An open source report has confirmed a vulnerability in the WPA2 protocol, which is used to secure most modern WiFi networks.
This vulnerability has been named “Key Reinstallation Attacks” or KRACK . Without going into the technical details as how the vulnerability works, it simply allows for the exposure of encrypted data sent via WiFi.
This vulnerability would most likely be used to steal personal information and credentials on a non-secure page, while the user is attached to a large, public WiFi network.
All devices that properly deploy the WPA1 and WPA2 protocol are vulnerable and devices need to patched.
As the use of WPA1 and WPA2 is wide spread, the release of patches from all affected vendors might take significant lead time. In addition, as a user of a WiFi network, there does not seem to be an easy way to know if the WiFi network that you are connecting to is vulnerable or has been patched.
STAY SAFE RECOMMENDATIONS
1. Keep your machine’s operating system patched and up-to-date
2. Keep your machine’s anti-virus patched and up-to-date
3. Connect to WiFi networks that you know has been patched and is no longer vulnerable
4. When connecting to WiFi networks whose vulnerability status is unknown (even if the WiFi network uses a password), do not exchange confidential data. If possible, limit use to HTTPS websites only
5. Use a Virtual Private Network (VPN) connection to re-route and mask all your internet bound traffic via a trusted host
6. Skip connecting to an unknown WiFi network but instead use 3G/4G tethering through your mobile phone
7. Elect to use the wired ethernet connection, whatever possible.
If you need help in determining if your WiFi infrastructure is vulnerable or needs patching, please feel free to contact us.
References:
Details of KRACK = https://www.krackattacks.com/
List of Vendors with Patches = https://char.gd/blog/2017/wifi-has-been-broken-heres-the-companies-that-have-already-fixed-it
ManagedIT.SG is an IT Support, IT Solutioning and Managed IT Service Provider specializing in serving Small Businesses in Singapore. Call us at +65 6748 8776 and let us manage your Small Business IT today!