This week everyone in the security world has been talking about the KRACK WiFi vulnerability. In this blog post we’re going to give a very high-level explanation of the security flaw and share a few things you can do to stay safe.
First things first — KRACK stands for Key Reinstallation Attack. Researcher Mathy Vanhoef discovered the security flaw, which is essentially a serious vulnerability in the WPA2 encryption protocol that most devices and routers rely on to encrypt WiFi traffic.
“This can be abused to steal sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on,” Vanhoef describes on his KRACK website. “The attack works against all modern protected WiFi networks. Depending on the network configuration, it is also possible to inject and manipulate data. For example, an attacker might be able to inject ransomware or other malware into websites.”
According to the experts, almost every mobile/desktop device on the planet is affected and will need to be patched. IOT (Internet of Things) devices and Android devices don’t often get updates, which will make things tough.
A few considerations: According to this TechCrunch story, the hacker can’t look at traffic encrypted properly using HTTPS; they can’t steal your WiFi password; and they need to be in range of your WiFi network to take advantage of the vulnerability.
So what can you do?
- Run updates on all routers and WiFi devices — laptops, phones, tablets with the latest security patches. Be sure and update your router’s firmware.
- If you have a router from an Internet Service Provider (ISP), call the company and ask when it will be patched.
- Once you update the router, it’s a good idea to go ahead and change your passwords, according to experts.
- You might want to skip using Wi-Fi until patches are available, according to this Forbes story.
- Also, you could only visit HTTPS encrypted websites.
- On your phone, you can disable your WiFi and just use cellular data instead if you want to ensure no one is watching.
- Don’t forget about your Internet of Things devices. “Consider which of those devices pose the most serious risk if unencrypted traffic is intercepted,” according to the TechCrunch story, which gives the example of a connected security camera and how it could be used for “attackers to snoop on raw video footage inside your home.”
Here’s a great list of firmware patch statuses.
Photo Credit: WiFi symbol, Christiaan Colen, Creative Commons Attribution-ShareAlike 2.0