WPA2 Cracked – Is Your WiFi Under Threat?

WPA2 encryption has been breached. The crack exposes WiFi users to various security threats. A Belgian security researcher from the University of Leuven, named Mathy Vanhoef, has discovered a serious flaw in the widely uses WPA2 WiFi security protocol. The flaw is related to the security protocol itself rather than devices that use it such as Linksys, TP-Link, D-Link, Cisco, Asus, and other well-known routers.

WPA2 Cracked – KRACK is Born

KRACK, which means Key Reinstallation Attack was the name given to the crack by its inventor Mathy Vanhoef. The researcher had the following to say about his crack: “Our main attack is against the 4-way handshake of the WPA2 protocol. This handshake is executed when a client wants to join a protected Wi-Fi network, and is used to confirm that both the client and access point possess the correct credentials. At the same time, the 4-way handshake also negotiates a fresh encryption key that will be used to encrypt all subsequent traffic. Currently, all modern protected Wi-Fi networks use the 4-way handshake. This implies all these networks are affected by our attack. For instance, the attack works against personal and enterprise Wi-Fi networks, against the older WPA and the latest WPA2 standard, and even against networks that only use AES. All our attacks against WPA2 use a novel technique called a key reinstallation attack.”

Basically, KRACK carries out a Man-in-the-Middle Attack which forces WiFi users to re-install the encryption key used to protect WPA2 traffic. Krack can also be used to inject and manipulate data as well as eavesdropping on communications.

Vanhoef even setup a microsite to provide more info about KRACK and how the attack works.

What Can You Do?

At the moment, users have been urged to continue using WPA2 pending the availability of a fix. Follow the steps below to increase your WiFi’s security:

• Changing the password of your Wi-Fi network does not prevent the attack. However, we do strongly encourage using strong passwords to protect all your accounts.
• Keep your router’s firmware up-to-date. The same applies to all other devices you connect to the Internet.
• Use VPN to add an extra layer of privacy and security to all the activities you carry out online.

WPA2 Cracked – What Next

The WiFi alliance, which is an organization that certifies that Wi-Fi devices conform to certain standards of interoperability, are putting together steps that will help path the vulnerabilities discovered by Vanhoef. Their plan includes communicating  details on this vulnerability, including remedies, to device vendors. Additionally, vendors are encouraged to work with their solution providers to rapidly integrate any necessary patches.