The Independent View: Experts Alarmed by Reports of Vulnerability in Wi-Fi Protocol

Cybersecurity Experts are concerned about New Research that reportedly identifies Vulnerabilities in a common Wi-Fi Protocol, which could make it possible for Hackers to Eavesdrop on Traffic between User Devices and Network Access Points (NAC).

“An air of unease set into the security circles on Sunday as they prepared for the disclosure of high-severity vulnerabilities in the Wi-Fi Protected Access II protocol that make it possible for attackers to eavesdrop Wi-Fi traffic passing between computers and access points,” Ars Technica’s Dan Goodin wrote. "The proof-of-concept exploit is called KRACK, short for Key Reinstallation Attacks."

The Department of Homeland Security’s United States Computer Emergency Readiness Team, has sent an Advisory on the Research to about 100 Organizations, according to Ars. “It works by exploiting a four-way handshake that's used to establish a key for encrypting traffic,” Ars said.

“This set of vulnerabilities has the potential to have a severe impact,” Shuman Ghosemajumder, CTO of Shape Security, told CIO Journal in an email. “Most organizations assume that using industry-standard WPA2 Wi-Fi encryption with a strong password is sufficient to protect internal networks against unauthorized access. As such, communication within that network is generally considered to be secure and is not necessarily further encrypted. An attacker who breaks in will be able to eavesdrop on any such unencrypted traffic, as well as access open computers and resources, such as shared file servers, which are available to authorized users of that network over Wi-Fi.”

“The safest policy, until there is a fix, is that you should treat all Wi-Fi connections the same way you would a public Wi-Fi network at a coffee shop: that is, only access sites and use applications that use secure connections (e.g., HTTPS), especially when viewing or entering sensitive information,” Ghosemajumder said. “Any unsecured resources available to all users of the network should also be immediately secured.”

The silver lining, if there is one. “Wi-Fi attacks require the attacker to be in the vicinity of the target,” Ghosemajumder said. “However, there are many important Wi-Fi networks that are within the vicinity of thousands or millions of people.”