Snippet: But, KRACK! ☇

Natasha Lomas for TechCrunch:

Security researcher Mathy Vanhoef publicly disclosed a serious vulnerability in the WPA2 encryption protocol today. Most devices and routers currently rely on WPA2 to encrypt your WiFi traffic, so chances are you’re affected.

But first, let’s clarify what an attacker can and cannot do using the KRACK vulnerability. The attacker can intercept some of the traffic between your device and your router. If traffic is encrypted properly using HTTPS, an attacker can’t look at this traffic. Attackers can’t obtain your Wi-Fi password using this vulnerability. They can just look at your unencrypted traffic if they know what they’re doing. With some devices, attackers can also perform packet injection and do some nasty things. This vulnerability is like sharing the same WiFi network in a coffee shop or airport.

The attacker needs to be in range of your WiFi network. They can’t attack you from miles and miles away. The attacker could also take control of a zombie computer near you, but this is already a much more sophisticated attack. That’s why companies should release patches as soon as possible because chances are most attackers just learned about this vulnerability today.

At this point, this is something to be concerned about, make sure you’re updating things, and realize that nothing is entirely safe from vulnerabilities. There’s a great guide of which devices and vendors have issued updates already (I’ll be doing some updates tonight on my personal Ubiquiti equipment and the Aruba gear we use at work).

Update: Apple has confirmed that this has been fixed in the latest iOS betas. This is yet another reason to run the updates for your devices on a regular basis.