Difference between revisions of "KRACK Vulnerability"
Jump to navigation
Jump to search
(add one sentence) |
|||
| Line 1: | Line 1: | ||
This page is specifically written to help members to understand the most relevant aspects of '''KRACK''' | This page is specifically written to help members to understand the most relevant aspects of '''KRACK''' Wi-Fi attacks. | ||
==What is KRACK?== | ==What is KRACK?== | ||
* KRACKs stands for Key Re-installation Attacks and refers to attacks on | * KRACKs stands for Key Re-installation Attacks and refers to attacks on Wi-Fi networks using weaknesses in the WPA2 protocol which secures most modern protected Wi-Fi networks. | ||
* KRACKs allow attackers to read and access information on | * KRACKs allow attackers to read and access information on Wi-Fi networks that were considered secured. | ||
* | * Wi-Fi networks use a password through WPA2 for two general purposes: | ||
** Controlling who can connect to the network; and | ** Controlling who can connect to the network; and | ||
** Encrypt (or conceal) the data shared over the network between the access point (Modem or Router) and clients (computers, phones, tablets, etc). Encryption is done by using the | ** Encrypt (or conceal) the data shared over the network between the access point (Modem or Router) and clients (computers, phones, tablets, etc). Encryption is done by using the Wi-Fi password to generate an even stronger key that is used to scramble the data between the access point and client. | ||
==Why should I care?== | ==Why should I care?== | ||
* WPA2 is widely used and is presently the strongest form of | * WPA2 is widely used and is presently the strongest form of Wi-Fi security available to the average person including modems configured by NCF. | ||
* Almost every client device is vulnerable to KRACK whether on | * Almost every client device is vulnerable to KRACK whether on Wi-Fi at home or elsewhere. | ||
** Variations of KRACK can be used against clients of various kinds including devices running Android, Apple | ** Variations of KRACK can be used against clients of various kinds including devices running Android, Apple OSs, Windows and Linux. | ||
==Should I be worried?== | ==Should I be worried?== | ||
| Line 20: | Line 20: | ||
* And, although your modem/router may not be vulnerable, your client devices may be. Updating your devices with a security patch that address KRACK will protect each device from this vulnerability. | * And, although your modem/router may not be vulnerable, your client devices may be. Updating your devices with a security patch that address KRACK will protect each device from this vulnerability. | ||
* Vulnerability vs Infection: Be vigilant but do not be anxious. A security vulnerability on a device does not mean that device is already infected or has a high likelihood of being infected. Follow the recommendations in the sections below to be safe against this vulnerability and keep informed. | * Vulnerability vs Infection: Be vigilant but do not be anxious. A security vulnerability on a device does not mean that device is already infected or has a high likelihood of being infected. Follow the recommendations in the sections below to be safe against this vulnerability and keep informed. | ||
* Proximity: An attacker needs to be within wireless range of your network (close enough to connect to your | * Proximity: An attacker needs to be within wireless range of your network (close enough to connect to your Wi-Fi). | ||
* Time: This attack works only during periods of connection and re-connection of your client device to a | * Time: This attack works only during periods of connection and re-connection of your client device to a Wi-Fi network. As such, an attacker has a very limited time window in which to attempt this attack (usually a few seconds). | ||
==What should I do?== | ==What should I do?== | ||
| Line 27: | Line 27: | ||
# Update the operating system on your phone, computer and other client devices when they receive security updates. Each device you update becomes protected against the KRACK vulnerability. | # Update the operating system on your phone, computer and other client devices when they receive security updates. Each device you update becomes protected against the KRACK vulnerability. | ||
#* You can [https://char.gd/blog/2017/wifi-has-been-broken-heres-the-companies-that-have-already-fixed-it check if your client devices have received updates] | #* You can [https://char.gd/blog/2017/wifi-has-been-broken-heres-the-companies-that-have-already-fixed-it check if your client devices have received updates] | ||
# Do not trust | # Do not trust Wi-Fi outside of your home (public Wi-Fi). KRACK is just one of many known security risks associated with using public Wi-Fi. Using a trusted [[Virtual Private Network]] (VPN) service is one way of keeping your data encrypted on public Wi-Fi. | ||
# Connect your devices where possible to the modem by ethernet cables, especially those without an available security update. | # Connect your devices where possible to the modem by ethernet cables, especially those without an available security update. | ||
# Use HTTPS to connect to secured services and websites. This means information transmitted to such web pages will have end-to-end encryption. Web pages that use HTTPS or another secure connection will include HTTPS in the URL. | # Use HTTPS to connect to secured services and websites. This means information transmitted to such web pages will have end-to-end encryption. Web pages that use HTTPS or another secure connection will include HTTPS in the URL. | ||
Revision as of 17:53, 11 November 2017
This page is specifically written to help members to understand the most relevant aspects of KRACK Wi-Fi attacks.
