KRACK - It's Not As Bad As You Think

KRACK - It's Not As Bad As You Think

By Tom Carpenter On 10/18/2017 - 40 Comments

The recent reveal of the key reinstallation attack (KRACK) caused much stir in the wireless LAN community. This post addresses the reality of the attack, what should be done immediately, and lessons we should learn from it.

KRACK (key reinstallation attack) was widely published this week and is based on previously available information hinting at its potential. KRACK is not a hacking tool, but is a collection of vulnerabilities that will eventually be exploited by hacking tools. It exposes a weakness in 802.11 WLANs that should be addressed and can be addressed through patches and firmware upgrades from AP and client vendors. First, some basic details on the attack.

KRACK is in the category of a replay attack. Replay attacks are used to inject information into communication streams, to execute previously used authentication packets, and other actions. In the case of KRACK, it is used in relation to the 802.11 4-way handshake. The 4-way handshake is an exchange of four messages used to properly install encryption keys for communications between two devices and transfer group encryption keys for use within a WLAN by broadcast and multicast communications.

To execute a KRACK attack effectively a Man-in-the-Middle (MitM) attack is launched to perform the reinstallation. A MitM attack occurs when the attacker inserts the attack machine between two devices and receives all communications from both directions and also modifies information using various methods. In wireless, it is typically performed with a spoofed AP (an AP configured to look like the real thing).

A total of ten vulnerabilities impacting Wi-Fi in various ways were documented with the release of the KRACK information. One of these is AP-related and the others are client-related. The AP-related problem is easily fixed with vendor patches and many vendors have already released those patches. The client problem can also be fixed with patches, but this will take much more time and, in some cases, where vendor support no longer exists (the vendor has gone out of business or simply no longer supports the old device) they may never seen an actual patch.

NOTE: In the real world, the vulnerability in Android clients is the most important. It is not Android-specific, Linux clients using similar software are also vulnerabile if not patched, but Android devices make up the bulk of clients impacted by the vulnerability that allows the installation of an all zero key, effectively removing encryption from that client's link. Make sure you apply patches for your Android devices when they are available. If you aren't seeing them, contact your vendor and encourage all your friends to do the same until a patch is available.

The reparation process requires patches on both the APs/wireless infrastructure and clients. Apply AP patches as soon as they are available and most of your enterprise data concerns are gone. Apply client patches to protect your clients whether they are on your network or another network. Where client patches are not available, encourage the use of VPN connections on all public hotspots (I use these anyway) and you will have protection for those clients as well.

In the end, KRACK should be a reminder to us that security awareness, vulnerability testing, and response plans should be part of every secure implementation. When it is, you have a plan to respond to such incidents. Fear need not rule the day and actions can simply be put into place to begin problem remediation. Having a response plan is a far more peaceful road to travel than not having one.

In this post, I've attempted to give you a high-level overview of the issue without getting into technical details. If you want the technical details, view the Revolution Wi-Fi blog here: WPA2 KRACK Vulnerability.

Vendor patches are simply too many to list within just three days of the announcement of KRACK. This is good news. Check with your vendor to ensure they have provided patches for this, including patches for 802.11r roaming if it is used on your network.

Tagged with: KRACK, security, WPA2, WPA, PTK, GTK

40 Responses to KRACK - It's Not As Bad As You Think

Subscribe by Email
kexaciz 10 Says:
02/25/2018 at 06:28am
With the help of Aesoponline login portal, You can access your Frontline education account and check all of the services available in it. By logging in to aesop login login portal you can expect the following services:

kexaciz 10 Says:
02/25/2018 at 06:26am
Walgreens is diversified in its business: includes groceries, personal care products, trash bags and toilet paper. With walgreens photos coupons and promo codes, customers can save money on their next order.


moffitt moffitt Says:
02/15/2018 at 10:23am
This is very useful post for me. This will absolutely going to help me in my project. Booth Booster

Albina muro Says:
02/15/2018 at 02:46am
Wonderful article! We will be linking to this great post on our site.
Keep up the good writing. how to buy facebook comments instantly

