October 17, 2017 By Larry Loeb 2 min read

A security researcher unearthed a serious vulnerability that affects the Wi-Fi Protected Access 2 (WPA2) protocol, which protects all modern Wi-Fi networks. That means an attacker can eavesdrop on any device, such as a smartphone or router, within range without entering a password.

Belgian researcher Mathy Vanhoef revealed in a paper, titled “Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2,” that if a certain step of the WPA2 protocol was repeated, it would cause the network to reuse what should be a one-time encryption key to encode the data stream. The WPA2 vulnerability has been dubbed KRACK, which stands for Key Reinstallation Attack.

Unpacking the WPA2 Vulnerability

The vulnerability has more to do with flawed implementation than the protocol itself. Programmers failed to anticipate this particular set of circumstances when writing their code, falsely assuming that any packet loss would result from transmission rather than a direct attack.

To exploit the vulnerability, a cybercriminal would have to launch a man-in-the-middle (MitM) attack against a WPA2-protected Wi-Fi network from within physical range of the target device. This is no trivial task, but it is not impossible, either.

As of this writing, the attack has not been seen in the wild.

Cracking Down on KRACK

Vanhoef gave companies advanced warning about the problem before announcing it publicly, which gave them time to find a solution. Microsoft issued a patch for the vulnerability in its October security release, and technology analyst Rene Ritchie reported in a tweet that Apple had patched the flaw in the latest beta versions of iOS, tvOS, watchOS and macOS.

Unfortunately, using only HTTPS connections for end-to-end encryption is not an adequate workaround. As Ars Technica reported, fraudsters can foil HTTPS using a simple script that causes a site to revert back to unsecured HTTP communications.

Linux-based systems seem to be particularly vulnerable to this type of attack because they require comparatively little effort to exploit — a potentially disastrous problem, since most Internet of Things (IoT) devices are basically Linux systems on a chip. Also, an IoT device manufacturer may not be able to provide a patch to fix the underlying Unix.

The best defense against this vulnerability is vigilant patching. Bleeping Computer posted a list of available patches and pledged to update it as new fixes appear. Security teams should take inventory of devices on their networks that could be affected by this far-reaching attack patch accordingly.

More from

Cyberattack on American Water: A warning to critical infrastructure

3 min read - American Water, the largest publicly traded United States water and wastewater utility, recently experienced a cybersecurity incident that forced the company to disconnect key systems, including its customer billing platform. As the company’s investigation continues, there are growing concerns about the vulnerabilities that persist in the water sector, which has increasingly become a target for cyberattacks. The breach is a stark reminder of the critical infrastructure risks that have long plagued the industry. While the water utility has confirmed that…

What’s behind unchecked CVE proliferation, and what to do about it

4 min read - The volume of Common Vulnerabilities and Exposures (CVEs) has reached staggering levels, placing immense pressure on organizations' cyber defenses. According to SecurityScorecard, there were 29,000 vulnerabilities recorded in 2023, and by mid-2024, nearly 27,500 had already been identified.Meanwhile, Coalition's 2024 Cyber Threat Index forecasts that the total number of CVEs for 2024 will hit 34,888—a 25% increase compared to the previous year. This upward trend presents a significant challenge for organizations trying to manage vulnerabilities and mitigate potential exploits.What’s behind…

Quishing: A growing threat hiding in plain sight

4 min read - Our mobile devices go everywhere we go, and we can use them for almost anything. For businesses, the accessibility of mobile devices has also made it easier to create more interactive ways to introduce new products and services while improving user experiences across different industries. Quick-response (QR) codes are a good example of this in action and help mobile devices quickly navigate to web pages or install new software by simply scanning an image.However, legitimate organizations aren’t the only ones…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today