Failures in fundamental Wi-Fi security leave Wi-Fi networks susceptible to attack.
Breaking WPA2 with KRACKs
Recently discovered weaknesses in Wi-Fi Protected Access II (WPA2), a common encryption protocol used to protect most Wi-Fi networks, enable attackers to gain access to your personal information by using Key Reinstallation Attacks (KRACKs). With KRACKs, attackers can read your encrypted data as well as infect your computer with malware by inserting the malware into websites you visit. Ultimately, any device that has Wi-Fi capabilities can be affected and your sensitive information (credit card numbers, passwords, etc.) can be stolen.
The United States Computer Emergency Readiness Team (US-CERT), a department of Homeland Security, issued a vulnerability note (VU#228519) that lists the affected vendors, impact and solutions.
Installing Updates to Prevent KRACKs
As noted by US-CERT, the installation of updates that patch Wi-Fi networks against KRACKs should serve as a satisfactory method of solving the problem and should prevent attackers from using KRACKs to gain access to your personal and encrypted data. Fortunately, security researcher Mathy Vanhoef discovered the WPA2 security flaw before hackers became aware of the vulnerability. This led to most vendors pushing security updates through to users as fast as possible. So, unless you haven’t installed any security updates for the past several months, you are likely now safe from attack.
Securing Websites & Website Connections – How Does This Impact Website Design?
Middle man attacks on affected devices can “see” web traffic as it passes through the devices however traffic served by properly configured modern SSL/TLS technology or accessed over VPN isn’t affected by this attack vector. It’s now important more than ever to ensure that your website’s SSL certificates are valid to ensure that they provide maximum protection, especially given the average website visitor may not be browsing over VPN so the responsibility falls to the website operator to fill in the those potential security gaps to the extent possible. Our St Louis, Missouri web design company can upgrade your website to run over SSL and address common serialized URL value issues along with proper search-friend HTTPS redirection.
To see if you’re protected against Key Re-installation Attacks or for more information how you can protect your website visitors against these issues, call IQComputing at 636-594-5552.