The "Krack" Wi-Fi Security Problem: It Affected Everyone
Wi-Fi is a science fiction technology come true. Phones are using your home Internet instead of eating up cellular data, laptops can be used almost anywhere, and all kinds of gadgets are communicating. IoT anyone?
Wi-Fi is basically the backbone of all the smart technology we have in our home and business. Most of these Wi-Fi networks are protected by passwords with WPA2 encryption. This was safe and secure, or at least we thought until around late 2017.
In 2017 a flaw in the security of Wi-Fi networks, called KRACK, was found that will allow hackers into a Wi-Fi network, even the ones we think are secured. That smartphone, gaming console, laptop, even your wireless cameras, and smart refrigerator can be vulnerable.
How Does KRACK work?
KRACK is an acronym for the Key Reinstallation Attack. KRACK is not a problem with your devices or how they are configured. The problem is with the Wi-Fi technology itself. The attack resets the encryption key by getting between your device and access point (wireless router). Hackers can then view all the network traffic in plain text before it is encrypted. Since we rely on Wi-Fi a great deal, this means hacking jerks can have VIP seats to view your personal information such as passwords, credit card numbers, banking information, messages, email, and more.
It should be noted that the hacker will need to be in the physical range of the Wi-fi signal to take advantage of this flaw.
Unlike other attacks we see, it does not work remotely. Seeing that most Wi-Fi signals will reach outside your home or business, this can be small comfort. However, it is important to know.
How Do You Protect Yourself?
Run those updates
Software updates have been released that fixes this vulnerability. Both Microsoft and Apple have released updates to fix this issue. Always make sure you take the time to ensure all devices using Wi-Fi are up to date with patches. This means smartphones, tablets, laptops, gaming consoles, etc. Unfortunately, some devices were slow in getting this update, and some are so old that they won't get an update at all. If your device is older and can't get an update for this, then use a cable connection as much as possible. But, upgrading to a newer device is preferred and may be the cheaper alternative, especially if your personal banking or credit card information is hacked.Use Caution with Public Wi-Fi
Your library, school, or local business centers may have IT pros taking care of security, but the local coffee shop or diner is a different story. The likelihood small locations like your local café are on top of security patches is exceptionally low. You need to remember; a hacker only has to be within range of the Wi-Fi your using. So, make sure you don't give them a double shot of your personal data with that mocha latte'.Watch your browser security
Make sure you are using https instead of HTTP for websites before sending any information over the Internet. Most browsers will show some form of a small padlock next to the URL to let you know if you're using HTTPS. That and the URL begins with HTTPS :-). Major websites already use HTTPS, like Gmail, Twitter, and financial institutions.
Conclusion
Do you have any suggestions, comments, tips, or questions to add to The "Krack" Wi-Fi Security Problem? If you do, please provide them here. We welcome all input, concerns, questions, and feedback, so feel free to Contact Us.
Want to start receiving posts and articles about IT information? START HERE!
Data breaches can get your data on the Dark Web.
Is Your Data for Sale on the Dark Web?
DOWNLOAD THIS FREE TODAY TO LEARN MORE!
Well thanks .. i guess? It's from 2017, so nothing too special.
"this means hacking jerks can have VIP seats to view your personal information such as passwords, credit card numbers, banking information, messages, email, and more"
None of these should be submitted without tls / https, even in 2017. So if this was the case you probably already had bigger problems than KRACK and if you use https that data is secured
Thank you for the comment, and appreciate the additional value-add to the post.
Would like to hear more about this. I have heard it said:
KRACK KILLS
Spelling and cliche wisecracking aside, I am curious if WPA2 Enterprise is also susceptible. 🤔
I would guess it would present another layer that the attacker would need to compromise which is a good thing, of course, from a layered defense or defense-in-depth perspective.
It's been a while since I brushed up on EAP 802.1x so not too savvy how vulnerable it is but would imagine it varies according to the implementation / config.
Anyways, thanks for touching on this topic. Among my certifications, CCNA Wireless was one so wonder how this attack could be defeated with an business grade wireless solution involving WLCs.
First off, thanks for the vote and reblog. As one person pointed out in the comments, if one ensures they use https or TLS they should be okay to avoid the average hacker, but as you probably know, that will not negate the determined hacker. I think most business-grade systems, when configured correctly are good to go. Even the home router when configured correctly could go a long way.