Researchers have found a bunch of vulnerabilities that make all Wi-Fi networks insecure

Most vulnerabilities go unnoticed by the majority of the world’s population even if they affect several million people. But this vulnerability is probably going to affect several billion people all over the world: Researchers have found a bunch of vulnerabilities that make all Wi-Fi networks insecure.

According to researchers, any Wi-Fi network that relies on WPA or WPA2 encryption can be compromised. And with WPA being the standard for modern Wi-Fi, that means pretty much every Wi-Fi network in the world is vulnerable.
Researchers have found out that devices based on Android, iOS, Linux, macOS, Windows, and some other operating systems are vulnerable to some variation of this attack, and that means almost any device can be compromised. They called this type of attack a key reinstallation attack, or KRACK for short.
Once the attack is successful, an attacker may take advantage of accessing and tampering network traffic, which may lead to login credentials or any other sensitive data theft or malware injection. The paper reveals that the attack is catastrophic especially against version 2.4 and above of wpa_supplicant, a Wi-Fi client commonly used on Linux and Android devices. Also affected are Apple, Windows, OpenBSD, MediaTek, Linksys, among others.

One may argue that there’s another layer of security — the encrypted connection to a site, e.g., SSL or HTTPS. However, a simple utility called SSLstrip set up on the fake access point is enough to force the browser to communicate with unencrypted, HTTP versions of websites instead of encrypted, HTTPS versions, in cases where encryption is not correctly implemented on a site (and that is true for quite a lot of websites, including some very big ones).

Following the lines from the original researchers, Vitaly Kamluk, Director of Global Research and Analysis Team (GReAT) for Asia Pacific at Kaspersky Lab, recommends the following:

1.Update all WiFi client devices (such as smartphones, tablets, personal computers, etc) once security updates become available. This ensures a key is used only once, preventing the attack.

2.Update the firmware of your WiFi router.

3.Changing your Wi-Fi password does not prevent or mitigate this attack. And this type of attack does not help recovering your Wi-Fi passwords. But after updating your devices and router, it’s always a good practice to change your Wi-Fi password.

4.If your router does is not configured for automatic updates, please contact your vendor immediately for manual updates. Generally, you can try to mitigate attacks against routers and access points by disabling client functionality and disabling 802.11r (fast roaming). For ordinary home users, your priority should be to update your devices such as laptops, tablets, and smartphones.

5.WPA2 is still encouraged to be used as the safest option.

6.WPA3 is not needed at this time. Implementations can be patched in a backward-compatible manner, meaning a patched client can still communicate with an unpatched access point, and vice versa.