Wi-Fi Security Flaw Researcher Warns ‘We’re Just Getting Started’

A flaw in a widely-used Wi-Fi security protocol was revealed on Monday, and the researcher behind the discovery has warned that other vulnerabilities could come further down the line. A “serious weakness” in WPA2 means an attacker could listen in on traffic moving between computers and access points.

“I think we’re just getting started,” Mathy Vanhoef, a postdoctoral researcher in computer security at Belgium’s KU Leuven, said on the website explaining his discovery. The line, used in response to an FAQ question about whether other vulnerabilities will be discovered, is a quote from the end of 2001 video game Halo: Combat Evolved, uttered by hero Master Chief after defeating the Covenant alien forces.

The implications for the discovery are vast. Wi-Fi survey website Wigle.net shows around 60 percent of access points use WPA2, with a further seven and eight percent using the older WPA and WEP standards. Vanhoef also notes that the issue is not with how various products have implemented WPA2, but it’s in the standard itself.

“If your device supports Wi-Fi, it is most likely affected,” Vanhoef said. In testing, he found Android, Linux, Apple, Windows and more are affected by the attack in some shape or form. Around 41 percent of Android devices are vulnerable to an “exceptionally devastating” variant of the attack, and an attack against macOS is “significantly easier” than the method outlined in the research paper.

Vanhoef explains the attack as so:

Our main attack is against the 4-way handshake of the WPA2 protocol. This handshake is executed when a client wants to join a protected Wi-Fi network, and is used to confirm that both the client and access point possess the correct credentials (e.g. the pre-shared password of the network). At the same time, the 4-way handshake also negotiates a fresh encryption key that will be used to encrypt all subsequent traffic. Currently, all modern protected Wi-Fi networks use the 4-way handshake.

When a device joins a network, it carries out this four-way handshake, sending four messages back and forth. In the third message, though, the access point can re-send the key a few times if it doesn’t get through. The attack involves taking that message and playing it back.

To watch Vanhoef carry out the attack, complete with step-by-step commentary, see below:

Note that while an attacker can listen in on traffic, it doesn’t break any encryption used in that traffic, which means a protocol like HTTPS used for sending sensitive data like credit card information over secure connections has not been broken here. Vanhoef notes, however, that HTTPS has been bypassed before, and it’s still concerning that an attacker can eavesdrop on traffic passing over secure Wi-Fi connections.

The best thing to do at this stage is keep an eye out for any security updates released by manufacturers, and install them as soon as possible. Thankfully, the attack does not mean that WPA2 as a whole is broken, and companies can protect against the attack in a way that does not break compatibility with un-protected hardware. In other words, you can still use an old router with an updated smartphone and vice versa.