New Krack Hack Has Raised Major Concerns For Businesses Worldwide Update #1

A major WPA2 flaw is being utilized to compromise the online security of businesses and private users alike, with the potential for far-reaching consequences.

Cybersecurity headlines on Monday, October 16th focused on a fundamental flaw that has been uncovered in Wi-Fi Protected Access II (WPA2). By exploiting this flaw, hackers that happen to be in close proximity to your wireless device can decrypt your traffic, steal your user IDs and passwords, redirect you to malicious websites, install malware, and eavesdrop on your communications. This latest threat has been dubbed the KRACK flaw by the industry professionals who have uncovered it.

It goes without saying that this is a very big deal, and it has a lot of people very, very worried – and with very good reason.

As this is a flaw in the WPA2 standard itself, there is nothing you as a user can do on your own to reduce your risk beyond turning Wi-Fi off on your laptops, smartphones, and tablets. The job of correcting this issue falls to the vendors who make networking hardware and software, and the unfortunate reality is that the rest of us are stuck waiting for them to roll out updates. However, US-CERT has known about this flaw for a few months, and several vendors have already released updates to help protect their customers against KRACK.

For example, Microsoft released its patch for Windows 10 in reaction to the KRACK flaw back on October 10th. Apple has already patched the BETA versions of iOS, macOS, tvOS, and a patch for watchOS is due out soon. iOS 11 and macOS High Sierra make the attack difficult for hackers to execute, which is good news for many Apple users. Other vendors are hard at work on their own responses to this WPA2 flaw.

As much as we — and the entire IT security and support community — would like to be able to step in and take care of this KRACK flaw ourselves, we’re also stuck waiting for patches to be made available. However, we do have some good news for our managed IT services clients; you will receive these updates automatically for your supported Windows-based PC’s, laptops, tablets, and servers as soon as they are released.

In the meantime, it’s important to know that you absolutely must update both the wireless device AND the wireless access point or router in order to be protected. For example, our Networking-as-a-Service uses Datto Networking, which has already implemented a fix for their wireless access points. In addition, our SonicWALL wireless firewalls and SonicPoint access points are not vulnerable to KRACK.

The KRACK Flaw May Be Tricky, But There Are Still Steps You Can Take To Stay Secure

While you’re waiting on the remaining critical patches to be made available, there are a few things you can be doing from a practical perspective:

  1. If it is not completely necessary, don’t use wireless at all until you know your device and your wireless access point are patched with a fix. This means actually turning off the Wi-Fi on your devices while they are still vulnerable to the KRACK flaw.
  2. Dynamic Quest clients using Windows-based devices and our Networking-as-a-Service, you can safely use wireless on your internal network.
  3. Dynamic Quest clients that do not use Networking-as-a-Service, we’ll let you know when it is safe to use Windows-based devices on your internal networks.
  4. Dynamic Quest will send out periodic updates on specific vendors and when their products have been patched. Once both the wireless device and the access point or router is patched, you can safely use wireless on your internal network.
  5. Refrain from using public or guest Wi-Fi hotspots unless you know that their access point or router has been patched against the KRACK flaw. For instance, if your local coffee shop certifies that its hotspot is patched and you are using a patched Windows laptop, then you can safely use the wireless.
  6. Watch for unusual activity on your wireless device. For instance, if you are going to a secure website using HTTPS: and don’t see the secure lock, or if you are redirected to an unusual website, immediately turn off your Wi-Fi and power off your device.

Our technicians will be providing further updates as this WPA2 security incident continues to unfold and new information becomes available.

Our Vendors

Knowbe4