Highly Secured WiFi Protocol “WPA2” Critical Weakness allows to Break any WiFi Network using Key Reinstallation Attack (KRACK Attack) and this flow is given an Ability to Attacker to crack any of Victims WiFi Modem within The Range of Network.
Wi-Fi Protected Access II (WPA2) is security protocol and security certification program developed by the Wi-Fi Alliance to secure wireless computer networks. The Alliance defined these in response to serious weaknesses researchers had found in the previous system, Wired Equivalent Privacy but Now WPA2 also Flowing with New Attack.
This Critical KRACK Attack allows an Attacker to Steal the Sensitive Information such as credit card numbers, passwords, chat messages, emails, photos, and so on.
Researchers Said , this key reinstallation attacks can Work against all modern protected Wi-Fi networks and also it is Possible to inject the Ransomware and malware, manipulate data into victims network and website.
It is not Limited to any Environment which including home network Or Corporate Network. so this Weakness will have affected to all the WPA2 Protected Modems.
This Attack will Work against AES-CCMP, and GCMP, Ciphers WPA-TKIP, WP1, WPA2, Personal and enterprise networks.
Also Read : PoC Script Released for Remote WiFi Hack Including iOS and Android
How Does WPA2 Flow KRACK Attack Works
This flow mainly abuses the flow of design and implementation of cryptographic Protocols by re-installing the already used key in the 4-way handshake that is used to generate the new session key.
In This KRACK Attack Tricks to Victims into reinstalling an already-in-use key protected WPA2 traffic by manipulating and replaying cryptographic handshake messages.
By this way, Attacker can also reset to their initial value of associated parameters such as the incremental transmit packet number and receive packet number.
Key reinstallation Against 4-way Handshake
Once User joined with the WiFi Network, it used to execute the 4 way-handshake to negotiate A Fresh Encryption key and it will be installed receiving message 3 of the 4-way handshake.
Later it will be used for Encrypt the user data using a normal Excryption method by an encryption protocol.
In this case, sometimes Handshaking message may be dropped or lost so Access Point (AP) will retransmit message 3 if it did not receive an appropriate response as acknowledgment.
So a client may receive message 3 multiple times. Each time it receives this message, it will reinstall the same encryption key, and thereby reset the incremental transmit packet number (nonce) and receive replay counter used by the encryption protocol.
According to Researchers, We show that an attacker can force these nonce resets by collecting and replaying retransmissions of message 3 of the 4-way handshake. By forcing nonce reuse in this manner, the encryption protocol can be attacked, e.g., packets can be replayed, decrypted, and/or forged. The same technique can also be used to attack the group key, PeerKey, TDLS, and fast BSS transition handshake.
An attacker can Accomplish this KRACK Attack by Performing Man-in-the-Attack and force network participants to reinstall the encryption key used to protected WPA2 traffic.
Almost Any Device is affected in this Attack around the World by this KRACK Attack and Changing WiFi passwords doesn’t protect users. Users must install firmware updates for affected products.
Assigned CVE identifiers
The following Common Vulnerabilities and Exposures (CVE) identifiers were assigned to track which products are affected by specific instantiations of the KRACK Attack:
- CVE-2017-13077: Reinstallation of the pairwise encryption key (PTK-TK) in the 4-way handshake.
- CVE-2017-13078: Reinstallation of the group key (GTK) in the 4-way handshake.
- CVE-2017-13079: Reinstallation of the integrity group key (IGTK) in the 4-way handshake.
- CVE-2017-13080: Reinstallation of the group key (GTK) in the group key handshake.
- CVE-2017-13081: Reinstallation of the integrity group key (IGTK) in the group key handshake.
- CVE-2017-13082: Accepting a retransmitted Fast BSS Transition (FT) Reassociation Request and reinstalling the pairwise encryption key (PTK-TK) while processing it.
- CVE-2017-13084: Reinstallation of the STK key in the PeerKey handshake.
- CVE-2017-13086: reinstallation of the Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) key in the TDLS handshake.
- CVE-2017-13087: reinstallation of the group key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame.
- CVE-2017-13088: reinstallation of the integrity group key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame.
