Serious weaknesses were discovered in the protocol that provides security for modern protected Wi-Fi networks, or WPA2, according to researcher Mathy Vanhoef, who discovered the flaw.
Vanhoef detailed the weaknesses and potential security breaches on his website, krackattacks.com.
A hacker within range of a victim can exploit these weaknesses using key reinstallation attacks, or KRACKs. The attacker can use this technique to read information that was previously assumed to be safely encrypted.
Below are the key things to know about the security vulnerability. And you can watch the video above for additional information.
What can a hacker have access to?
Hackers can inject computer viruses into internet networks and steal sensitive information, such as credit card numbers, passwords, messages, photos and emails sent over the internet.While some websites and apps may use HTTPS as an additional layer of protection, it can still be bypassed by a hacker.
Who is at risk?
Initial research found Android, Linux, Apple, Windows, Linksys and others are all affected by some variant of the attacks. Any device that is connected to a Wi-Fi network is at risk for an attack if the hacker is within range of the victim."If your device supports Wi-Fi, it is most likely affected," said Vanhoef.
Linux and Android are at greater risk for an attack because they can be tricked into installing or reinstalling an all-zero encryption key that makes it easier than other devices to hack.
How does the hack work?
The main attack is against the "four-way handshake" of the WPA2 process that is executed when a user wants to join a protected Wi-Fi network.It is used to confirm both the user and access point possess the correct credentials such as entering the correct passwords. The hacker can manipulate that process to gain access to sensitive information.
All modern protected Wi-Fi networks use the "four-way handshake," which implies all these networks can be affected by an attack, Vanhoef said.
Vanhoef uploaded a video on YouTube outlining how the attack works.
How can I prevent an attack?
The weaknesses are in the Wi-Fi itself, not in individual products or implementations. To prevent an attack, users must update affected products as soon as security updates become available.Make sure all your devices are updated and update the firmware of your router. While changing the password of your Wi-Fi network does not prevent or mitigate the attack, it's never a bad idea to change the Wi-Fi password, Vanhoef said.
Manufacturers and vendors have promised updates that are already available or will be soon.
©2017 Staten Island Advance, N.Y. Distributed by Tribune Content Agency, LLC.
