By Kate O’Neal
In today’s world, almost all of us rely on wireless networks, and we believe them to be secure and encrypted. Earlier this month, a vulnerability was discovered regarding WPA2 encrypted networks, and it’s something you should pay attention to. The KRACK attack (Key Reinstallation Attacks) can affect virtually any modern Wi-Fi network previously thought to be secure.
You might be wondering what a WPA2 encrypted network is. Simply put, it is a type of encryption which is used to secure the vast majority of Wi-Fi networks. For each wireless client that connects to a wireless network, a unique encryption key is provided by the WPA2 network. WPA2 is the most advanced form of wireless encryptions and has been known to be virtually un-hackable.
This attack essentially fools one of the layers of WPA2 and reuses a previously issued encryption key, which is meant to be used once, rather than generating a new encryption key. Ultimately, this means a hacker could get their hands on potentially sensitive information, including credit card numbers, passwords, photos, messages, etc.
There are some key facts to know about this attack:
- The code that makes this attack possible has not been publicly released, so at this time, we won’t be seeing a wave of hackers.
- The KRACK attack affects Android, Linux, and OpenBSD operating systems. Windows and MacOS operating systems are affected to a lesser extent.
- Android operating systems are the most vulnerable.
- The attackers must be within Wi-Fi range of the vulnerable access point or client in order to pull off the attack.
- Changing the passwords of your Wi-Fi network does not prevent the attack.
So, how do you stay protected? At this point, technology companies are busy creating patches for their systems, and some have already been released. Ubiquiti, a major hardware brand, has come out with their patch as of October 18th. Prior to the attack becoming public, Microsoft had already released a patch. If you have not yet installed the most recent round of Windows patches, be sure to install them right away. It’s critical to make sure your access points, routers, computers, and other clients are updated with the newest firmware and patches.
For the time being, people with vulnerable access points and clients should avoid using Wi-Fi until patches are available. Instead, use a wired connection. If Wi-Fi is the only connection, look for HTTPS, STARTTLS, Secure Shell, or VPN connections to encrypt web and email traffic.
Attacks of this nature have happened previously. No matter the attack, it’s always critical to keep your system patched and up to date for the best IT hygiene.
Kate O’Neal
With multiple years’ experience working with clients in many industries, Kate brings her skills and positive attitude to Network 1’s team, clients and partners. She strives to provide the best service and solutions to her clients so they can achieve greatness through Worry-Free IT.
koneal@network1consulting.com or 404.997.7653
Network 1 Consulting is a 19-year-old, IT Support company in Atlanta, GA. We become – or augment – the IT department for law firms and medical practices. Our IT experts can fix computers, but what our clients value most are the industry-specific best practices we bring to their firms. This is especially important with technology, along with regulations and cyber threats, changing so rapidly. We take a proactive approach to helping our clients use technology to gain and keep their competitive advantage.
