Kr00K: the Wi-Fi flaw hiding in hotel access point firmware

Kr00K, tracked as CVE-2019-15126, is a flaw in Broadcom and Cypress FullMac Wi-Fi chips that lets a nearby eavesdropper recover pieces of supposedly protected wireless traffic. The silicon vendors and device makers shipped fixes between late 2019 and 2020, but six years on the interesting question for hotels is not the vulnerability itself. It is whether the firmware running the access point fleet ever took those updates.

The facts

ESET discovered Kr00K and presented it publicly in February 2020, alongside the RSA Conference in San Francisco. The company's own conservative estimate put the affected install base at over one billion devices. The chip family shows up in phones, tablets, laptops, smart speakers, e-readers, routers and access points from vendors including Apple, Amazon, Asus, Dell, Google, HP, Huawei, Lenovo, Microsoft and Samsung, plus the Raspberry Pi 3 and Asus and Huawei routers. Both WPA2-Personal and WPA2-Enterprise are affected whenever data confidentiality relies on AES-CCMP encryption. The researchers trace the bug's lineage to KRACK, the 2017 handshake research: Kr00K first surfaced as one plausible explanation for an all-zero key reinstallation they observed during KRACK testing.

How it works

WPA2 (Wi-Fi Protected Access 2) negotiates session keys through a four-way handshake. One derived key, the 128-bit temporal key, encrypts each unicast data frame between a client and an access point. When a device leaves a network, through roaming, interference or switching Wi-Fi off, the session disassociates and the temporal key is cleared from chip memory, which is normal behavior. The defect is what happens next: frames still sitting in the chip's transmit buffer get encrypted with an all-zero key and pushed over the air. A zero key makes decryption trivial, so anyone in radio range who captured those frames reads fragments of cleartext.

Three details matter for a defender.

Forced disconnection. Deauthentication and disassociation management frames are neither authenticated nor encrypted, so an attacker within range can trigger the buggy behavior at will on a chosen target, repeating disconnections to accumulate fragments. Ars Technica, covering the disclosure, put the volume at several kilobytes of retransmitted data per disconnection.

Patched clients are not safe. ESET's research paper notes that a fully patched client connected to a vulnerable access point can still have data transmitted by that access point decrypted. Personal device hygiene does not solve this. The attack surface shifts to the infrastructure, which is exactly the access point an operator controls and a guest does not.

The leak is not limited to obvious secrets. Navigation identifiers, such as DNS queries and the SNI name of the site being visited, can appear in recovered fragments even when the site itself is served over HTTPS.

The firmware currency question

At disclosure time, patches were available for most or all affected devices, but nobody knew how many had installed them, and Ars Technica flagged that routers and access points often stay unpatched indefinitely. That is what keeps the story readable for hotels, an analysis we flag as our own.

On one side stands the guest device fleet: phones, tablets and laptops that turn over every two or three years and update automatically. On the other stands the property's Wi-Fi fleet, bought in tranches across several refresh cycles, deployed by integrators and maintained on an operations schedule. Five to eight year old access points are common in lobbies, ballrooms and conference space, the exact locations where high-value guests cluster. A passive attacker sitting in one of those spaces installs nothing on anyone's device. It just listens to frames leaving an unpatched access point. The classic evil twin, a fake network advertising the conference's own SSID, remains a separate and well-known risk. Kr00K's reminder is harsher: eavesdropping can work with no deception at all.

What to check

Inventory every access point by make, model and firmware version, then obtain written confirmation from the vendor or integrator that the Kr00K patch level is applied. Track the support lifecycle of each model and replace end-of-support units outright, since no future firmware will arrive for them. Keep guest Wi-Fi segmented from operational networks, and hold the line on end-to-end encryption: Kr00K does not break TLS, it exposes fragments and metadata when the wireless layer misbehaves, so HTTPS remains the guest data's last and strongest layer. Finally, put wireless firmware currency into the annual security audit as a named checklist item, alongside the migration to WPA3, which hardens management frame protection and reduces an attacker's ability to force the disconnections that trigger the flaw.

To our knowledge, Kr00K has never been documented being exploited against a hotel. That is not the point. It is a case study in firmware debt: a flaw the silicon vendors paid to fix in 2019 and 2020, whose bill is still settled access point by access point, property by property.