Share:

" />
Published On: Tue, Oct 17th, 2017

Severe vulnerabilities affect virtually all Wi-Fi devices and encryption

nsnbc : Researchers in Belgium discovered on Monday that a major Wi-Fi vulnerability affects absolutely every device that supports Wi-Fi. The vulnerability allows attackers to decrypt WPA2 connections. A second vulnerability affects encryption codes.

KRACK Wi-Fi vulnerabilityThe Wi-Fi vulnerability has been dubbed “KRACK”, which is short for Key Reinstallation Attacks. The vulnerability can allow attackers to crack WPA2 which was previously thought of as a secure Wi-Fi encryption protocol. WPA2 is a protocol that secures all modern protected Wi-Fi networks. The vulnerability thus makes virtually all Wi-Fi devices and networks vulnerable to attacks. Statistics by Wigle.net show that WPA2t secures at least 60% of the world’s Wi-Fi networks.

The vulnerability was discovered by researchers at KU Leuven university in Belgium. Researchers there found a way for an attacker to read sensitive information that is sent over a Wi-Fi network using WPA2. Attackers can potentially use this vulnerability to steal sensitive information like credit card numbers, passwords, chat messages, emails, photos, classified files, public records, journalistic sources, industrial secrets, and so one … Experts at Wordfence state that the attack – even though only some 60% of the world’s Wi-Fi networks use WPA2 – works against “all modern Wi-Fi networks. It may also be possible for an attacker to inject malicious information such as malware, ransomware, key-loggers, or viruses into a targeted Wi-Wi network, state experts at Wordfence.

The vulnerability is reportedly in the Wi-Fi standard itself, and not in individual products or their implementations. That means that all products that correctly implement the WPA2 standard are affected. Products that are known to be affected by this at this time include Android, Linux, Apple, Microsoft Windows, Linksys and more. The list of affected vendors is enormous, and vendors including Amazon, Cisco and Netgear are reportedly scrambling to release patches to fix this issue. It is advisable that users contact their own providers including IT providers to assure that all participate in fixing the issue as soon as possible.

Wordfence reports that BleepingComputer has compiled a running list of vendors that will be growing over time as more information about patches becomes available. Users can also find out the technical details on the KRACK attack from the researchers themselves at krackattacks.com. This includes an academic paper and demonstration video, shown below:

What to Do ?!

Wordfence reports that this affects every device you own that uses Wi-Fi. If your device uses public Wi-Fi, you are at an even higher risk. The vendors that make your products are most likely working on patches which they will release in the coming days. However, it may be a good idea to ask your provider if you have any doubts. Better safe than sorry. As they release the patches, you will need to update your devices and hardware. Updates will eventually fix the issue so there will be no need to replace any hardware. Wordfence compiled a list of devices and hardware one will need to update once patches are released. The list includes the following:

  • Desktop workstations
  • Laptops/notebooks
  • Mobile phones
  • Tablets and e-readers that use Wi-Fi
  • Home and office routers
  • Home devices like NEST, Amazon Echo and Google Home
  • Printers, both home and office, that use Wi-Fi
  • Any other device that uses Wi-Fi

Wordfence notes that one should prioritize devices that use public Wi-Fi higher than your other devices. This puts mobile phones and tablets at the top of the list. Your desktop, mobile and tablet devices will prompt you when an important security update is available. Many may update automatically. Most devices also provide an option to manually check for updates. We recommend you do that periodically this week so that you catch any updates as soon as they are released. For routers, printers and other “Internet of things” devices, you may have to sign into the device to manually update the device “firmware.” Again – for routers, you can contact your Internet service provider for help if you are unsure how to update. You may need to consult the manual of other devices or do a Google search to learn if they are affected. nsnbc recommends that users politely make providers aware of their advise and excellence in service to help fix the issue – if necessary, note that other providers might be more helpful and that it is a buyers’ market.

Another vulnerability involves an attack on public key encryption

The other vulnerability was also discovered on Monday and it is known as “ROCA”. Wordfence reports that this vulnerability may weaken the way we authenticate software when installing it. It affects many other systems that rely on public/private key encryption and signing. Fixing this also requires users to update their devices using vendor-released software updates, so keep an eye out for security updates for your devices and workstations that fix any ROCA-related issues. Experts at Wordfence stress that “It is imperative that we get the word out about these vulnerabilities so that our friends and colleagues can update their devices before they are exploited”.

CH/L – nsnbc 17.10.2017

About the Author

- nsnbc international is a daily, international online newspaper, established in 2013. nsnbc international is independent from corporate, state or foundation funding and non-partisan. nsnbc occasionally republishes selected articles from other media. Republication of articles does not imply that we agree with media's editorial policy. nsnbc international is free to read and free to subscribe to. We appreciate and depend on modest donations from our regular readers; such as the equivalent of the price of one print newspaper per month.

Leave a comment

XHTML: You can use these html tags: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>