It has been revealed that the security protocol WPA2, used by most domestic and commercial Wi-Fi networks has a vulnerability which allows the decryption of any data traffic.
Wi-Fi Protected Access (WPA,WPA II) became available in 2003 developed by The Wi-Fi Alliance as response to serious weaknesses researchers had found in the previous system, Wired Equivalent Privacy (WEP). Specifically WPA uses TKIP Temporal Key Integrity Protocol which employs a per-packet key, which means it dynamically generates a new 128-bit key for each packet sent and thus prevents the types of attacks that compromised WEP. Where the 64 bit or 128 bit key was generated only once at the endpoints and through monitoring the traffic the key could be revealed.
The vulnerability affects many operating systems and devices, including Android, Linux, Apple, Windows, OpenBSD, MediaTek, Linksys and others. Potentially exposing wireless internet traffic to malicious eavesdroppers and attacks.
The researcher who discovered the weakness. Mathy Vanhoef, a security expert at Belgian university KU Leuven said, “Attackers can use this novel attack technique to read information that was previously assumed to be safely encrypted and emphasised that, “This can be abused to steal sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on”. Vanhoef stressed that “the attack works against all modern protected Wi-Fi networks. Depending on the network configuration, it is also possible to inject and manipulate data. For example, an attacker might be able to inject ransomware or other malware into websites.” The researchers have given the weakness the codename KRACK, short for Key Reinstallation AttaCK.
The “Krack” attack works by exploiting the “handshake” that a Wi-Fi network and a device give to each other when the latter wants to join. Usually, the two decide on an encryption key for all future traffic, meaning that each device will only be able to read data if it has that key. But researchers have found that process can be tricked, by giving the key that’s already in use which allows decryption of any of the messages that are being sent over the network.
“Currently, all modern protected Wi-Fi networks use the” specific kind of handshake that is liable to attack, wrote Mr Vanhoef. “This implies all these networks are affected by (some variant of) our attack”, he wrote, noting that it didn’t simply apply to any one form of Wi-Fi Protected Access. Manufacturers were first made aware of this vulnerability in July and many have rolled out patches. Android is perhaps among the more vulnerable of devices, because of the relatively slow roll out of software updates across the various versions.
There is very little the average user can do about the problem. Changing your Wi-Fi password will make no difference, for instance, since the attack doesn’t use that password. It’s important that everyone updates their software as soon as it becomes available.
It’s important to keep calm because not everything you do on the internet relies on the security protocol WPA II. For example, every time you access an https site your browser is negotiating a separate layer of encryption. So its important to check for the padlock icon in your browser.
