Cyber Security Experts recently found a major security flaw in the standard technology protocol used to protect Wi-Fi networks. This security issue in wireless networks could potentially allow hackers to steal personally identifiable information (PII) such as credit card details, social security numbers, private messages, photos, etc.
The issue is part of the security protocol WPA2, the recommended protection used when setting up your wireless router or wireless access point. This issue is being referred to as a “key reinstallation attack,” or KRACK, for short. It only affects devices that support Wi-Fi… which is pretty much everything right?!
There is some good news…
Wireless device manufacturers were first warned about this issue in July of 2017. That means that companies had time to prepare patches before the attack became national news.
To exploit the KRACK security flaw on WPA2 and steal private information from you, an attacker would need to be on your Wi-Fi network. That means that public Wi-Fi broadcasted by devices without the patch would be dangerous for you, but your home Wi-Fi as long as you haven’t shared the password out with everybody and aren’t using a default password, is likely still pretty safe and you have a low probability of being targeted at home. You also have a low probability of being targeted at the office if your business is using a device that allows for cloud based configuration updates like the Cisco Meraki network devices that we recommend to our business clients.
Lastly from the good news department, other encryption standards used in transmitting data have not been compromised, including the HTTPS, the security standard in place on websites with an SSL Certificate (What is an SSL and why do I need one on my website?) which are used by most banking and finance platforms on the web.
How to protect yourself from the WPA2 Wi-Fi Vulnerability
- Update every wireless item you own to the latest operating system and install security patches.
- If you are a SeedSpark managed services client, we do this proactively for you.
- Update the firmware your wireless router, security appliance, and or wireless access points
- If you are a SeedSpark managed services client and purchased Meraki equipment from us recently we proactively do this for you.
- When you are in public Wi-Fi zones like a coffee shop, use your cellular data personal hotspot
- Do not transmit personal information on websites that do not have an SSL certificate as designated by the HTTPS before the URL and/or a green lock box to the left of the web address. If you want to take it a step further, install the HTTPS everywhere extension
- Change the feature in your phone that automatically joins wireless networks
- Go into your settings for your laptop and delete remembered networks so you only have the ones you trust. Chances are as you go about adding back wireless networks from areas you frequent, you will be able to confirm they have up to date wireless standards.