A WPA2 Wifi Security Vulnerability is Exposed through KRACK
So, the WPA2 Protocal has a security flaw that has been exposed. This security flaw, apparently, makes ALL of Wifi vulnerable to hackers. That’s the cliffnotes version of what will follow.
The internet is all abuzz with news that EVERYONE may be vulnerable to having ALL of their private information they share on the interwebs exposed for all the world to see, should hackers decide, for whatever reason, that you merit such an exposure.
The vulnerability to such exposure comes through the WPA2 protocol. The exposure as revealed today, October 16th, at 8AM EST. Researchers have revealed a hack that breaks the WPA2 security protocols called KRACK, or Key Reinstillation Attacks.
Here is more on the hacking vulnerability of the WPA2 protocol by itpro.co.uk
The global security community is reeling from the discovery of a devastating flaw in the WPA2 wireless encryption protocol, which affects virtually every modern Wi-Fi connection.
Discovered by KU Leuven researcher Mathy Vanhoef, the flaw is being referred to as ‘KRACK’ – short for key reinstallation attack – and involves exploiting a design flaw in the four-way handshake used by the WPA2 wireless protocol, along with numerous other cryptographic protocols.
“Every Wi-Fi device is vulnerable to some variant of our attacks,” Vanhoef warned. It can be exploited to access virtually any information being transmitted over a Wi-Fi connection, including login credentials, photos, financial information and more.
As the article goes on to explain, KRACK works like this:
When a client device (like a laptop or smartphone) wants to join a network, the four-way handshake determines that both the client device and the access point have the correct authentication credentials, and generates a unique encryption key that will be used to encrypt all the traffic exchanged as part of that connection.
This key is installed following the third part of the four-way handshake, but access points and clients allow this third message to be sent and received multiple times, in case the first instance is dropped or lost. By detecting and replaying the third part of the four-way handshake, attackers can force the reinstallation of the encryption key, allowing them to access the packets being transmitted.
This essentially means, as of right now, if you are using wifi to access the interwebs, you are vulnerable to having all your stuff exposed. Good times, great fun. I am sure, because I believe in your web tech nerdles, that a security patch/fix is forthcoming and we can all go back to enjoying our interwebs like we did before, secure in the knowledge that no one can peek in on what we’re doing online (ok, so maybe this thing really doesn’t change our reality all that much after all).
Update to this story. One of our viewers on our YouTube channel, Patrick Boerman, pointed this article out to us that shows yes, yes there is a patch and it MAY have been available even before KRACK revealed the vulnerability:
From The Verge
echnology companies are starting to respond to a new Wi-Fi exploit affecting all modern Wi-Fi networks using WPA or WPA 2 encryption. The security vulnerabilities allow attackers to read Wi-Fi traffic between devices and wireless access points, and in some cases even modify it to inject malware into websites. Security researchers claim devices running macOS, Windows, iOS, Android, and Linux will be affected by the vulnerabilities.
Microsoft says it has already fixed the problem for customers running supported versions of Windows. “We have released a security update to address this issue,” says a Microsoft spokesperson in a statement to The Verge. “Customers who apply the update, or have automatic updates enabled, will be protected. We continue to encourage customers to turn on automatic updates to help ensure they are protected.” Microsoft is planning to publish details of the update later today.
While it looks like Android and Linux devices are affected by the worst part of the vulnerabilities, allowing attackers to manipulate websites, Google has promised a fix for affected devices “in the coming weeks.” Google’s own Pixel devices will be the first to receive fixes with security patch level of November 6, 2017, but most other handsets are still well behind even the latest updates. Security researchers claim 41 percent of Android devices are vulnerable to an “exceptionally devastating” variant of the Wi-Fi attack that involves manipulating traffic, and it will take time to patch older devices.