You’re at Risk From a KRACK Attack: Everything You Need to Know

Dan Price 17-10-2017

We’ve known public Wi-Fi networks are vulnerable to hacking 5 Ways Hackers Can Use Public Wi-Fi to Steal Your Identity You might love using public Wi-Fi -- but so do hackers. Here are five ways cybercriminals can access your private data and steal your identity, while you're enjoying a latte and a bagel. Read More for a long time. But according to experts, the situation is a whole lot worse than anyone imagined.


It’s now believed that every Wi-Fi network in the world is vulnerable — or at least, every Wi-Fi network that uses either WPA or WPA-2 encryption, which is virtually all of them.

The cause? An exploit called “KRACK,” which is short for Key Reinstallation Attacks.

But what exactly is a KRACK attack? How does it work? Can it be fixed? And what can you do about it in the short-term? Let’s take a closer look.

Why Are We Only Hearing About KRACK Attacks Now?

An excellent question.

Consider this: WPA and WPA-2 encryptions have been standard features of Wi-Fi networks since 2003 7 Essential Wireless Router Features You Should Be Using If you think a wireless router’s only job is to connect you to the world of the Internet, you’re missing out on a lot of its awesome goodness. Sure, maybe all you need is Internet... Read More . Until the KRACK revelations, nobody had cracked the encryption techniques.


The encryption plays a vital role in networking. It secures the traffic between your router and your wireless device, thus ensuring nobody can spy on your actions or inject malicious code into the transfer.

Now its perfect record lays in ruins. And so too does the security of billions of Wi-Fi networks around the world.

The man responsible for the bombshell is Belgian security researcher Mathy Vanhoef. He discovered the flaw several months ago but kept it as a closely-guarded secret until Monday 16th October 2017 Your Wi-Fi Connection Isn't As Secure As You Think The WPA2 encryption security protocol that protects your Wi-Fi connection has a flaw. This is a potentially catastrophic vulnerability that could adversely affect almost anyone connected to the internet. Read More .


How Does a KRACK Attack Work?

Perhaps the most worrying aspect of KRACK is that it’s not focused on a particular range of devices or a specific type of security implementation. The issue affects the Wi-Fi protocol itself, and thus affects every internet-connected device you own.

WPA-2 encryption uses a “four-way handshake” to establish a device’s connection to the network. It’s this “handshake” that the KRACK attack targets.

The first two parts of the four-part process ensure the password on a device matches the Wi-Fi’s security key. The device and router communicate with each other, and if the credentials agree, the third part of the handshake initializes.

At this point, a new encryption key is generated. Theoretically, it’s designed to protect a user’s session by encrypting data frames. This is where the KRACK attack kicks into action. Vanhoef’s research shows a hacker can intercept and manipulate the new key.


The hack works because a router (or other access point) will try and retransmit the new key several times if it does not receive a response from the device. Because each retransmission uses the same encryption key, it resets the transmit packet number and receive replay counter.

An attacker can collect the messages and force the counters to reset. In turn, this allows the person to replay, decrypt, or forge packets.

TL;DR: KRACK allows an attacker to steal and use one of the encryption keys that Wi-Fi network security relies on.

What Can Hackers Do With KRACK?

Let’s start with the good news. KRACK attacks are difficult for hackers to deploy for one simple reason: they need to be within range of a Wi-Fi network to make it work. Unlike some other worldwide security flaws, like Heartbleed and Shellshock, the hacker cannot deploy a KRACK attack remotely.


Secondly, a hacker can only attack one network at a time. Let’s assume the would-be criminal sets themselves up in a Starbucks in downtown New York. They probably have hundreds of networks within range, but there’s no way to attack them all at once — at least, not without a van full of equipment.

anonymous hacker on laptop
Image Credit: stokkete/Depositphotos

As such, if cyber-criminals are thinking of launching a KRACK attack, the most likely targets are large hotels, airports, train stations, and other vast public networks with thousands of people logging on and off every day. Your home network is almost certainly safe.

The bad news? A KRACK attack has the potential to be devastating for the victim.

