this.

Road_Trip

Hi thanks for the response and the sentement, however I have called support multiple times. This issue affects all hotspots so is not an account issue. The device in question is a MiFi 6620L Software version 3.0.

As far as I can tell no VZW hotpots have been remediated for KRACK. If you can offer proof that one has, then I would be willing to do an early upgrade.

If you get the response back that a patch is not needed then I urge you to beg your back office to get ahead of this. There is a huge body of technical information including from the research team at Berkley who found the vulnerability that all WPA2 WiFi encryption is affected. Carrires who persist with this message are eventually going to be the subject of bad press in the WSJ, Forbes and others. The possition is just not going to stand scrutiny.

I'm doing some research for a work around and if it pans out will post in the forum. Perhaps teathering will use the cellular radio only and turn off WiFi. This makes the hotspot useable for one PC at a time.

You might hear back that users most offten do web browsing where sensitive information is protected by https web encryption. The KRACK vulnerabilty allows for malware insertion even if https is used so that's not a viable reason for users to continue to use insecure WiFi.

Carriers who get ahead of this and put a plan and advice in front of their customers are going to be be ahead in the long run.

We in the tech community realize this is a total mess. KRACK affects and estimated 1 trillion devices on the planet and estimates are that it will take over 10yrs for us to get totally past this.

I'm hoping VZW will get serious with Mitel and work out a priority list to begin to give customers options.

Thanks again for the reply.

7e18n1

You're over reacting!

Within days of Mathy Vanhoef's public disclosure of the Krack exploit, researchers theorized that the reason they couldn't make it work was because Mathy Vanhoef intentionally withheld information necessary to make it work, from public disclosure. Now, here it is 100 days later and all available evidence supports this theory. Google Krack and you'll see virtually the same hits as 3 months ago, what you don't see is complaints about being infected with any type of Krack exploit. Google Krack test and the only test requires membership in the Wi-Fi Alliance. Google Wi-Fi Alliance to find out that this is. Search VirusTotal.com and no one has submitted any samples flagged as containing a Krack exploit. No AV vendor has published detention rates involving a Krack exploit. In other words, there is no evidence of a Krack exploit in the wild.

Verizon Wireless is stuck in the middle of this; it's not their job to fix your equipment. It is up to the manufacturer to provide firmware updates and if the equipment is out of warranty then the manufacturer has lived up to their end of the bargain and they are under no legal, moral or ethical obligation to do anything else. The truth is, you buy and use this equipment at your own risk--neither the OEM nor the provider is liable just because someone found a kink in the armor.

Perhaps it would be a good idea to review the Customer Agreement, the contract between you and Verizon Wireless. It does not give exception for firmware that makes you unhappy. If you don't pay the bill it will only affect you and your credit rating.

Child Item