Wifi WPA2 Security Cracked: All Platforms Vulnerable

It's have already demonstrated that any smart device can be hacked via various techniques and methods. And now here the same thing came up.

One of the secure WiFi protocol WPA II, have been successfully cracked and demonstrated by a security researcher on Sunday.

A severe security flaws in WPA II Protocol makes all WiFi device vulnerable and attacker can easily gain all the credentials and data information that are transmitting between any computer and access point.

Researcher have gave a name to this new type of attack as KRACK, short for Key Reinstallation Attacks. 

This vulnerability have been discovered weeks earlier but due to users security issues it has not been disclosed. The bug has been disclosed via a website which gives full details about the issues. According to site it affects the core WPA2 protocol itself and is effective against devices running the Android, Linux, Apple, Windows, and OpenBSD operating systems, as well as MediaTek Linksys, and other types of devices. The site warned attackers can exploit it to decrypt a wealth of sensitive data that's normally encrypted by the nearly ubiquitous Wi-Fi encryption protocol.

Why it is Dangerous?

The bug is pointed to very critical due to its affected users volume and it's nature. Researcher point that exploiting the bug leads to stealing of sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on.

Not only this, situation is more worst as the attack works against all modern protected Wi-Fi networks. Depending on the network configuration, it is also possible to inject and manipulate data. For example, an attacker might be able to inject ransomware or other malware into websites.

Video Demonstration

Researcher have demonstrated an attack on Google's Android. 

Researcher says that the weakness allows attackers to target both vulnerable access points as well as vulnerable computers, smartphones and other types of clients with differing levels of difficulty. But Windows and iOS aren't believed to be vulnerable to the most effective attacks. Linux and Android appear to be more susceptible, because attackers can force network decryption on clients in seconds with little effort.

What you have to Do?

Till now you also know the impact of the bug, so it very much recommend to all users whether it is Linux, Android, Windows or Mac, everyone should update there WiFi firmware.

Linux patches are available but it yet to be clear that when it will be available for various distribution. Android have also patched the vulnerability and will soon available but not for all.

According to a researcher who has been briefed on the vulnerability, it works by exploiting a four-way handshake that's used to establish a key for encrypting traffic. During the third step, the key can be resent multiple times. When it's resent in certain ways, a cryptographic nonce can be reused in a way that completely undermines the encryption.

There are various bugs discovered and all of them have veen assigned with a different CVE id: CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13084, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088.

All the technical details and more information about the KRACK is available on GitHub page, and also at its website.