What is WPA2
WPA2 is the network protocol that all modern devices are currently using to securely connect to our home, office or public Wi-Fi networks. It is that little symbol we see that says “Secured” and requires the correct password to gain access on routers that is protected with WPA2 security.
What has happened
A major flaw has been discovered in the WPA2 security that we all now use to gain access to our Wi-Fi networks. The recently discovered flaw allows an attacker who is within Wi-Fi range but not on your network to gain access to personal info. Including passwords, sensitive information, login details and other data we may believe to be encrypted can be accessed.
What is it called
Known as KRACK (Key Reinstallation Attack), it can be used to attack all modern Wi-Fi networks. Although it will mainly affect Android and Linux users there are still some instances whereby Windows and AppleMac OS are vulnerable. Most smart devices like light bulbs, security cameras, televisions etc. run Linux as their operating system. Researcher Mathy Vanhoef (Katholieke Univeriteit Leuven in Belgium) has discovered that it may even be possible to inject Ransomware or other Malware in to websites and trick users into installing it.
How does it work
This method of attack works by forcing the connecting device to reinstall an all zero encryption key rather than the actual one. This makes it simple to eavesdrop on the communication taking place and harvest the data. This attack mostly affects Android devices. Another more sophisticated way involves compromising the secure group handshake that takes place when devices connect. This harder method is capable of affecting Windows and Apple Mac operating systems.
What can you do
All is not lost, update, update, update, this is the only real easy to protect yourself. Both Windows and Apple have started rolling out update patches. Android and Linux patches for the various distributions are slowly becoming available. However once patched you will be effectively protected as either the connecting device or the access point (your Wi-Fi router) will still operate in the same way. It will only install the encryption key once and once only, preventing this type of attack.
What next
In conclusion, WPA2 has now been shown as compromised. An attacker who although not actually on your network, but within Wi-Fi range, can access your Wi-Fi traffic. They can decode and harvest your data and even possibly trick you in to installing Malware. Android and Linux devices are the most vulnerable but the latest updates and patches will provide protection for this newly discovered flaw. So make sure you update your devices.