According to Vanhoef, “credit card numbers, passwords, chat messages, emails, photos [and more]” could be stolen. This leaves you vulnerable to monetary loss and identity theft How to Prevent Identity Theft by Freezing Your Credit Your personal data has been compromised, but your identity not yet stolen. Is there anything you can do to mitigate your risks? Well, you could try freezing your credit -- here's how. Read More . Some network configurations will even allow hackers to inject malware, ransomware, and spyware into websites you’re visiting and, by extension, your computer.

Can KRACK Be Fixed?

Yes, hardware manufacturers and software developers can patch and fix devices that are vulnerable to KRACK attacks. Microsoft and Apple were particularly quick off the mark — the Silicon Valley giants released beta patches on the same day the flaw was publicly announced. Google has said an Android patch will be forthcoming in the next few weeks.

However, these days we connect a lot more to our Wi-Fi than just laptops and phones. Sure, they might be the primary attack vectors, but you need to update everything from your router to your smart fridge. That takes a lot of time, and many of the companies behind the devices won’t be as responsive as Microsoft and Apple.

Your router is arguably the most critical device to update. If you’ve got an ISP-issued model, you need to start pestering the company for a patch as soon as possible.

For more information about whether your device already has a fix, check this list.

Short-Term Solutions

It seems like we might be waiting for a long time before we can definitively claim all our devices are secure. Here are some steps you can take in the meantime:

Are You Worried About KRACK Attacks?

KRACK attacks are yet another reminder that we’re not as immune as we might like to think are.

We can all make strong passwords LastPass Users! Do This to Ensure Your Passwords Are Rock Solid Using the same weak password for all of your accounts is a recipe for disaster. Fortunately, LastPass has a feature that will guarantee strong, unique passwords for all of your accounts. Read More , use services like LastPass 5 Best LastPass Alternatives to Manage Your Passwords Many people consider LastPass to be the king of password managers; it's packed with features and boasts more users than any of its competitors -- but it's far from being the only option! Read More , keep our firmware updated, and take other security precautions, but we’re ultimately at the mercy of the technology we use. If there’s a flaw in the technology, it doesn’t matter how security conscious we are, we will be at risk.

Does the vulnerability worry you? How are you going to protect yourself? As always, you can leave all your opinions in the comments below.

Image Credit: yekophotostudio/Depositphotos

Related topics: Encryption, Online Security, Wi-Fi.

Affiliate Disclosure: By buying the products we recommend, you help keep the site alive. Read more.

Whatsapp Pinterest

Leave a Reply

Your email address will not be published. Required fields are marked *

  1. Max
    October 17, 2017 at 5:48 pm

    In the article, only have the reference of updates and patches for Win and Mac. Any specific concern for linux users?

    • dragonmouth
      October 17, 2017 at 8:58 pm

      As of 16:30 on 10/17/17, it seems that the article has been changed from when I read it for the first time this morning. In this morning's version, there was a statement to the effect that "while KRACK affects Windows and macOS, because of the way Linux handles WiFi, KRACK is particularly dangerous to Linux." There also was a statement that while software companies were notified about a week ago, nobody has as yet come up with any solution. IIRC, Dave suggested, tongue in cheek, that WPA3 be developed.

      I find these changes very disquieting. Firstly, because the article WAS edited, deleting some of the crucial information and secondly, because I also run Linux.

      • Dan Price
        October 17, 2017 at 10:52 pm

        I think you're getting mixed up with this news piece: //



        • dragonmouth
          October 17, 2017 at 11:14 pm

          Yes, you're right. My apologies to Mr. Parrack for mixing up two of his masterpieces.

          However, both articles hit on the same problem - KRACK. It sort of answers Max's question.

    • Colin
      October 17, 2017 at 11:35 pm

      Received update today on Ubuntu for WPA.

    • Gilbert J.
      October 18, 2017 at 2:03 am

      " Any specific concern for linux users?"
      Yes, Linux and Android 6.0 and up are especially vulnerable because of the way they manage the keys they generate for the handshake. The good news for Linux users is that many distros have already issued fixes. WEP/WPA/WPA2 in Linux are managed by "wpa_supplicant". If yours has been updated in the past day or two you should be good to go.