Wi-Fi security flaw leaves passwords exposed, say experts

[nitpicker]

http://www.dw.com/en/wi-fi-security-flaw-leaves-passwords-exposed-say-experts/a-40978522

Date 16.10.2017

Wi-Fi security flaw leaves passwords exposed, say experts

Internet security experts and US officials on Monday warned about a newly-discovered Wi-Fi network vulnerability, saying it enables hackers to spread malware and steal sensitive information. The US government's Computer Emergency Response Team (CERT) issued a statement saying the Wi-Fi security flaw can allow hackers to eavesdrop or hijack electronic devices that are connected to wireless networks.
(snip)

The US warning came after Belgian researchers Mathy Vanhoef and Frank Piessens of Belgian university KU Leuven published their findings on the bug, which they dubbed "KRACK" for Key Reinstallation Attack. The security flaw affects WPA2, an encryption protocol commonly used to secure Wi-Fi networks. The protocol protects communications between laptops, mobile phones and other devices connected to routers or hot spots.

"This can be abused to steal sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on," Vanhoef and Piessens wrote on a website set up to provide information on KRACK. In a video, the researchers demonstrate how the flaw can be used to view usernames and passwords for supposedly secure sites. "The attack works against all modern protected Wi-Fi networks," they added.

Vanhoef and Piessens' report noted that the KRACK attack could only occur if the hacker is within range of the potential victim, but could happen on any Wi-Fi network whether at the office, coffee shop or at home.

The Wi-Fi Alliance, an industry group, said on Monday that there's no evidence yet that the flaw has been exploited maliciously. They also added that the issue "could be resolved through a straightforward software update."

The Belgian researcher's discovery was reportedly kept secret for weeks so that Wi-Fi systems could develop security patches for the flaw, according to news site Ars Technica.

Computer scientists expressed concern over the discovery on Monday, saying that it will be difficult to patch millions of wireless systems.
(snip)