KRACK: How secure is my Wifi?

And what should I do now?

A new attack on the WPA2 protocol which is used to encrypt wifi connections has been published just recently. The attack is something that has been around for over a decade!

Security researcher Bruce Schneier states:

This meets my definition of brilliant. The attack is blindingly obvious once it’s pointed out, but for over a decade no one noticed it.

So that sounds really serious. What can I do about that now?

First of all: Don't panic. Even though this is a serious vulnerability and you cannot do something about the actual vulnerability yourself, this is something that probably won't affect you too much. What an attacker can do is to decrypt your wifi traffic when he is so close to you that he can physically listen to your wifi signal. However it can only decrypt the wifi signal. He cannot join the wifi network or decrypt any further encryption that is in use.

Therefore: Use TLS encrypted connections (if your browser says https:// that's it) whenever possible. Especially when you are entering login information in your browser or do anything else that might be sensitive. The Electronic Frontier Foundation for example offers the browser plugin HTTPS Everywhere which will redirect all your traffic to the encrypted version of a website whenever possible.

The researcher Mathy Vanhoef released a youtube video which illustrates the attack. It shows how the attack works to eavesdrop on a login form if you do not use the https version of a web application:

For solving the actual vulnerability make sure that you update your wifi drivers when a patch becomes available. You can check the status for the different vendors here: https://github.com/kristate/krackinfo

As a company it is important to provide a good encrypted version of your application. Check out our free security scanner to test the provided TLS encryption of your website: https://crashtest-security.com/product