KRACK WPA2 Wi-Fi Exploits

17
October

Here is a great writeup on this hack written by the person whom discovered and exposed this vulnerability.
https://www.krackattacks.com/

Watching the demo from the person whom discovered the exploit,  you will see some challenges for a hacker exploiting KRACK onto your corporate Wi-Fi connected users.

The following challenges for the hacker to exploit your users are as follows:

  • Hacker has to be connected onto the same Wi-Fi network as your users.
    • Your corporate Wi-Fi security password would have to be breached before they can even begin the exploit.
    • Mostly limited to open access public Wi-Fi networks.
    • Hacker will need a custom exploit tool to perform the exploit,.
    • The Hacker will need to be able to scan for the mac address of the user to exploit but many public wifi systems that are in place at major hotels and Starbucks will isolate clients from the other wifi clients, making the identity difficult or impossible.
    • Hacker will need to get to the victim before the victim logs into the their services.   In reality the attacker will likely need 10 to 15 minutes to perform the multiple steps to make a connection to the victim, minimising the exposure of the victim since network packet analysis tools only show traffic in process , not historical traffic.

It appears that the WiFi Access Points are not the problem

“The main attack is against the 4-way handshake, and does not exploit access points, but instead targets clients. So it might be that your router does not require security updates. In general though, you can try to mitigate attacks against routers and access points by disabling client functionality (which is for example used in repeater modes) and disabling 802.11r (fast roaming). For ordinary home users, your priority should be updating clients such as laptops and smartphones.”

Lastly , it appears the Windows computers were patched and the exploits are easier on clients running atop Unix systems, ie Mac and Linux.   Linux clients are not used in your environment, but a few Mac users may be affected.    Windows 10 users do not have control over blocking windows updates, so we can assume that they are safe.

With all the chatter about this vulnerability,  I most fear that attacks will be on users at public places ,  Starbucks, hotels, etc.

We recommend that if your using wifi outside your Wi-Fi password protected home or work environment that you turn on your VPN client.  Doing so will route your traffic thru your corporate network and your data will be encrypted, and safe.    The KRACK exploit does not decrypt packets.