Security researchers will release a proof-of-concept attack on the Wi-Fi Protected Access II (WPA2) protocol today, which lets attackers eavesdrop on traffic between devices and access points, reported Ars Technica.
Dubbed KRACK, a backronym for Key Reinstallation Attacks, the details of the research have yet to be released. Coordinated disclosure of the research is set to take place at 17:00 local time.
Ars Technica said the attack works by exploiting the four-way handshake used to set up a key for encrypting traffic between a device and access point.
In the third step of the handshake, the key can be resent multiple times. If done in a specific way, a cryptographic nonce may be reused – allowing an attacker to eavesdrop on the rest of the Wi-Fi traffic in that session.
The disclosure is expected to be made through krackattacks.com. Aruba and Ubiquiti are expected to have updates ready to fix the issue on their devices.
Ars Technica reported that security researchers said the vulnerabilities will be indexed as CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13084, CVE-2017-13086, CVE-2017-13087, and CVE-2017-13088.
Loading ...
