KRACK is a Wi-Fi hack that makes everyone vulnerable to attack. You can patch the holes, but if you don’t hackers could be stealing your personal data as you read this article. Read on and update now!
KRACK is not a misspelling of crack. We’re not talking about cocaine or plumbers, and there are no broken sidewalks. Frankly, this is a lot more serious. KRACK stands for Key Reinstallation Attack and was a closely guarded secret for weeks until the research was just published. What’s affected? Wi-Fi networks everywhere.
WOW. That’s my reaction when I think about it. Researchers just uncovered a major flaw in WPA2 protocol? That is like saying people learned how to hack microwaves! Everyone uses Wi-Fi, all-day, all-the-time. Cell phones, laptops, tablets, wearables, they all use Wi-Fi. And for the 98% of Americans who connect to it, that is a pretty serious problem.
Those hardest hit are the Android and Linux users. That doesn’t mean that macOS and Windows are getting off easy though. It affects the core of WPA2 and can steal tons of data from a phone or computer. According to researchers, it can be patched, but how many people will get to that before it’s too late?
How It Works
It’s all about the 4-way handshake that occurs when a client joins a WPA2-protected Wi-Fi network. This handshake assures that both the credentials of the client and access point are correct. KRACK works by decrypting the data that is sent from the phone or device to an access point. It then forces the phone to reinstall an all-zero encryption key, instead of its normal encryption key. It tricks the client into thinking that this key is correct. This allows the hacker to then have access to information on the device.
“This can be abused to steal sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on,” researcher Mathy Vanhoef, of the Katholieke Universiteit Leuven in Belgium wrote. “The attack works against all modern protected Wi-Fi networks. Depending on the network configuration, it is also possible to inject and manipulate data. For example, an attacker might be able to inject ransomware or other malware into websites.”
Access points, phones, computers, and anything that connects to Wi-Fi is vulnerable. Now, some might think that if you only connect to sites that employ SSL certificates (HTTPS), you’ll be safe. Unfortunately, that’s not the case. If the site is configured improperly, it can easily be forced to drop encrypted traffic and transmit, instead, unencrypted data.
How To Stay Safe
Luckily, all you need to protect yourself from this problem is an easy patch (hopefully). Microsoft released a patch for Windows, and others are releasing them daily. Here is what Vanhoef said about the patches.
“Luckily [WPA2] implementations can be patched in a backwards-compatible manner. This means a patched client can still communicate with an unpatched access point, and vice versa. In other words, a patched client or access points sends exactly the same handshake messages as before, and at exactly the same moments in time. However, the security updates will assure a key is only installed once, preventing our attacks. So again, update all your devices once security updates are available.”
As long as you update, you can stay safe from KRACK, one of the biggest vulnerabilities in Wi-Fi security ever. UPDATE. Can’t stress that enough.