Overview
A flaw in the implementation of WPA2-based encryption allows for an attacker within physical range of the wireless network to decrypt traffic from a vulnerable client, allowing for viewing, intercepting, and modifying data in transit.
This vulnerability has been assigned CVE numbers CVE-2017-13077 through CVE-2017-13088 [1].
There does not yet exist a working public exploit for this attack. However, the research group who discovered it have published their efforts [2], and working exploit code is likely a matter of days away.
Impact
An attacker who is passively listening to an active wireless network would be able to decrypt traffic sent by or to the vulnerable client [1]. This allows for the attacker to observe sensitive information, modify information in transit, or impersonate the client to the intended target. The ultimate effect of this vulnerability is that the benefits of encryption at the level of wireless traffic are largely invalidated, and communications over WPA2 are of a similar security as an open, unencrypted network.
It’s important to note that, while the vulnerability affects all unpatched systems that use WPA2-based encryption, this attack is especially effective against Linux- and Android-based devices due to an implementation flaw in the wireless capabilities of these systems. This is serious for IoT or “smart” devices and appliances, which commonly utilize WPA2-based wireless encryption and often do not receive security updates.
Affected
All unpatched clients that use Wi-Fi with WPA2 encryption are affected. This includes both WPA2-PSK and WPA2-Enterprise.
Recommendations
Update devices to most recent version, where available. Microsoft pushed out an update in October 2017’s Patch Tuesday that fixes this vulnerability on Windows hosts. Patches are available for MacOS and iOS devices by Apple. A fix is in the works for Linux and Android devices, which will be available in the coming weeks. For a full list of vendors and the status of patches, Carnegie-Mellon’s CERT.org vulnerability note VU#228519 compiles affected vendors and current update availability [3].
In general, because of the insecurities inherent in communication over a wireless medium, Wi-Fi traffic should be treated as largely unsafe when designing a network. As much communication as feasibly possible should be performed over encrypted channels, such as HTTPS instead of the unencrypted HTTP.
These attacks do not recover the Wi-Fi network password [1]. Thus, changing the password of your wireless network is unnecessary at this time, though we do recommend a regular rotation as part of good security hygiene.
