KRACK Attacks: Breaking WPA2

WiFi is broken. The only thing we can do now is wait for updates from the vendors. If you thing about the amount of devices we put online using WiFi, do they all need an update? And how will a consumer know when he need to update something? Will there be a tool that consumers can use to scan there WiFi networks for vulnerable devices like security cameras, televisions or network attached storages?

We discovered serious weaknesses in WPA2, a protocol that secures all modern protected Wi-Fi networks. An attacker within range of a victim can exploit these weaknesses using key reinstallation attacks (KRACKs). Concretely, attackers can use this novel attack technique to read information that was previously assumed to be safely encrypted. This can be abused to steal sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on. The attack works against all modern protected Wi-Fi networks. Depending on the network configuration, it is also possible to inject and manipulate data. For example, an attacker might be able to inject ransomware or other malware into websites.