KRACK WiFi Exploit
KRACK WiFi Exploit
If you haven’t been paying attention to the news, it’s time to get patching again! Another vulnerability has been exposed, affecting virtually all WiFi enabled devices globally.
Known as KRACK – short for Key-Reinstallation Attack, this vulnerability can be abused to steal sensitive information such as credit card numbers, chat messages, emails etc.
Depending on the network configuration, hackers may also be able to inject ransomware into websites. Microsoft secretly patched this last week with the release of their October Cumulative update, but not all vendors have been as quick to respond.
What devices are affected?
This affects all WiFi networks that use the WPA2 (WiFi Protected Access II) protocol. At present, every device on WiFi networks using this protocol may be exploitable, including those with Windows, MacOS, Linux, Android and Apple iOS Operation Systems!
How does the exploit work?
In summary, an attacker finds a wireless network with this encryption vulnerability and creates a duplicate wireless network to perform a ‘Man-in-the-Middle’ attack. This means that legitimate traffic is redirected through a device that inspects the traffic, and attempts to capture any readable sensitive data.
As with many ‘Man-in-the-Middle’ attacks, it has the potential to manipulate or insert malicious code or links into the traversing traffic.
If you are interested in looking at exactly how devastating the attack could be, check out this demonstration video by Mathy Vanhoef who discovered the vulnerability.
The good news?
Remote attacks aren’t possible with this hack alone. For most attacks, the hacker would have to be directly connected to the WiFi and therefore would need to be within physical proximity to the device. The exploit doesn’t uncover or decrypt the actual WiFi password itself and can’t decrypt traffic protected by encryption that isn’t related to WPA2 WiFi signal encryption itself (e.g. HTTPS).
Additionally, it’s likely that you don’t have too many protocols relying on WPA2 security alone. When browsing to a HTTPS website, the browser is negotiating an additional layer of encryption. Accessing secure websites over WiFi is still regarded as safe.
Patch, Patch, Patch! Although some are still in the process of developing and releasing patches, most of the large vendors already have. The Options Desktop Management Team is working closely with our contacts in the industry to identify these releases and coordinate patch deployment across endpoints. Cover your desktops and laptops, but don’t forget about personal devices!
For devices that do not have a vendor patch released yet, we recommend you use only wired or securely encrypted (e.g. VPN / Citrix) methods to connect to corporate resources. Until endpoints are patched, avoid using wireless connectivity where possible and disable wireless on your endpoint when not in use.