Mark Smith Says:
02/09/2018 at 06:14am
WiFi internet service has become the need of an era for everyone. It helps in getting rid off cable hazards so that user can easily use the internet service easily. Best Assignment Help

alice long Says:
02/06/2018 at 00:07am
sage+1 888 336 0774 the quintessential success story in the Silicon Valley software industry with a remarkable contribution in giving a makeover to old and worn Sage Customer Service Numberout face of the 19th-century accountancy, has bestowed the with reducing the time-consuming paper-based and manual worksheets preparation job and making it a user-friendly digital phenomenon. Not too surprisingly, Intuit's or for that matter any Silicon Valley juggernaut's success Sage Customer Service Phone Numberowes its growth to a rapid breakthrough in the Information technology.

alice long Says:
02/06/2018 at 00:02am
QuickBooks+1 888 336 0774 dawn of the internet and the spectacular advancements in the computer hardware paraphernalia like printers, fax during the era of baby boomers had marked the usher in of a new era for digital accounting. Intuit's astute QuickBooks Technical Support Phone Numbercreators leveraged on the same and created what is today a $ 4.19 billion tech giant.

alice long Says:
02/05/2018 at 23:56pm
Quicken+1 888 336 0774 dawn of the internet and the spectacular advancements in the computer hardware paraphernalia like printers, fax during the era of baby boomers had marked the usher in of a new era for digital accounting. Intuit's astute Quicken Technical Support Phone Numbercreators leveraged on the same and created what is today a $ 4.19 billion tech giant.

Lucy Gray Says:
02/05/2018 at 00:17am
Sage Technical Support Number calls on +1-844-454-7202 bookkeeping apparatus is the cloud-empowered arrangement particularly for the private venture financials that never should be introduced, refreshed, tore or supplanted. The usefulness of the product is demonstrated with dependably on portability. Sage Technical Support Phone Number programming disentangles everything from the client charging to ongoing coordinated effort.

Lucy Gray Says:
02/05/2018 at 00:11am
Quicken Technical Support Phone Number will interface you straight through to the Quicken Support contact Direct number.Quicken Support Phone Number You can call this Quicken helpline number 24 hours per day, 7 days seven days on: +1-844-454-7202 It will get you straight through to the right group. On the off chance that for any reason you encounter any issues with this Quicken Support coordinate contact number. At that point please drop us an email. So we can investigate it, as we need to keep the Quicken data on this site as progressive as could reasonably be expected.

Lucy Gray Says:
02/03/2018 at 08:00am
Technology makes our lives less difficult and working progress toward becoming easy. Here we discuss the progress and helpful QuickBooks bookkeeping Software.Quickbooks Tech Support Phone Number +1-844-454-7202 is additionally a valuable innovation. The vast majority of individual utilized this innovation for your business running.
Visit here: http://www.accountingpre.com/phone-number/quickbooks/

anjilo smith Says:
02/03/2018 at 05:19am
Sage 50 Support Phone Number +1-888-307-3506
SAGE 50 Software Tech Support and help is practical for US Edition on Sage Support Number
Sage Support Phone Number Toll Free Phone Number ☎ +1-888-307-3506, User can get arrangements quickly additionally SAGE 50 Chat Support likewise working 24x7 which answers general quarries as well as settled specialized issue. For Billing or Payment related issue SAGE 5o Dial Toll Free Number 1-888-307-3506.

anjilo smith Says:
02/03/2018 at 03:23am
Quicken Tech Support Number +1-888-307-3506
Stimulate is an individual fund administration apparatus created by Quicken Inc. Revive Support is an online administration. We have a gathering of Quicken specialists. Our colleagues are very experienced and taught. On the off chance that you are confronting any sort of issue withQuicken Support Number
Quicken Support Phone Number Quicken program, at that point you can reach us. Our without toll 1-888-307-3506 is Quicken telephone number. Stimulate is an Intuit item.

