Every Wi-Fi network at risk of unprecedented 'Krack' attack security flaw


The US-CERT has already released an advisory to a limited set of organizations, with consumer and enterprise WPA1 and WPA2 networks affected.

Currently, 41 percent of Android devices are vulnerable to this attack. According to a security researcher who spoke to Ars Technica, hackers can compromise encryption around Wi-Fi traffic by establishing a key for encrypting such traffic in certain ways. It has the potential to be Heartbleed on steroids (or on KRACK, if you insist) and there's pretty much nothing any of us can do about it, because no one has been really focusing on what would happen if it was. That key is unique to that connection, and that device.

Vanhoef has nicknamed his discovery "KRACK" short for "Key Reinstallation Attacks".

The weakness lies in the third step of the four-way handshake the protocol uses to authenticate devices onto the network. This is achieved by manipulating and replaying cryptographic handshake messages.

Devices running Linux or Android 6.0 or later are particularly vulnerable to a CRACK and a hacker should be able to decrypt all the data that victims using these devices transmit relatively easily. IP packet headers, in turn, provide exactly that.

For starters, any attacker exploiting the vulnerability needs to physically be on the same Wi-Fi network as you.

Concretely, attackers can use this novel attack technique to read information that was previously assumed to be safely encrypted. The affected Android versions are about half of all Android devices that are in use worldwide. This implementation of WPA tries to defend against key reuse by wiping it from RAM after it is used for the first time.

The KRACK vulnerabilities define new approaches to exploit the way that WPA2 generates a session encryption key. The attackers can easily capture and decrypt the data as per the demonstration.

Today's disclosure is documented across ten CVEs, each describing a different style of key reinstallation attack on different parts or modes of WPA.

The site adds that even though the likes of Aruba and Ubiquity have updates available to mitigate these vulnerabilities, a large number of WI-Fi devices may not be patched in time or at all by their makers. Wi-Fi routers, Android phones, iOS devices, Apple computers, Windows computers, Linux computers - all of them. A broader warning was sent out by the CERT to more vendors on August 28. The second option was the creation of an un-official WPA3 without the help of the Wi-Fi Alliance.

The details of all this are due to be published shortly via several vulnerability announcements (CVE-2017-13077, 13078, 13079, 13080, 13081, 13082, 13084, 13086, 13087, 13088) and the collection of flaws are being referred to as KRACK (aka - Key Reinstallation Attacks).

"Until the issue is fixed via a router firmware update - if possible - or WPA2 is superseded, everyone should adopt an additional level of caution when sending sensitive information to online servers", he said.

There's some bad news on the security front this morning, namely that your Wi-Fi network is at risk of being hacked thanks to a freshly uncovered vulnerability.

This "severe" security flaw means that home networks will be under significant risk.

"The easiest way to protect yourself is to use a Virtual Private Network (VPN)", continued Migliano.