According to the researchers, the WPA2 protocol vulnerability works by intercepting the data at the point of a four-way handshake which uses a passkey called Pairwise. The worst part, however, is that the key can be resent multiple times. This is facilitated by using a cryptographic nonce, an arbitrary number that can be ideally used only once. In this particular case, the cryptographic nonce when sent in a certain manner renders the encryption void. The proof of concept is called KRACK (Key Reinstallation Attacks). The findings have now been made public. Most of the organizations have already received advisories and some of them have also issued patches for their routers. The disclosure is made on the site krackattacks.com. Furthermore, the researchers are also expected to present a talk titled “Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2” on November 1. As per the reports, the encryption bypass is relatively easy and reliable when it comes to the WPA2 protocol. This also means that attackers will be able to eavesdrop on nearby wifi traffic and also opens up the possibility of a forged DHCP setting. It is still not clear whether or not all the access points will be patched. What is worrisome is that the vulnerability lies in the WPA2 protocol and the chances are that even a proper implementation may go in vain. Since the attackers can eavesdrop on data traffic from nearby WiFi, it is advisable not to use WiFi for the time being. It is even better if you consider using a VPN (not exactly foolproof). Apart from that, since the HTTPS is designed to work with WiFi without any encryption it should be relatively safe. Also, make it a point to pay heed to the cert warnings that may pop up.
