Wi-Fi WPA2 Security Protocol Cracked; iOS and macOS Devices Vulnerable [Updated: ‘KRACK’ Wi-Fi Vulnerability Patched in betas]


iPhone 8 Plus front view

Most of the world woke up to some not so good news today when Mathy Vanhoef, a security researcher in the CS department at KU Leuven Belgium revealed how the Wi-Fi WPA2 security protocol has been cracked, allowing potential intruders to decrypt the contents sent between the router and the device. The report details how attackers can exploit this to gather personal information like credit card numbers, passwords, photos, and more.

While Android and Linux are said to be most affected, iOS and macOS devices aren’t immune from this attack. The researcher claims that although it was initially harder to intercept data between macOS/iOS devices and the router, an easier alternative has been found.

WPA2 is used on most modern day devices and routers, which makes this particular vulnerability incredibly concerning. It must be pointed out that the issue can only be fixed by the Wi-Fi Alliance and not individual router manufacturers as this pertains to the security of the Wi-Fi standard. The Wi-Fi Alliance has acknowledged this crack and is working with all major platform providers to send out the patches. The patch will be backward compatible as well, which comes as a big relief.

Here’s what Vanhoef had to say on how the “KRACK” attack works – “We discovered serious weaknesses in WPA2, a protocol that secures all modern protected Wi-Fi networks […] Attackers can use this novel attack technique to read information that was previously assumed to be safely encrypted. This can be abused to steal sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on. The attack works against all modern protected Wi-Fi networks.”

“The weaknesses are in the Wi-Fi standard itself, and not in individual products or implementations. Therefore, any correct implementation of WPA2 is likely affected […] If your device supports Wi-Fi, it is most likely affected. During our initial research, we discovered ourselves that Android, Linux, Apple, Windows, OpenBSD, MediaTek, Linksys, and others, are all affected by some variant of the attacks.”

Vanhoef has created a proof of concept video to show how the ‘KRACK’ Wi-Fi vulnerabilities can be used to bypass WPA2 security protocol.

What can users do to stay safe?

As a preemptive measure, it is recommended to stay away from public Wi-Fi networks as they mostly use WPA2 encryption. It is also important to keep looking for router patches or updates as the manufacturer makes them available. Be sure to use HTTPS websites whenever possible as it can encrypt your data independently. However, there are ways to get through HTTPS encryption as well, so it’s not exactly foolproof.

Update:

Apple has confirmed to Rene Ritchie of iMore that the ‘KRACK’ Wi-Fi vulnerability have been patched in iOS, tvOS, watchOS, and macOS betas that have been seeded to developers, and will be released to the public soon.

Apple seeded iOS 11.1 beta 3, watchOS 4.1 beta 3, tvOS 11.1 beta 3 earlier today, and macOS High Sierra 10.13.1 beta 2 last week. It is not clear when Apple plans to release these software updates.

[Via Ars Technica]

Like this post? Share it!