Investigators designed a new version of the reinstalling key attack, also known as KRACK
Mathy Vanhoef and Frank Piessens, experts in digital forensics, have revealed new variants of the KRACK attack. Last year, experts found several key management flaws in the core of the WiFi Protected Access II (WPA2) protocol that could be exploited by an attacker to hack the WiFi network and eavesdrop on WiFi communications, which could cause personal information theft.
The KRACK attack allows attackers to decrypt the WiFi data of the victim without the need to get or crack the password.
According to experts in digital forensics, KRACK works against:
- WPA1 and WPA2
- Home and organizational networks
- Cipher WPA-TKIP, AES-CCMP and JCGP
The flaws impact all implementations, including Android, Linux, Apple, Windows, OpenBSD, MediaTek, Linksys, and others.
Recently, experts have revealed new variants of the KRACK attack.
New attacks no longer depend on complex conditions to be triggered and involve a new method for conducting Man-in-theMiddle (MitM) attacks.
“We systematically investigate the 802.11 standard for key reinstallation vulnerabilities, and show that the Fast-Initial Link Installation (FILS) protocol and the Tunneled Direct PeerKey Link protocol (TPK) are also vulnerable to key reinstallations,” the investigators mentioned.
Experts explained that they achieved the multichannel MitM position by forging channel switch announcements (CSA) to deceive customers into changing to the desired channel.
“we propose a more practical method to get the MitM, which works based on the channel switch announcements. In this method, the adversary forges the CSA to deceive the customers to change to the desired channel”, the experts continued. “This is more reliable than interrupting certain channels, and does not require special WiFi equipment. We have successfully tested this approach against Android and Chromium”.
Digital forensics experts also found that it is possible to delay the delivery of message 3, which transports the key to the client once it has been captured. In this way, the reinstallation of the key will not be activated immediately, which allows to delay the attack and increase the potential impact.
Experts successfully tested this attack delay on Linux, Android, IOS and macOS, and also works with encrypted messages.
“Our results show that preventing key reinstallations is more difficult than we thought”, researchers conclude, the main reason that vulnerabilities are still persistent is because the WiFi standard is large, it is expanding continuously with new features and requires a specific knowledge of the domain.
According to specialists in digital forensics from the International Institute of Cyber Security, the WiFi Alliance should not only test products for interoperability, but also to detect vulnerabilities that may apply to different deployments.
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
