In a report by The Verge, researchers say they’ve found a serious gap in the WPA2 security protocol that can allow hackers to use key reinstallation attacks (KRACKs) to compromise most WiFi devices.
The researchers say the method allows hackers to read encrypted information transiting via WiFi, including passwords, emails, photos, credit card numbers, and more. KRACKs can access nearly all WiFi traffic and, depending on the individual network safety configuration, insert code and alter data, such as send malware. The researchers claim the weakness is in the WiFi standard itself, and not in individual products, which is why the vulnerability is so widespread.
Devices running Android, iOS, Linux, Windows, macOS, and other platforms are impacted. The U.S. Computer Emergency Readiness Team (US-CERT) agreed with the researchers’ assessment and warned,
“The impact of exploiting these vulnerabilities includes decryption, packet replay, TCP connection hijacking, HTTP content injection, and others. Note that as protocol-level issues, most or all correct implementations of the standard will be affected.”
In other words, even if WiFi devices are being used properly, with passwords, they are still vulnerable. Google said it is aware of the issue and will patch the vulnerability in a future security update.
The WiFi Alliance has not yet responded to the researcher’s revelations.
