WiFi Alliance introduced WiFi Certified WPA3 to replace current WPA2 security standard

WiFi Alliance has just introduced WiFi CERTIFIED WPA3 (Wi-Fi Protected Access version 3) as the next generation WiFi security standard, bringing new capabilities to enhance WiFi protections in both personal and enterprise wireless networks.

Key capabilities of WPA3 include:

• WPA3-Personal: more resilient, password-based authentication even when users choose passwords that is simple to remember. WPA3 will leverage on Simultaneous Authentication of Equals (SAE), which is a secure key establishment protocol between devices, to provide stronger protections for users against password guessing attempts by third parties.
• WPA3-Enterprise: offers the equivalent of 192-bit cryptographic strength, providing additional protections for networks transmitting sensitive data, such as government or finance. The 192-bit security suite ensures a consistent combination of cryptographic tools are deployed across WPA3 networks.

With the evolution of WiFi security from current WPA2 to WPA3, we can expect:

• WiFi password to be a lot more difficult to crack.
• WiFi CERTIFIED Easy Connect - IoT devices can connect to WiFi network more easily.
• WiFi data sniffed and recorded without knowing your password will not be able to decrypt even if your password is obtained later.
• WiFi CERTIFIED Enhanced Open - communication in open connection (WiFi connection without the need of any password) will also be encrypted, therefore much more secured than WPA2 open connection. In current WPA2, if the WiFi is connected using open connection without the need of password, the communication between the WiFi connected device and access point is not encrypted.
• Stronger WiFi encryption by replacing the existing PSK (Pre-Shared Key) system in WPA2 with the new SAE system.

Anyhow, in order to enjoy the benefits of using WiFi WPA3, both the access point (or wireless router) and the connecting device must support this new WiFi security standard. Devices that support WPA3 will probably hitting the market from year 2019 onwards and gradually replacing the existing which only support up to WPA2.

My Dell DA300 6-in-1 USB-C mobile adapter

My Dell Inspiron 5370 laptop has limited output ports as a trade-off for its slim and lightweight design. It only has 1 USB 3.1 Gen 1 (Type-C) port with Power Delivery/DisplayPort, 1 HDMI 1.4b port and 1 combo audio port.

This means that it can only connect to the network using WiFi connection, as there is no Ethernet port. It is also not able to output its display to projector using VGA connector unless making use of an adapter to convert its HDMI output to VGA.

Luckily, Dell has made available a DA300 6-in-1 USB-C mobile adapter which is able to convert the USB-C port of the laptop into:

• HDMI 2.0 port that supports 4K display output
• DisplayPort (DP) 1.4 that supports 4K display output
• VGA port that supports 1080p full HD display output
• Ethernet network port that supports MAC address pass-through, PXE Boot, and Wake-On-LAN
• USB-A port with up to 10 Gbps data transfer speed
• USB-C port with up to 10 Gbps data transfer speed

This Dell DA300 mobile adapter is plug-and-play on supported Windows 10 computer. It can be used straightaway without the need to install any driver.

It offers seamless video, network, and data connectivity, in a neat, compact design. It price of around RM300 is quite reasonable for its 6-in-1 functions and its innovative design.

About the Cyber Kill Chain

The Cyber Kill Chain introduced by Lockheed Martin is a cybersecurity model to describe, in general, how a computer intrusion (hacking) through IT network is carried out in 7 distinguished stages. It was developed based on military attack kind of thought.

Anyhow, there is no common SOP in cyber-attack, and hackers are not necessary following the Cyber Kill Chain of planning and action in their attacks.

This model is however useful to plan for cyber-defense strategy and measure, and also for cyber-threat analysis to a networked computer system.

The 7 stages in Cyber Kill Chain are:

• Reconnaissance - the victim is observed, analyzed and studied by the attacker.
• Weaponization - tools are developed or obtained to exploit the weaknesses found in the victim.
• Delivery - the "weapon" is deployed to the targeted victim.
• Exploitation - once the "weapon" is successfully deployed, it will start working by looking for vulnerabilities in the victim's computer system.
• Installation - at the stage, access is silently obtained by the "weapon". It will find it way to communicate to the attacker using the computer network. Normally, a backdoor is established to enable such linkage.
• Command and Control - remote access to the victim's computer system is made available to the attacker. The attacker can take over control of the compromized system and issue command to it.
• Actions on Objectives - with the control, the attacker is able to proceed with the objectives of the attack, such as data exfiltration, data destruction, data encryption for ransom, etc.

With reference to this model, the defending party can plan for countering the attack by the famous 4 Fs strategy, namely:

• Find the enemy
• Fix the enemy
• Fight the enemy
• Finish the enemy