Existing encryption's a casualty of the massive KRACK WiFi attack

The KRACK WiFi attack has exposed a major vulnerability that could impact millions of users around the world, creating a major new threat for security professionals, financial institutions, retailers and payment companies. But there are options to mitigate the risk.

In cryptographic protocols, a nonce (Number used ONCE) should never be repeated, but often design flaws are introduced, when the protocol is implemented in software, that allow this to happen.

One response is to just blame the designer and fix the software, but the same problem will likely come up again in a different place. A better approach is to re-design protocols to be more resistant to nonce-reuse, which we know how to do, albeit with a slight loss of efficiency. It is concerning that nonce-reuse has even more serious consequences in the next generation of WiFi encryption (GCMP) compared to the existing one, allowing data to be tampered as well as being eavesdropped.

Krisztian Bocsi/Bloomberg

The vulnerability is serious, but to exploit it the criminal has to be physically near the computer they want to attack. For this reason, the more valuable the network, the more likely it is criminals will make the effort to carry out the attack, so businesses are at a higher risk than average home users. We have seen in cases like the hack of TJX that criminals will likely exploit such vulnerabilities to gain access to business networks, and then exploit other vulnerabilities to steal sensitive data.

Affected manufacturers were notified of the vulnerability in August to give them an opportunity to fix the flaw before the public disclosure today.

Unfortunately, manufacturers often do not fix vulnerabilities in older products, particularly those that aren’t being actively promoted. It is likely that the vulnerability will persist for years, through to end-of-life and up to disposal, in products such as Android smartphones and WiFi routers. This unfortunate situation has led to calls for hardware manufacturers to prominently state how long they will continue to supply security updates for products they sell.

Attacks against the cryptographic algorithms and protocols that underpin secure communication only get better over time. The plethora of attacks against SSL/TLS in recent years, and the novel KRACK attack against WPA2, illustrate this.

Luckily this flaw can be fixed by installing patches. Companies and households should therefore be on the lookout for security patches of their wireless access points and endpoint devices like laptops, desktops and mobile devices. Much of the risk of this attack can be alleviated by using cryptographic protocols at the transport or application layer (e.g. SSH, TLS) or by using Virtual Private Networks (e.g. IPsec).