• Home
  • Miscellaneous
  • WPA2 Wi-Fi Security Cracked – Leaves Connected Devices Open to Attack

WPA2 Wi-Fi Security Cracked – Leaves Connected Devices Open to Attack

WPA2 Wi-Fi Security Cracked – Leaves Connected Devices Open to Attack

A security researcher has cracked WPA2, the encryption standard used to secure most modern Wi-Fi networks. This would allow an attacker to read all information passing over a wireless network secured by WPA2.

WPA2 Wi-Fi Security Cracked - Leaves Connected Devices Open to Attack

Android and Linux are described as “particularly vulnerable,” and are both described as “trivial” to attack. However, iOS and macOS, along with other platforms, are also vulnerable.

Mathy Vanhoef, a postdoc security researcher in the computer science department of the Dutch university KU Leuven, discovered the flaw.

We discovered serious weaknesses in WPA2, a protocol that secures all modern protected Wi-Fi networks […] Attackers can use this novel attack technique to read information that was previously assumed to be safely encrypted. This can be abused to steal sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on. The attack works against all modern protected Wi-Fi networks […]

The weaknesses are in the Wi-Fi standard itself, and not in individual products or implementations. Therefore, any correct implementation of WPA2 is likely affected […] If your device supports Wi-Fi, it is most likely affected. During our initial research, we discovered ourselves that Android, Linux, Apple, Windows, OpenBSD, MediaTek, Linksys, and others, are all affected by some variant of the attacks.

As a proof-of-concept, Vanhoef’s team executed a key reinstallation attack against an Android smartphone. In the demonstration, the attacker was able to decrypt all data that the victim transmits.

The attacks only decrypt data encrypted by the WiFi connection, but can’t touch data encrypted by a secure website encrypted using the HTTPS protocol. However, attackers could make use of separate attacks against the HTTPS encryption.

The attacks exploits the communications that occur when a device joins a WPA2-protected Wi-Fi network.

In a key reinstallation attack, the adversary tricks a victim into reinstalling an already-in-use key. This is achieved by manipulating and replaying cryptographic handshake messages. When the victim reinstalls the key, associated parameters such as the incremental transmit packet number (i.e. nonce) and receive packet number (i.e. replay counter) are reset to their initial value. Essentially, to guarantee security, a key should only be installed and used once. Unfortunately, we found this is not guaranteed by the WPA2 protocol. By manipulating cryptographic handshakes, we can abuse this weakness in practice.

Luckily, Vanhoef says WPA2 can be patched to block the attack, and the patch is backward compatible. Users are advised to patch their router with new firmware as soon as it becomes available.

The Wi-Fi Alliance has posted a security advisory, stating that it is aware of the issue, and that multiple platform providers have begun deploying patches for the issue. So far, there is no evidence the attack has been used in the wild, but it would be difficult to detect the attack if it were used.

(Via 9t05Mac)

  1. Exhaustare says:

    858682 622479Terrific paintings! That may be the type of details that are meant to be shared about the net. Shame on the seek for no longer positioning this publish higher! Come on more than and consult with my site . Thank you =) 694891

  2. 201586 20959I dont generally comment but I gotta state thanks for the post on this fantastic one : D. 738868

  3. nova88 says:

    273823 890022I besides believe therefore , perfectly composed post! . 450542

  4. 429787 488956I discovered your blog site internet site on google and appearance some of your early posts. Preserve up the great operate. I just extra increase Feed to my MSN News Reader. Looking for toward reading far more by you later on! 444950

  5. nova88 says:

    298845 447758I found your weblog site on google and check a couple of of your early posts. Proceed to sustain up the really good operate. I just extra up your RSS feed to my MSN News Reader. Looking for ahead to reading extra from you later on! 22077

  6. 24674 171493Oh my goodness! a wonderful post dude. Thanks Nevertheless My business is experiencing issue with ur rss . Dont know why Not able to sign up for it. Possibly there is any person obtaining identical rss difficulty? Anyone who knows kindly respond. Thnkx 739473

  7. 809851 570051 I discovered your blog internet site on google and check a couple of of your early posts. Continue to keep up the really great operate. I just additional up your RSS feed to my MSN News Reader. Seeking forward to reading much more from you later on! 707616

  8. 958424 456933You will notice several contrasting points from New york Weight reduction eating strategy and every one 1 might be valuable. The first point will probably be authentic relinquishing on this excessive. lose weight 498954

  9. 569984 64396Do you wear boxers or biefs? I wana bui em. 912667

Leave a Reply

Your email address will not be published.