anjilo smith Says:
02/03/2018 at 03:22am
Quicken Tech Support Number +1-888-307-3506
Stimulate is an individual fund administration apparatus created by Quicken Inc. Revive Support is an online administration. We have a gathering of Quicken specialists. Our colleagues are very experienced and taught. On the off chance that you are confronting any sort of issue with Quickbooks Technical Support Number
Quickbooks Technical Support Phone Number Quicken program, at that point you can reach us. Our without toll 1-888-307-3506 is Quicken telephone number. Stimulate is an Intuit item.

anjilo smith Says:
02/03/2018 at 02:56am
QuickBooks Support Phone Number +1-888-307-3506
It computerizes the business bookkeeping and makes it simpler to oversee everyday bookkeeping errands. Breaking the customary hindrances of procuring experts and bookkeepers to work for a considerable length of time, QuickBooks has helped in sparing cash from enlisting experts and made bookkeeping simpler and Quickbooks Support Number
Quickbooks Support Phone Numberspeedier with only a couple of snaps. We are here to help and guide you in understanding QuickBooks so you can utilize it in the most ideal way and deal with your accounts.

anjilo smith Says:
02/03/2018 at 02:55am
http://getsharepoint.com/

check Support

[url="http://getsharepoint.com/"]check Support Number[/url]

[URL="http://getsharepoint.com/"]check Support Number[/URL]

[url=http://getsharepoint.com/]check Support Number[/url]

[URL=http://getsharepoint.com/]check Support Number[/URL]

Olivia Smith Says:
02/02/2018 at 05:27am
Antivirus Customer Service Phone Number is here to help. Call +1888-451-1608 Norton Antivirus Support Phone Number for all kind of technical and support queries. There are many kinds of viruses. These viruses enter the computer systems and damage them. Norton Antivirus Support Number technology can help the people to save their computer systems Avg Antivirus Support Number from the virus attacks.

Olivia Smith Says:
02/02/2018 at 05:07am
Microsoft Outlook Customer Support is here to help. Call +1-888-451-1608 Microsoft Outlook Support Phone Number for all kind of technical and support queries. Outlook Support Number Now that a wealth of email client programs is available, trying one or two is not a bad idea. In fact, it will only help understand the progress made in respect to Microsoft Outlook Customer Service Phone Number.

Olivia Smith Says:
02/02/2018 at 04:51am
Aol Customer Support Number is here to help. Call +1-888-451-1608 for Mail correction, reset, forget password, account disable and unable, send or receive mail.In other words, their friends have a sense of Aol Support Phone Number commitment to something more than just earning some money. They have a commitment that is envied by the person who has no Aol Customer Support Phone Number guide to who they are or what they should do.

Olivia Smith Says:
02/02/2018 at 04:44am
Check Support
[URL=http://www.density.com/]Check[/URL]
[url=http://www.density.com/]Check[/url]
[URL="http://www.density.com/"]Check[/URL]
[url="http://www.density.com/"]Check[/url]



[url="http://www.density.com/"]Check[/url]



http://www.density.com/

Olivia Smith Says:
02/01/2018 at 07:33am
Check Support
[URL=http://www.density.com/]Check[/URL]
[url=http://www.density.com/]Check[/url]
[URL="http://www.density.com/"]Check[/URL]
[url="http://www.density.com/"]Check[/url]



[url="http://www.density.com/"]Check[/url]



