WPA2 KRACK Wifi vulnerability

Some of you may have heard about a newly discovered Wifi vulnerability called “KRACK”, which stands for “Key Reinsertion attACK”.  This vulnerability exposes a flaw in the WPA2 security protocol that virtually all Wifi networks use to keep them secure and prevent unauthorized access to a password protected Wifi network.  Most of you are affected by this vulnerability.

Here are the bullet points on this issue:

• Protocol flaw affecting all devices secured by WPA2.
• Newly disclosed, no known exploits in the wild.  (not super dangerous at this time)
• Two classes of remedy: “Client”, and “Router/AP”
• ABN Contract clients will receive remediation as it becomes available under contract terms automatically.
• Clients without ongoing monthly support contract with ABN must contact ABN for service to remedy this issue.
• Microsoft has already released a fix for Windows computers through Windows Update.
• Other manufacturers and software publishers have not yet published all required fixes at this time. 

Fortunately, the threat level of this vulnerability is not high, partly because it was caught before any exploits have come to light, which means that it was a secret to bad guys and good guys alike.

Now that it is known, vendors are working hard to close the hole in the WPA2 protocol implementation.  There are two general classes of fixes coming to us for this vulnerability.  The first is a class of “client” updates, which affect anything that connects to a wireless network.  This includes Wireless enabled PC’s, laptops, smartphones, tablets, printers, and other wireless devices such as security cameras, baby monitors, and the like.  The second class of fixes are for the Wireless Access Points and routers to which the clients connect.

The most critical class of updates is the clients class, and there is good news here.  Microsoft has already released a fix to their Wireless client software, and anyone remaining current on Microsoft updates through the Windows Update process will receive, or may have already received their update.  Apple is beta testing updates for iOS and MacOS, as is Google and the various smartphone manufacturers for Android.  So, anyone following the ABN standard procedure to maintain all device updates as current as possible will be well served to keep it up and make sure that everything you’ve got is up to date.  ABN performs this service for contract customers, so those of you in that position need not worry, and watch for us checking up on this issue as we go forward.

The less critical but equally important class of updates is for the Wireless Access Points and Routers.  To correct the protocol flaw on these devices, a device “firmware” update will be required, and we are receiving communication from our major vendors indicating that they are developing and testing firmware updates for their devices.  Again, as a matter of course, ABN updates device firmware on wireless access points and routers for our contract customers as part of the contract support entitlement.  As firmware updates become available for each of your various access points and routers, we will be contacting our contract customers to schedule a maintenance window to perform the firmware updates.

Those of you who are not contract customers of ABN, you will need to contact us and request a review of devices for remediation.  Please call our main support number to get this service scheduled.  At this time we can check Windows updates only.  As time goes on and more of our vendors have issued fixes for their devices, we will have more that we can do for you.

As a side note, we have received independent confirmation that companies served by managed service providers like ABN were almost unscathed by the WannaCry and Petya ransomware attacks.  This is partly because those attacks relied on out of-date-software on networked PC’s which had gone months and even years without regular updates.  We make sure that doesn’t happen.