Think your Wi-Fi network is secure? Think again.
From our Cybersecurity experts
A major vulnerability in the protocol that secures the vast majority of the world’s Wi-Fi networks has just been reported.
What was discovered?
Mathy Vanhoef, a security researcher with KU Leuven in Belgium, discovered a vulnerability in Wi-Fi Protected Access 2 (WPA2) that can be exploited using a Key Reinstallation Attack (which he dubs KRACK). The attack is performed by manipulating and replaying messages in the WPA2 “4-way handshake”, the process by which clients attempt to join the Wi-Fi network. If successful, the attack can allow a malicious party to eavesdrop on communications traversing Wi-Fi networks, and potentially steal sensitive information such as credit card numbers, banking information, personal information, etc. Vanhoef also says that in some cases an attacker could even inject ransomware or other types of malware into websites that the victim is browsing.
What does this mean to me?
Most implementations of WPA2 (and the predecessor, WPA) are likely to be vulnerable. If you own Wi-Fi infrastructure, or you connect to Wi-Fi networks, you could very likely be affected.
What can I do to protect myself?
Changing your Wi-Fi password will not prevent this attack. In fact, this attack takes place without actually disclosing the Wi-Fi password. Therefore, other steps should be taken.
Step 1 Patch: The first step should be to install vendor patches for this vulnerability as soon as possible. Note that since this vulnerability is so new, many vendors have not yet released a fix. Until a patch is released, monitor your vendors’ websites regularly to stay on top of this. This vulnerability affects both the wireless access point as well as the clients that connect to it, so you will need to update the operating systems of your Wi-Fi clients as well as the firmware of your wireless access points to be fully protected.
Step 2 Use Encryption: When browsing the web on Wi-Fi networks, use encrypted connections (i.e., HTTPS) whenever possible. Vanhoef warns, however, that in some situations this protection can still be bypassed.
Step 3 Use a VPN: If you use a Virtual Private Network (VPN) connection to connect to your corporate network from Wi-Fi networks, ensure that the VPN is enabled, as this will establish an encrypted tunnel between your device and the corporate network. By doing so, even if someone is listening to the traffic on the Wi-Fi network, your encrypted tunnel will still be private.
Is there another more secure protocol that I should be using instead of WPA2?
No, at the moment, WPA2 is still your best bet.
Above all, be sure to exercise caution when handling sensitive data or entering user IDs and passwords over Wi-Fi, until vendor patches have been applied to correct the issue.
References
https://www.krackattacks.com/
https://papers.mathyvanhoef.com/ccs2017.pdf