http://www.density.com/

Galang saputra Says:
01/30/2018 at 23:34pm
href="https://goo.gl/QD6q3C">jual laptop asus murah
undangan pernikahan mewah
Jual Besi Unp Baja Profil Kanal
Pabrik Besi Wf Baja
Pabrik sch 40
Jual besi beton interworld steel is
Distributor Bondek Cor
Distributor Bondek Cor
Distributor Plat kapal besi baja bki krakatau steel
Distributor Welded Beam
Distributor besi cnp
undangan pernikahan cute
Jual Besi Cnp Profil Baja Gording
Distributor Plat Besi Baja
Distributor besi Pipa sch 80 baja
Jual besi beton gunung garuda
Harga Bondek Cor
Harga Bondek Cor
Distributor besi siku
Harga Welded Beam
www.gudangbesibaja.com
undangan pernikahan online
undangan pernikahan islami
undangan pernikahan unik dan murah
Jual Besi Hollow
Supplier Plat Besi Baja
Harga besi Pipa sch 80 baja
Jual besi beton delcoprima
Jual Bondek Cor
Jual Bondek Cor
Distributor pipa besi baja sch 40 sch 80
Jual Welded Beam
Jual besi Wf Baja
undangan pernikahan buatan sendiri
Jual Wiremesh
Agen Plat Besi Baja
Jual besi Pipa sch 80 baja
Jual besi beton cakra steel cs
Supplier Bondek Cor
Supplier Bondek Cor
Distributor Plat besi
Supplier Welded Beam
Jual bondek
undangan pernikahan artis
Jual Besi Pipa Baja Schedule 80
Toko Plat Besi Baja
Supplier besi Pipa sch 80 baja
Jual besi beton bjku
Toko Bondek Cor
Toko Bondek Cor
Distributor besi h beam
Toko Welded Beam
Jual wiremesh
undangan pernikahan anti mainstream
Jual Besi Pipa Baja Schedule 40
Jual Plat Besi Baja
Toko besi Pipa sch 80 baja
Jual besi beton Sni Ulir Polos
Agen Bondek Cor
Agen Bondek Cor
Distributor besi wf
Agen Welded Beam
Jual pipa besi baja sch 40 sch 80
undangan pernikahan amplop
Jual Pipa Besi Hitam Medium
Harga Plat Besi Baja
Agen besi Pipa sch 80 baja
Jual besi beton ais
Pabrik Bondek Cor
Pabrik Bondek Cor
Distributor wiremesh
Pabrik Welded Beam
Jual besi hollow
undangan pernikahan mewah
Jual Besi Wf
Pabrik Plat Besi Baja
Pabrik besi Pipa sch 80 baja
Jual besi beton
Distributor Welded Beam
Distributor Welded Beam
Distributor besi unp
Distributor Besi Beton
Jual besi beton Sni Ulir Polos
undangan pernikahan anime
Jual Besi H beam
Distributor Besi H beam Baja
Distributor Plat Bordes
jasa konstruksi baja
Harga Welded Beam
Harga Welded Beam
Distributor besi cnp
Harga Besi Beton
Jual besi wf baja
undangan pernikahan elegan
Jual Besi Beton
Supplier Besi H beam Baja
Harga Plat Bordes
www.pusatbesibaja.co.id
Jual Welded Beam
Jual Welded Beam
Distributor besi hollow
Jual Besi Beton
Jual besi unp
undangan pernikahan contoh
www.sentrabesibaja.com
Agen Besi H beam Baja
Jual Plat Bordes
www.pusatbesibaja.com
Supplier Welded Beam
Supplier Welded Beam
Distributor besi beton Sni Ulir Polos
Supplier Besi Beton
Jual besi siku
undangan pernikahan yang unik
Harga Welded Beam T beam King Queen Cross Castellated Beam
Toko Besi H beam Baja
Supplier Plat Bordes
www.jualbesibajamurah.com
Toko Welded Beam
Toko Welded Beam
ironsteelcenter.com
Toko Besi Beton
Jual Plat besi plat kapal
undangan pernikahan amplop
Harga Bondek Cor
Jual Besi H beam Baja
Toko Plat Bordes
harga besi beton Sni Ulir Polos polos ulir
Agen Welded Beam
Agen Welded Beam
Jual stainless steel
Agen Besi Beton jual hp asus murah jual hp asus murah
Jual besi h beam baja
undangan pernikahan unik dan murah
Harga Atap Spandek Sni
Harga Besi H beam Baja
Agen Plat Bordes
harga besi beton sii
undangan pernikahan kalender
undangan pernikahan
link4

sm phyl Says:
01/30/2018 at 02:42am
Superb article, the amazing blog cover all that information which I need keep sharing all this blog it is very helpful for me. I am glad to visit your website Tech o phyll

spring cleaning Says:
01/27/2018 at 07:16am
A new childcare professional is surely an seasoned individual that supplies little one proper care as being a existing. They may most often have little one care-related requirements along with coaching, along with as a childcare professional are going to be his or her major employment. A new babysitter normally have yet another employment as well as always be understanding, along with will not be while seasoned throughout little one proper care as being a childcare professional. Babysitting is just not his or her major employment, nonetheless they need to even now get pleasure from tending to young children. Specialized businesses present laid-back as well as standard babysitters. These kind of businesses will certainly fee a new price, nonetheless they could gain access to numerous babysitters, plus the babysitters can have been recently looked at ahead of these are applied. Businesses get distinct plans pertaining to filling out reference point along with background record checks in probable babysitters. cleaning service

