cintibiztest-blog - Tumblr blog

What is KRACK and why is it whack?

By Gail Carnes, Owner, Westside Business Services

October 22, 2017

KRACK is hot in the news right now. Even if you haven’t heard of it, you may have recently noted that all of your devices are pushing through the dreaded Operating System upgrades. I have seen more than one of the dreaded “Has anyone else lost text messaging after the new iPhone update?” This article explains what it is, how likely it is to impact you, and what you can do to prevent it.

KRACK stands for Key Reinstallation Attack. It allows the “bad guys” to wait for you to connect to a Wi-Fi network and intercept the data packets. That means they can see anything you send, manipulate the things you are looking at, and get access to information you plug into your computer, like a flash drive or a SD Card. It can allow hackers to do all kinds of malicious things like putting malware on websites that are not secure, infecting you with ransomware, or forging data. Attackers could also steal sensitive data, like credit card numbers. You don’t want to be affected by this attack.

Since this is a vulnerability in wireless networking, the attacker has to be within range of a network you connect. That gives you some power to stop this from happening. It is doubtful that someone is going to sit close to your home to specifically target you, unless you live in a particularly affluent community. It is much more likely that hackers and thieves will go to areas with people likely to have money or information they want, where they will connect to a public hot spot. Places like the airport and coffee shops, especially places like the Starbucks down the street from your Fortune 500 Company’s office, are much more likely to host a KRACKer.

What can you do to protect yourself from a KRACK Attack?

1) Don’t connect to public Wi-Fi until you have patched for the problem.

2) Let patches and updates run! Patches and security updates are available for a lot of devices and coming soon for others. For laptop and desktops Windows 7 through Windows 10 have put security updates through. If you have Windows Security Updates set to automatically run you have most likely already noticed the “Windows is updating. Do not turn off your computer” message when shutting down. Current Linux versions are ready. MacOS 10.11.1 beta and Raspberry Pi users are also good to go, but they already knew. On the phone and tablet end, Apple will be releasing iOS 11.1 in a couple of weeks. Android is expected to release their update on Nov 6, 2017. Most of our Smart TV’s and devices are also affected or assumed to be affected, but do not yet have an update or release date. You can check your devices here. https://www.kb.cert.org/vuls/byvendor?searchview&Query=FIELD+Reference=228519&SearchOrder=4

3) Make sure you use secure websites when providing personal information or credit card numbers. Secure websites use the https:// in the address bar. Don’t provide credit card or personal information on sites that are not secure. That S in the address means that the data is encrypted.

4) Finally, small to mid-size businesses should be using a Virtual Private Network to access company data anytime the user is not physically connected to the LAN or company Wi-Fi. If you need help setting this up, Westside Business Services [CCG1] is happy to assist you.

Windows 7

https://www.microsoft.com/en-us/download/details.aspx?id=43281

Windows 10

https://support.microsoft.com/en-us/help/4027667/windows-update-windows-10

iPhones and iPads

https://support.apple.com/en-us/HT204204

Android devices

https://lifehacker.com/5946585/force-an-android-device-to-check-for-a-system-update