#krackattack WiFi encryption “Key Reinstallation Attack”

What happened?

A flaw has been discovered and widely reported as breaking WiFi encryption. The attack is a client-based attack and exploits vulnerabilities in the 4-way handshake of the WPA/2 protocol.

As the problem lies within the WiFi standard, the potential impact is widespread, affecting just about every smartphone and PC. The exploit could allow attackers to read WiFi traffic between devices and wireless access points. Certain implementations on Linux and Android devices are more severely impacted, allowing attackers to modify network traffic.

No need to panic

The flaw is not as ubiquitous and severe as the headlines suggest. The following context has been made public:

• Secured protocols (for example, HTTPS) still provide protection for applications.
• Attackers require close proximity to the wireless network – they need to be in range of the WiFi client.
• The attack is complex to execute and there are no public exploit tools currently available to facilitate the exploit (though this will likely change soon!).
• The exploit was responsibly disclosed, so vendors have already released patches (Microsoft) or intend to release soon (Android, Apple).

What can you do?

1) Implement patches when released.
2) Encrypt critical data in motion, independent of the network.
3) Ensure encryption is properly implemented to good standards (don’t invent your own!).
4) Use a virtual private network (VPN) solution on your devices, especially on public WiFi hotspots.
5) Advise users to only access secure sites, with https:// instead of http:// at the start of the address and check for a locked padlock or key in the browser address bar.

If you’re worried about the protection of your sensitive information, ask us how we can help.