WPA2 bug leaves virtually all WiFi networks at risk of hacking, research shows

A Belgian researcher has discovered disconcerting weaknesses in the 14-year-old WPA2 protocol & security certification program devised by the Wi-Fi Alliance to secure all modern protected wireless computer networks.

“An attacker within range of a victim can exploit these weaknesses using key reinstallation attacks (KRACKs),” Mathy Vanhoef of KU Leuven University writes on a website dedicated to the finding.

“Concretely, attackers can use this novel attack technique to read information that was previously assumed to be safely encrypted. This can be abused to steal sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on.”

Vanhoef confirmed through extensive testing that the attacks work against all modern protected WiFi networks, and no operating system is immune. However, Android is more vulnerable than iOS and Windows, for example, according to the researcher.

Breaking the WPA2 protocol is possible by forcing “nonce reuse,” according to Vanhoef. So what does this mean in layman”s terms?

The problem lies in the four-way authentication handshake exchanged during association or the periodic re-authentication method used by the WPA2 standard. WPA2 should guarantee a decryption key is only installed and used once. However, that is not the case, Vanhoef discovered.

“By manipulating cryptographic handshakes, we can abuse this weakness,” he wrote.

The “KRACK” attack devised by Vanhoef works against personal and enterprise Wi-Fi networks, WPA and WPA2, as well as against AES-encrypted networks. An attacker could theoretically abuse the weakness to inject ransomware, or another type of malware, into websites the victim visits.

Flawed WPA2 implementations can be patched in a backwards-compatible manner, noted the researcher – who clarified that he speaks in third person plural out of habit, but really did all the legwork himself.

The Wi-Fi Alliance is actively working on a fix. In the meantime, users should refrain from changing the way they connect to the Internet wirelessly (i.e. don”t switch away from WPA2).

Since an attack would require the hacker to be quite close by, and since HTTPS web browsing negotiates its own security layer, experts recommend that users remain calm, for now. For complete peace of mind (until a fix is deployed), access only HTTPS websites (shown in green with a padlock icon in the left side of the URL), and use a virtual private network (VPN) application for sensitive transmissions.