Now, researchers have found critical vulnerabilities in the 13-year-old protocol that can allow attackers, within the physical range of your network, to decipher the WiFi password and intercept the internet traffic.
They might be able to get access to any unencrypted traffic between the device and the access point or even decrypt WiFi. Further possibilities include content injection.
The flaw lies in the 4-way handshake used to create an encryption key to secure the traffic, according to a researcher. And the vulnerability can be seen in action in the form of a proof-of-concept known as KRACK (Key Reinstallation Attacks).
The attack vector has been known for weeks but it was scheduled for a coordinated disclosure on Monday (8 AM PST). The following CVEs carrying more details will be published.
- CVE-2017-13077: Reinstallation of the pairwise encryption key (PTK-TK) in the 4-way handshake.
- CVE-2017-13078: Reinstallation of the group key (GTK) in the 4-way handshake.
- CVE-2017-13079: Reinstallation of the integrity group key (IGTK) in the 4-way handshake.
- CVE-2017-13080: Reinstallation of the group key (GTK) in the group key handshake.
- CVE-2017-13081: Reinstallation of the integrity group key (IGTK) in the group key handshake.
- CVE-2017-13082: Accepting a retransmitted Fast BSS Transition (FT) Reassociation Request and reinstalling the pairwise encryption key (PTK-TK) while processing it.
- CVE-2017-13084: Reinstallation of the STK key in the PeerKey handshake.
- CVE-2017-13086: Reinstallation of the Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) key in the TDLS handshake.
- CVE-2017-13087: Reinstallation of the group key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame.
- CVE-2017-13088: Reinstallation of the integrity group key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame.
Also, a new website krackattacks.com will be made live to describe the issue. One of the researchers has also put up a near-empty GitHub repo contained various tags related to the KRACK attack.
On November 1, the researchers will discuss their paper titled “Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2” at the ACM Conference on Computer and Communications Security, Dallas.
It’s not likely for most affected WiFi routers and access points to receive patches immediately, and we can only pray for the older ones. However, it might not be the case that the attackers are actively exploiting the vulnerabilities in the wild. You can take care of a few things as a protective measure:
- Prefer HTTPS over HTTP.
- Don’t provide confidential details over unencrypted connections as they’re sent in plain text.
- Use VPN services to add an extra layer of security.
- Don’t use public WiFi networks unless it’s necessary.
- Prevent yourself from visiting unknown websites or installing software from untrusted sources.
Source: ArsTechnica
Update: This story has been updated to include information about the CVEs.
