Credit: Christiaan Colen
A researcher has released details on vulnerabilities in the Wi-Fi Protected Access II (WPA2) protocol, which he calls KRACK.
Attacks taking advantage of the issues that makeup KRACK will work against all modern protected Wi-Fi networks. To put it another way, if a given device supports Wi-Fi it is likely impacted by the KRACK vulnerabilities.
This is because the weaknesses are in the Wi-Fi standard itself, not in a given product or implementation.
Details of the problems with WPA2 were revealed on Monday morning by Mathy Vanhoef, a researcher studying at Katholieke Universiteit Leuven (KU Leuven) with the imec-DistriNet Research Group.
Several months ago, in a brief to those impacted the most, US-CERT described the disclosure as such:
"US-CERT has become aware of several key management vulnerabilities in the 4-way handshake of the Wi-Fi Protected Access II (WPA2) security protocol. The impact of exploiting these vulnerabilities includes decryption, packet replay, TCP connection hijacking, HTTP content injection, and othersâŚ"
The brief goes on to say that since the vulnerabilities are protocol-level issues, "most or all correct implementations of the standard will be affected."
A draft version of the paper being presented Monday, later officially released by Vanhoef after it was leaked, says the KRACK attack "abuses design or implementation flaws in cryptographic protocols to reinstall an already-in-use-key."
"Concretely, attackers can use this novel attack technique to read information that was previously assumed to be safely encrypted. This can be abused to steal sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on," explains a post on the website Vanhoef developed to disclose KRACK.
Again, as the notice by US-CERT pointed out, KRACK isn't just about compromising login credentials. There are layers of risk and potential damage when it comes to attacks on WPA2 with KRACK.
However, it's important to note that the main attack is against the 4-way handshake, so it's going after the client â not access points. Also, it's important to remember that KRACK doesn't render the mathematics used to prove the security of the 4-way handshake useless.
As a proof-of-concept, Vanhoef released a video of a KRACK attack against Android, noting that such attacks are devastating attain Linux and Android versions 6.0 or higher.
What you should do about KRACK:
For home users, the going advice is to update their clients (phones and laptops), and contact their ISP to see if their gear needs an update. At no time should they stop using WPA2.
For those working in the office, Vanhoef suggested disabling client functionality on routers and access points, and disabling 802.11r.
The following CVE-IDs are related to the issue, at the time this story was posted, none of them were updated with additional information:
CVE-2017-13077, 13078, 13079, 13080, 13081, 13082, 13084, 13086, 13087, 13088
Please note: While the KRACKen has been released, this story is developing. According to Vanhoef 41-percent of Android devices are vulnerable to KRACK attacks, and in the time between writing the paper and disclosure, attacks against macOS and OpenBSD have become easier.
CSO will update it with further information as details become available. We've reached out to several vendors and ISPs, and will share their comments once they respond.