By: Aman2406
November 20, 2017
Why Krack Attack Will Make You Question Everything
By: Aman2406
November 20, 2017
On 6th August 1991, a powerful invention came into existence, the Internet. Since its introduction, it has made a huge impact on the society, which later demanded the invention of WI-FI in the year 1997. The invention was responsible for wireless standardization which was introduced by a community called IEEE802.11. They introduced WI-FI for Home or personal use in 1999. Just when people were getting the hold of the technology and realizing the fact of how easy it made their lives, some continued to doubt it's security. Added doubts came from the news, the recent cyber-attack which just made their doubts more evident, leaving all with a question in their minds, “Are we safe?”
Just recently, we have heard the news about certain successful hacking attempts on many companies, and one went against a nation. These scenarios have led to awareness amongst people, who have become active in safeguarding their information and privacy by adopting various security guidelines for their enterprises and homes. We all have heard the age-old saying ‘prevention is always better than a cure’ but how do we act upon it? What will be your reaction, when someone tells you that you were following guidelines perfectly, it's just a fault in your Wi-Fi which got you compromised?
There is a recent release of an article by Mathy Vanhoef and Frank Piessens on their blog, who is currently working as a security expert at Belgium University. In the article, it was disclosed that we are still using encryption with flaws that put us in an unbreakable dilemma. We are using WPA-2 encryption nowadays, which was introduced to us almost 13 years ago after so many inventions, thinking that it was the perfection that we needed for wireless security; however, we always forget that the internet has never been as safe a place as we think.
The WPA-2 is referred as Wi-Fi Protected Access -2, which works on Advanced Encryption Standards (AES), mostly used for the support of CCMP (Cipher Mode Code Block Chaining Message Authentication Code Protocol) cryptographic encryption protocol. But the recent discovery uncovers the flaw in it and there is a novel technique which exploits that vulnerability known as KRACK (Key Re-installation AttaCK).
In this Krack attack, which is a specific type of Man-In -Middle attack the attacker can inject and manipulate data by inserting a malware or some other program into the workstation to compromise it. As we know that WIFI networks use shared keys to communicate with the network based on AES encryption, and these keys act as a cryptographic “handshake” to check the authenticity of the user. Where the Krack attack target those network traffic that works on a 4-way cryptographic handshake using a shared key, Group key refreshed handshake when a user leaves the communication and the Fast roaming protocol which allows users to roam on the network providing multiple access points. In this novel technique, the attacker decrypts all the data that is sent to an access point and forces the device to reinstall the zero encryption keys instead of the authentic keys.
After the article regarding the vulnerability was published, many organizations went through a series of research to check the authenticity of the article comprising of research conducted by Mathy Vanhoef and Frank Piessens. They concluded that the vulnerability was real and do exist, by supporting Mathy Vanhoef and Frank Piessens theory that it is limited to certain devices. But it’s just a bad luck that those affected devices are the ones in the majority as per the devices widely used, making all the users a target for the hackers. The devices that run on Linux, OpenBSD or Android version 6.0 or more are the most vulnerable to this devastating technique. Whereas the Windows, IOS and MacOS devices are safe from one technique but can be compromised from other technique like they are immune from 4-way handshake but are vulnerable to group-key share and Fast BSS attack. Whereas Android, chromium, Linux is very vulnerable to 4-way handshake. This attack can be withdrawn by using a MAC address filtering, which has proved to be a good asset in controlling unauthorized access, but it has even bypassed by this technique. Whereas the Krack attack is not able to affect the big enterprises and MNC’s where the users use the cryptographic certificate to join and must provide both valid username and password.
As per the brief research, I have gone through by visiting many websites and reading a lot of articles from many great technical researchers and bloggers, I conclude that this attack has really made us doubt everything that state that they are secure, especially the devices that for IOT which hardly gets any security patches to overcome these attacks. I even thought that do we need a new version of wireless security like WPA-3 but after the quick response from the many technology companies in terms of patching their products, we can still use WPA-2 but we might need the new version in coming future.
Whereas even after conducting many campaigns and broadcasting regarding the cybersecurity, many people don’t even care to give a thought to it and are the first one who becomes victims in these situations. So, to keep these risks at bay, patches should be applied as per their availability.
References:
https://www.inverse.com/article/37693-wifi-krack-attack
http://techgenix.com/krack-danger-wifi/
https://krebsonsecurity.com/2017/10/what-you-should-know-about-the-krack-wifi-security-weakness/
https://www.wired.com/story/krack-wi-fi-iot-security-broken/
