Updated KRACK WPA2 Wi-Fi recommendations
Please note: This is an update to our original analysis posted earlier on Oct. 16, 2017.
The best advice is to not transmit or receive sensitive information over Wi-Fi without some additional form of encryption actively in place, and follow these best practices:
- Use a corporate VPN client whenever you’re outside of your corporate networks.
- In conjunction use HTTPS in web browsing.
- Ensure that the padlock icon is active in your browser.
- Stop browsing if you get any pop-up errors about certificates or insecure communications.
- Apply vendor patches to all Wi-Fi client devices as soon as they are made available.
------
Original Post:
As many people will have seen already, a team of researchers led by Mathy Vanhoef have released details of an attack against the WPA2 Wi-Fi security protocol they are calling KRACK – Key Reinstallation AttaCKs. Full details of the disclosure can be found here: https://www.krackattacks.com/
WPA2 has been the standard method of security access to Wi-Fi networks for a number of years now, as such this vulnerability exposes almost all devices communicating over Wi-Fi to compromise.
As ever, Forcepoint Security Labs will continue to monitor this threat and provide updates where necessarily.
How do KRACK attacks work?
In brief, the attack works against the four-way handshake process used between a client and wireless access point (AP) when the client wishes to join a secure wireless network.
To allow for unreliability in the ‘physical’ transmission layer (i.e. the radio signal) the protocol allows the third part of this handshake to be re-sent by the AP if it doesn’t receive an acknowledgement (i.e. the fourth part) from the would-be client.
Unfortunately, certain values on the client are reset in response to ‘message three’ of the handshake. By collecting these messages and replaying them to a client, a malicious actor can exploit this behaviour to introduce enough known values into the system to attack the encryption protocol.
What does this mean?
In a practical sense, this may allow malicious actors to decrypt data being transmitted across wireless networks and, in certain cases, inject malicious data into existing streams, forge and inject packets, or recover encryption keys.
What devices are affected?
Almost all Wi-Fi client devices are reportedly affected, with certain operating systems (Android and Linux) and encryption protocols (WPA-TKIP and GCMP) more severely impacted.
How concerned should I be?
This is certainly a concerning discovery with far-reaching implications but there are mitigating factors: many applications such as online banking, accounting, or even Facebook and Google use HTTPS to provide an additional layer of encryption.
Attacks against HTTPS are not unheard of, but would require the presence of additional vulnerabilities and effort on the part of an attacker to break. However, if successful they would allow attackers to see sensitive messages being sent using this channel.
Protection Statement & Recommendations
Because the attacks focus on the 802.11 protocol, a standard which sits on the Physical and Data-Link levels of the OSI model, many devices are unable to protect against or detect the attack.
Owing to the way the attack works, AP devices – including Forcepoint NGFW devices with wireless capability – cannot be directly attacked with KRACK. However, this also means that the attack cannot be effectively mitigated by patching AP devices.
As such, it is critical that vendor patches are applied to all Wi-Fi client devices as soon as they are made available.
