A well-known security researcher has just exploited WPA2, the most secure WiFi encryption algorithm on the planet. Here’s all you need to know about it.

What is a KRACK Attack?

KRACK stands for Key Reinstallation Attack. This was discovered by information security researcher, Mathy Vanhoef.

It exploits a bug present in the 4-way handshake of the WPA2 protocol. In layman’s terms, it renders WPA2 protection on all modern WiFi networks absolutely useless.

A hacker can use this security vulnerability, which plagues all smartphones/devices, to steal your information.

Here’s a brief explanation of how this exploit works.

• The target device connects to a WPA2-secure WiFi network and initiates a handshake. It ascertains that both the client device and the network possess the same set of credentials (network password).
• The router then sends the target device an encryption key.
• The device deletes the key from the memory after usage. It also overwrites its entire length with zeros for security.
• The hacker tricks the target device into believing that the encryption key didn’t transmit correctly.
• The target device now begins using just zeros as the WPA2 encryption key.
• Hacker can now access all its data packets without knowing the WiFi network’s password.

Here’s a live proof-of-concept demonstration against Android and Linux by hacker Mathy Vanhoef.

Platform-specific Vulnerability Status

Mathy Vanhoef will be notifying all vendors about this vulnerability. Here’s a list of all popular operating systems and platforms that are affected by KRACK.

iOS

Apple hasn’t announced anything related to this exploit, thus far. Vanhoef has clearly mentioned in his research paper that iOS operating system is vulnerable.

Update – iOS 11.1 beta 3 firmware update fixes this security vulnerability.

Android

The smartphones and tablets running Android 6.0 Marshmallow and above are vulnerable to KRACK attacks.

Google hasn’t released a patch so far since Android devices are very thinly spread out.

Windows

Windows is vulnerable but Microsoft has released a patch, which will come soon for its entire operating system lineup.

macOS

No known fix or patches announced and it’s unclear what devices are affected (or not) until Apple makes a statement on this. So far, they’ve said nothing.

Linux

A patch is already available upstream and Debian-based builds can install it now. OpenBSD was patched all the way back in July.

WiFi chipsets

Intel has issued firmware updates for all its WiFi chipsets and you can download them now. If you own a laptop with Intel WiFi chips, you must upgrade their firmware right now.

How can I keep myself secure from KRACK?

The only way to keep yourself secure from KRACK right now is to stop everything that involves using a WiFi network.

Here are a few tips that I recommend to every user.

• Stay away from public WiFi networks completely.
• Switch off your WiFi completely and stick to mobile data or wired internet only.
• Always use a trusted VPN.
• Wait for an update by your device manufacturer. As soon as an update rolls out, upgrade your device instantly.
• Remember, do not update if you have a jailbroken device. Hopefully, a developer will release a fix for it soon.

For more hacking updates, follow us on Twitter and Facebook.