Whoer Review Says:
01/23/2018 at 22:56pm
Thanks for sharing
Whoer

Bach Johann Says:
01/16/2018 at 01:20am
I needed to thank you for this incredible read!! I unquestionably adored each and every piece of it. I have you bookmarked your site to look at the new stuff you post. who is chuck hildebrant

alisha jonwal Says:
12/29/2017 at 01:28am
Excellent details are in this post and i am glad to see this post. Independent Escorts Delhi

Eric Bruce Says:
12/25/2017 at 13:52pm
download Freedom apk for android latest version click below download Freedom Apk button ( https://apksdl.com/freedom-apk/ )

Aaradhya Mishra Says:
12/21/2017 at 01:04am
Wonderfull keep sharing Awesome post really appreciating TutuApp is not working

Anna Shetty Says:
12/11/2017 at 03:54am
Very good, I think I found the knowledge I needed. I will see and refer some information in your post. thank you.
Putlocker, 123movies

Anna Shetty Says:
12/05/2017 at 22:48pm
You have posted a very detail document. I read all of your article and I really like it, I understand your point of view.
photoshop alternative, cool math games run 3

jenny han Says:
12/01/2017 at 03:35am
happy wheels full game an interesting game for interesting children

April Russell Says:
11/20/2017 at 23:44pm
Thank you for posting such a great article! I found your website perfect for my needs. It contains wonderful and helpful posts. Keep up the good work!
free run 3 online

yify tv Says:
11/20/2017 at 03:59am
To find a website where the quality of audio and images to satisfy it is very difficult. And today I want to share a website with people watching. Movies extremely fine but completely free. View offline ..!
- yify

James E Mosley Jr Says:
11/10/2017 at 11:29am
James Mosley Wireless Engineer:
Glad you all are making sure we are informed in the wireless community. Thanks again for the information.

tutu app Says:
10/29/2017 at 21:20pm
Tutuapp is an amazing application to download paid games like Pokemon go for free. You can also get latest paid apps, tweaked apps, themes, emulators for free on this application. All you need is download Tutuapp from the link tutuapp

flip diving Says:
10/27/2017 at 05:08am
The information you share is very useful. It is closely related to my work and has helped me grow. Thank you!
flip diving

Howard Higgins Says:
10/22/2017 at 10:41am
Good points Tom.
I'm sure you've seen or heard of the difficulties in making details of bugs like this known to the right, and not the wrong, people in a timely fashion. I hope this improves in the future.

Howard Higgins Says:
10/22/2017 at 10:39am
Good points Tom.
I'm sure you've seen or heard of the difficulties in making details of bugs like this known to the right, and not the wrong, people in a timely fashion. I hope this improves in the future.

<< prev - comments page 1 of 1 - next >>

Leave a Reply

Please login or sign-up to add your comment.
Success Stories

I literally just came out of the testing centre having taken the CWDP exam. The certification process opened my mind to different techniques and solutions. This knowledge can only broaden your perspective. Great job, CWNP, you have a great thing going on here.

-Darren
Read More

Working through the CWNP coursework and certifications helped not only to deepen my technical knowledge and understanding, but also it boosted my confidence. The hard work it took to earn my CWNE has been rewarding in so many ways.

-Ben
Read More

I want to commend you and all at CWNP for having a great organization. You really 'raise the bar' on knowing Wi-Fi well. I have learned a ton of information that is helping my job experience and personal career goals, because of my CWAP/CWDP/CWSP studies. Kudos to all at CWNP.

-Glenn
Read More