11:10am, 17 Oct 2017

TLP Rating: White

KRACK attack: security vulnerabilities in WPA1+2

A series of wi-fi vulnerabilities have been identified and are collectively referred to as KRACK (Key Reinstallation Attack). These vulnerabilities affect MacOS, Windows, iOS, Android and Linux internet connected devices.

The primary exploit is against the 4-way handshake of the WPA2 protocol that takes place when a user seeks to join a protected wi-fi network. This handshake is currently utilised by all modern protected wi-fi networks. In the report detailed by security researchers from imec-DistriNet, KU Leuven, a key reinstallation attack can be deployed, in which the attacker tricks the user into reinstalling a key “through manipulating and replaying cryptographic handshake messages”. 

When exploited, these vulnerabilities could allow attackers to observe sensitive traffic, including cookies, passwords, and any other traffic traversing your wi-fi connected network.