10/25/2017
KRACK Exploit explained
The KRACK (short for, uh, Key Reinstallation AttaCK) vulnerability targets the communication of devices, communicating over wi-fi. If you are using your cell phone’s data plan, or a wired Ethernet connection, you are unaffected by this exploit. KRACK interferes with the way your devices communicate over a wi-fi connection. So, while your devices are safe, any data you transmit (passwords, usernames, credit card info, etc.) over wi-fi may not be.
How serious is this? This is a discovered vulnerability, I haven’t heard of any ACTUAL exploits taking place yet. But if there is money to be made, they will! Also, the individuals trying to get access to your data would need to be within range of the router you are using to communicate over wi-fi with.
Lastly, you should assume that public wi-fi’s are unsafe, as they probably haven’t been patched. But thankfully, even if you are using a public wi-fi, any communication over a secured website (HTTPS) would have their own built-in encryption, and therefore should be safe. But this is communication only on that website, not for your whole session.
What types of devices are affected? All of them! Routers, cell phones, computers, laptops, tablets, etc. In a strange twist of fate, your Windows OS devices are probably already protected and safe! Microsoft is really very good at issuing updates, so as long as you install the updates they send to you, you are probably safe. Android devices seem to be the most affected.
All of the devices will be safe once you install an update provided by your specific manufacturer.
So what should you do? As stated, Windows devices should be fine, as long as you regularly install updates. Other computer OS’s (Apple, Linux) will probably issue updates fairly quickly. You’ll need to check with them. Cell phone manufacturers take a very long time to issue their updates, but keep an eye out for them. Probably the most important update is an update to your Router’s firmware. This is also the hardest, as you’ll need to know how to log in as an administrator and then find the section where you can manually check for updates. Alas, I cannot do this for you remotely as I would be disconnected during the install phase. Feel free to call me to set up an appointment to come out if you wish.
Eventually, all devices will be updated and we can then move on to the next "big thing".
There are several (mostly anti-virus) companies, telling you that you should install their add-on features to protect yourself. Should you do it? If these add-ons are being offered by the AV software that you already have installed on your computer, feel free. But be warned, they are also going to try to install other software as well, that really has no value to this exploit. I wouldn't pay for anything they are offering. Again, the only real fix is a software patch to your device. Anything short of this is a band-aid.