vulnerability · 1508112000000

KRACK Wi-Fi Vulnerability Disclosure

Disclosure of Key Reinstallation Attacks (KRACK) affecting the WPA2 Wi-Fi protocol.

What happened

Researchers demonstrated how an attacker within range could manipulate the WPA2 handshake to decrypt network traffic.

Technical mechanism

Exploited flaws in the 4-way handshake of the WPA2 protocol to force nonce reuse (CVE-2017-13077 to CVE-2017-13088).

Why it matters

Exposed a fundamental flaw in the nearly universal WPA2 protocol, potentially allowing interception of Wi-Fi traffic.

Impact

Affected virtually all modern Wi-Fi devices, necessitating widespread patching across operating systems and network hardware.

Response

Vendors rapidly released patches; the Wi-Fi Alliance updated its testing plan to check for the vulnerability.

Defensive lessons

  • Protocols must be rigorously formally verified
  • Need for defense in depth (e.g., HTTPS over Wi-Fi)
  • Challenges of updating embedded devices

Evidence register

  1. Mathy Vanhoef — KRACK Attacks Website (verified)