Security researcher Mathy Vanhoef of KU Leuven disclosed KRACK (Key Reinstallation Attacks), a set of weaknesses in the WPA2 protocol that secured most Wi-Fi networks. The findings were published on 16 October 2017 after a co-ordinated disclosure period with vendors.
What happened
- The flaws were in the Wi-Fi standard itself, so almost all devices supporting WPA2 were affected to some degree.
- An attacker within range could trick a device into reinstalling an encryption key, potentially allowing traffic to be decrypted or manipulated.
- Android and Linux devices were particularly exposed because of how they handled the attack.
- The disclosure was co-ordinated with vendors, many of whom had patches ready or released them soon after.
Why it mattered
KRACK showed that even long-trusted security standards can contain fundamental flaws, and it accelerated the move to WPA3. It also reminded organisations that devices such as printers and IoT equipment may never receive patches.
Lessons for organisations
Patch client devices as well as access points, and do not rely solely on Wi-Fi encryption for sensitive data. Using TLS and VPNs adds protection when network-level security fails.
Source: TechCrunch
Part of our Top stories archive of headline-making events in information security, privacy, and AI. If you would like help applying the lessons to your organisation, contact us.
