New Attack Against WPA2 “KRACK”

There has been a new security flaw found in the WPA2 stack: a security researcher was able to manipulate handshake packets in the 4-way WPA handshake and perform a key re-installation attack.The basics of this attack are:

1. An attacker needs to be in close range of your network.
2. The attacker manipulates the 3rd stage of the handshake process, which tricks the client to install a key that is already in use. This allows the attacker to read all of the traffic that should be encrypted via WPA.

It has been found that Linux, MAC, and Android devices are most vulnerable since an implementation bug allows for the devices to install an all-zero key. This is a perfect example as to why it's important to use a VPN service when connected to a public wireless network. If you did fall victim to this attack method, it would be ineffective if the traffic were encapsulated in a VPN tunnel.See the video below for a demo of this attack from the researcher who found the exploit:It's highly recommended that you check your router for firmware updates. If none are available, it may be time to replace your wireless router to better protect yourself. Also, it's recommended that consistent checks are performed for software patches on your operating systems to patch this vulnerability.Sources for you: securityaffairs.co/wordpress/64373/breaking-news/wpa-krack-attack.html; www.seanmancini.com