Saturday, March 29, 2025
HomeData BreachNew Serious Flaw Called KRACK Attack Allow to Break WPA2 WiFi Protocol...

New Serious Flaw Called KRACK Attack Allow to Break WPA2 WiFi Protocol in Any WiFi Modem

Published on

SIEM as a Service

Follow Us on Google News

Highly Secured WiFi Protocol “WPA2” Critical Weakness allows to Break any WiFi Network using Key Reinstallation Attack (KRACK Attack) and this flow is given an Ability to Attacker to crack any of Victims WiFi Modem within The Range of Network.

Wi-Fi Protected Access II (WPA2) is security protocol and security certification program developed by the Wi-Fi Alliance to secure wireless computer networks. The Alliance defined these in response to serious weaknesses researchers had found in the previous system, Wired Equivalent Privacy but Now WPA2 also Flowing with New Attack.

This Critical KRACK Attack allows an Attacker to Steal the Sensitive Information such as credit card numbers, passwords, chat messages, emails, photos, and so on.

Researchers Said , this key reinstallation attacks can Work against all modern protected Wi-Fi networks and also it is Possible to inject the Ransomware and malware, manipulate data into victims network and website.

It is not Limited to any Environment which including home network Or Corporate Network. so this Weakness will have affected to all the WPA2 Protected Modems.

This Attack will Work against  AES-CCMP, and GCMP, Ciphers WPA-TKIP, WP1, WPA2,  Personal and enterprise networks.

Also Read :  PoC Script Released for Remote WiFi Hack Including iOS and Android

How Does WPA2 Flow  KRACK Attack Works

This flow mainly abuses the flow of design and implementation of cryptographic Protocols by re-installing the already used key in the 4-way handshake that is used to generate the new session key.

In This KRACK Attack Tricks to Victims into reinstalling an already-in-use key protected WPA2 traffic by manipulating and replaying cryptographic handshake messages.

By this way, Attacker can also reset to their initial value of associated parameters such as the incremental transmit packet number and receive packet number.

Key reinstallation  Against 4-way Handshake

Once User joined with the WiFi Network, it used to execute the 4 way-handshake to negotiate A Fresh  Encryption key and it will be installed receiving message 3 of the 4-way handshake.

Later it will be used for Encrypt the user data using a normal Excryption method by an encryption protocol.

In this case, sometimes Handshaking message may be dropped or lost so Access Point (AP) will retransmit message 3 if it did not receive an appropriate response as acknowledgment.

So a client may receive message 3 multiple times. Each time it receives this message, it will reinstall the same encryption key, and thereby reset the incremental transmit packet number (nonce) and receive replay counter used by the encryption protocol.

According to Researchers, We show that an attacker can force these nonce resets by collecting and replaying retransmissions of message 3 of the 4-way handshake. By forcing nonce reuse in this manner, the encryption protocol can be attacked, e.g., packets can be replayed, decrypted, and/or forged. The same technique can also be used to attack the group key, PeerKey, TDLS, and fast BSS transition handshake.

An attacker can Accomplish this KRACK Attack by Performing Man-in-the-Attack and force network participants to reinstall the encryption key used to protected WPA2 traffic.

Almost Any Device is affected in this Attack around the World by this KRACK Attack and Changing WiFi passwords doesn’t protect users. Users must install firmware updates for affected products.

Assigned CVE identifiers

The following Common Vulnerabilities and Exposures (CVE) identifiers were assigned to track which products are affected by specific instantiations of the KRACK Attack:

  • CVE-2017-13077: Reinstallation of the pairwise encryption key (PTK-TK) in the 4-way handshake.
  • CVE-2017-13078: Reinstallation of the group key (GTK) in the 4-way handshake.
  • CVE-2017-13079: Reinstallation of the integrity group key (IGTK) in the 4-way handshake.
  • CVE-2017-13080: Reinstallation of the group key (GTK) in the group key handshake.
  • CVE-2017-13081: Reinstallation of the integrity group key (IGTK) in the group key handshake.
  • CVE-2017-13082: Accepting a retransmitted Fast BSS Transition (FT) Reassociation Request and reinstalling the pairwise encryption key (PTK-TK) while processing it.
  • CVE-2017-13084: Reinstallation of the STK key in the PeerKey handshake.
  • CVE-2017-13086: reinstallation of the Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) key in the TDLS handshake.
  • CVE-2017-13087: reinstallation of the group key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame.
  • CVE-2017-13088: reinstallation of the integrity group key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame.
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

SquareX Discloses Browser-Native Ransomware that Puts Millions at Risk

From WannaCry to the MGM Resorts Hack, ransomware remains one of the most damaging...

Hackers Exploit DNS MX Records to Create Fake Logins Imitating 100+ Brands

Cybersecurity researchers have discovered a sophisticated phishing-as-a-service (PhaaS) platform, dubbed "Morphing Meerkat," that leverages...

New Python-Based Discord RAT Targets Users to Steal Login Credentials

A recently identified Remote Access Trojan (RAT) has raised alarms within the cybersecurity community...

PJobRAT Android Malware Masquerades as Dating and Messaging Apps to Target Military Personnel

PJobRAT, an Android Remote Access Trojan (RAT) first identified in 2019, has resurfaced in...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

Blacklock Ransomware Infrastructure Breached, Revealing Planned Attacks

Resecurity, a prominent cybersecurity firm, has successfully exploited a vulnerability in the Data Leak...

Massive Data Breach Hits NSW Online Registry: 9,000+ Files Stolen

A major cybersecurity incident has struck the New South Wales court system, as cybercrime...

Four Members of Hacker Group Behind 90 Worldwide Data Breaches Exposed

A recent investigation by Group-IB has shed light on a notorious cybercriminal operating under...