bobbyfromtweets,
As someone that worked on both the hardware and the code that runs on the Gen1 and Gen2 hardware I can tell you we don’t run any form of linux.
I apologize if you feel the response so far has not been adequate. Please keep in mind that the frontline support people are not experts in this field and it’s not often that they have to respond to customers concerning issues like this. Also it’s very hard to word a statement about something like this that reassures non-technical people while at the same time gives all the finer details that people like you and me want to know to assess the situation for ourselves.
We have been getting together with the wifi hardware vendors and working out how gen1 and gen2 are affected and what we need to do going forward. For Gen1 the wifi vendor put out a statement pretty quickly and that’s what you see linked in our page. For Gen2 we just got a response from the wifi vendor saying they are identifying the issues in their implementation of WPA and will be supplying us with an update.
You’ve written a lot about how we bought an off the shelf solution threw some code on top and put it out there. Again, as someone that worked on this I can tell you nothing is further from the truth. In the IoT world there are only a few options on the parts you can use for the wifi side of a product and all of them use proprietary firmware (software for hardware) provided by the vendor that only they can update. This is true even in the open source world; If you’re using wifi on Linux or Android you’re using proprietary software that only the vendor of your wifi chip can update.
Both Gen1 and Gen2 support over the air updates. Both can receive updates to their OS, application code and the previously mentioned wifi firmware. Both have received updates since they were launched and will be receiving updates to address issues like this.
Regarding KRACK itself:
Almost all implementations of WPA are affected by the “handshake” issues because everyone followed the specifications. Everyone has to follow the specifications to get their products certified. For Linux and Android the problem is much worse as their WPA implementation contains extra bugs that amplify the problem. We do not use that WPA implementation.
KRACK is an attack against a wifi client (in this case a Gen1 or Gen2 controller). So if someone successfully uses the exploits they will be able to see traffic between that client and the access point it’s connected to. This is undesirable but for our controllers there isn’t a lot of data going back and forth and none of it is sensitive data. For the most part the controllers use a single connection to our servers. That connection is encrypted and at connection time we validate the identity of both the controller and the server.
The demo video on youtube that shows an attacker downgrading match.com from HTTPS to HTTP is worrying but we don’t use HTTPS and we don’t connect to our server in such a way that an attacker can force us to not use SSL/TLS. It’s encrypted or nothing. Then on top of that we are validating that both ends of the connection are who we think they are.
If you have any more technical questions or concerns I’ll be happy to answer them.
Daniel