13iron wrote

plz provide instruction on how to put my Archer C50 into "Router Mode" or where to find instruction

If you have 1 wifi router device and you are surfing the internet through it then you are already in router mode.

13iron wrote

plz provide instruction on how to put my Archer C50 into "Router Mode" or where to find instruction

If your Archer C50 is connected to the front-end modem or router via an Ethernet cable, then you're using the Router or Access Point mode.

skyman wrote

If I understand correctly, if you have the latest Windows 10 update you should be safe if you're on WiFi. On Android, iPhone or any other we'll have to wait for a patch.

My question is: will a firmware update on the router ensure protection if your Android is not patched? A lot of us don't have vanilla Android and I don't know when updates will drop for all these models.

I'm sure this has been stated on the forum already but I hope people will read and understand this explanation of the current situation:

The Krack Attack method is not really a hardware / software issue completely. The hardware / software will be patched to fix the real issue. WPA / WPA2 encryption uses a key for the devices to communicate anytime and sometimes randomly, when the devices communicate there is what is called a "handshake" between the devices. 4 messages are sent between the devices. At some point in these messages (usually the 3rd message) the devices "agree" on a key that allows them to know they are talking to each other to "secure" the connection the key travels with each transmission between the devices. Currently the key is not randomized enough or regularly enough to prevent the hacker from determining your key. Once they have the key they can tell the devices to not change the key, then do what they want with the info they can see, and even "insert" their own info into your devices (on both the access point i.e. wifi router, and client i.e. smartphone, computer,...etc). Both the access point and the client will need a patch. If the access point only was fixed the hacker can still use access the client. That is why both need the fix. Additionally, Android / Linux devices are susceptible to a "All zero's key hack" where the hacker can change the encryption key to all 0's and not have to use the software to figure out the key each time. That is why just fixing the access point will not completely protect you.

You can watch this if I did not make it clear enough: https://youtu.be/VI89hpI5pos

Hope this helps.

ok! thnx to both Sitedrifter and tplink...

Sitedrifter wrote

What a pile on top of TP-Link. Netgear has the same issue and they are 10 times the size of TP-Link and were notified well over a month ago and still don't have fixes. To all the people who will be dumping TP-Link, what manufacturer are you going to go to? I ask this because most of the comparable manufactures have the same issue. Maybe people should calm down and wait for fix instead of demanding something that is not an easy repair. Hell, Google is not going to release a fix for android or chrome devices until November. How many 100s of millions of Android phones are affected but Google will take it time? jump on their heads!

DD-WRT released KRACK patches almost immediately. So have commercial grade OEMs.

After this snafu, I think buying from TP-Link (which is not the worst of the bunch) or from any other consumer grade OEM should be very strongly avoided. If and until we see detailed support lifecycles, how fast patches will be issued for what, and what resources and people they're throwing into taking security seriously, "just say no."

Artichokes wrote

DD-WRT released KRACK patches almost immediately. So have commercial grade OEMs.

After this snafu, I think buying from TP-Link (which is not the worst of the bunch) or from any other consumer grade OEM should be very strongly avoided. If and until we see detailed support lifecycles, how fast patches will be issued for what, and what resources and people they're throwing into taking security seriously, "just say no."

For clarity – and not to defend or vilify TP-Link here – it's worth going back and reading the post from tplink that is currently at the top of page 6. In it, they explain that the code they use in their routers (a) doesn't use 802.11r and (b) also doesn't accept retried Replay Counter values in the handshake, thereby blocking this type of attack.

This also means – and they explicitly state this – that TP-Link's code has never fully-adhered to the WPA-2 spec. Today that makes them look like prescient wizards, though they are not claiming that at all. ;)

tplink wrote

That's the point if you get deeper into the publisher's paper. The key reinstallation attacks mainly target the client devices. This is why some phones & computers manufactures such as Microsoft, Intel and Apple, are notified about the vulnerabilities in advance and patch their products at the first time that the vulnerability is reported.
Suppose a router has the vulnerability issue and already gets a fix, the issue will remain if your clients are still not patched. Many people have a misunderstanding on this case, regarding that get the router patched will solve all the problems.
The reality is that, routers that have vulnerabilities should be patched, all the Wi-Fi clients should be patched as well to ensure a safe Wi-Fi network.

That's what I thought I understood from all of this. Android devices which are not vanilla(Pixels or Nexuses) will have to wait a very long time for a patch. My Huawei P9 hasn't gotten an update in 5-6 months. This means I will only use my WiFi at home where I'm at least a bit secure, never in public places. At least Microsoft patched the laptops so at least we're secure there...

I am sure there are millions of active users that are trying to break in. Stop the panic !! it doesn't help anyone.

I have a TP-LINK TD-W8151N 150Mbps Wireless N ADSL2+ Modem Router.
It's not specified on the WPA2 Security (KRACKs) Vulnerability Statement.
Is this model vulnerable to KRACK?
Will we see firmware updates for this model?

Unfortunately I use "WDS bridge mode" with my Archer C9 (V1 and V2) and Archer C8 V1.
I need an firmware upgrade for my Archer C8 and Archer C9.
Thanks in advance.