What is KRACK?
- KRACKs stands for Key Re-installation Attacks and refers to attacks on Wi-Fi networks using weaknesses in the WPA2 protocol which secures most modern protected Wi-Fi networks.
- KRACKs allow attackers to read and access information on Wi-Fi networks that were considered secured.
- Wi-Fi networks use a password through WPA2 for two general purposes:
- Controlling who can connect to the network; and
- Encrypt (or conceal) the data shared over the network between the access point (Modem or Router) and clients (computers, phones, tablets, etc). Encryption is done by using the Wi-Fi password to generate an even stronger key that is used to scramble the data between the access point and client.
Why should I care?
- WPA2 is widely used and is presently the strongest form of Wi-Fi security available to the average person including modems configured by NCF.
- Almost every client device is vulnerable to KRACK whether on Wi-Fi at home or elsewhere.
- Variations of KRACK can be used against clients of various kinds including devices running Android, Apple OSs, Windows and Linux.
Should I be worried?
NO why?
- NCF modems with standard configuration are NOT VULNERABLE to KRACK. Nevertheless, NCF will continue the practice of making firmware updates available as they become available from our modem providers.
- Modems or routers connected to each other in a wireless chain (using WDS) are potential at risk unless a patch is applied.
- Also, other networking devices like Wi-Fi repeaters and extenders which are not connected to your modem by ethernet may be vulnerable.
- And, although your modem/router may not be vulnerable, your client devices may be. Updating your devices with a security patch that address KRACK will protect each device from this vulnerability.
- Vulnerability vs Infection: Be vigilant but do not be anxious. A security vulnerability on a device does not mean that device is already infected or has a high likelihood of being infected. Follow the recommendations in the sections below to be safe against this vulnerability and keep informed.
- Proximity: An attacker needs to be within wireless range of your network (close enough to connect to your Wi-Fi).
- Time: This attack works only during periods of connection and re-connection of your client device to a Wi-Fi network. As such, an attacker has a very limited time window in which to attempt this attack (usually a few seconds).
What should I do?
- Update the operating system on your phone, computer and other client devices when they receive security updates. Each device you update becomes protected against the KRACK vulnerability.
- Do not trust Wi-Fi outside of your home (public Wi-Fi). KRACK is just one of many known security risks associated with using public Wi-Fi. Using a trusted Virtual Private Network (VPN) service is one way of keeping your data encrypted on public Wi-Fi.
- Connect your devices where possible to the modem by ethernet cables, especially those without an available security update.
- Use HTTPS to connect to secured services and websites. This means information transmitted to such web pages will have end-to-end encryption. Web pages that use HTTPS or another secure connection will include HTTPS in the URL.
- Check on your browser's address bar to ensure the. If your browser shows a little lock in the address bar and says "secure," you should be safe.
- HTTPS Everywhere for Chrome
- HTTPS Everywhere for Mozilla Firefox
- Consider using a VPN service.
External links
- Krack Attacks Website by Mathy Vanhoef of imec-DistriNet
- Krack Attacks FAQ
- Microsoft Security TechCenter KRACK Update
- Ars Technica Reports on KRACK
- NCF Discussion Group on KRACK
- TP-Link KRACKs Vulnerability Statement
- Good online references for understanding some of the terms used in this article are Webopedia and Wikipedia