The dangers of public Wi-Fi are well known, but now it seems that WPA- and WPA2-secured routers may not be safe, either. In fact, compromising secured Wi-Fi sources just got a lot easier.
While testing the limits of the upcoming (and much more secure) WPA3 Wi-Fi standard, a researcher accidentally uncovered a new strategy to intercept a router’s four-way handshake and come away with Pairwise Master Key Identifier (PMKID) on WPA/WPA2 connections. This allows the hacker to crack the router password through brute-force attack and gain access to the network and all devices attached to it, along with all their traffic and valuable personal information.
This newly discovered vulnerability changes the game for hackers with their sights set on Wi-Fi attacks, since finding success becomes far quicker and simpler. And while a new standard of Wi-Fi is on the way, three-quarters of all Wi-Fi points are relying on WPA/WPA2 encryption in the meantime. Businesses and consumers alike must know what they’re dealing with when it comes to these attacks, as well as how to protect themselves.
- Concerned about your security online? Protect yourself with a VPN
The consequences of a WPA/WPA2 attack
Wi-Fi wasn’t always so easy to hack. Before this new strategy was discovered, a hacker had to sit around monitoring chatter on the Wi-Fi network and wait until a user logged in to intercept the network password. Thanks to this new discovery, however, there is no waiting game. A bad actor can choose to tune in at anytime and get their hands on a hash which will help them guess the password.
Once they’ve broken into the Wi-Fi, the hacker can then download all web traffic the user creates. They can go through this later, and search for valuable personal data that was entered into any form, such as payment info, social security numbers, or passwords for other accounts. While more and more sites each day — from financial institutions to major retailers — turn to HTTPS to encrypt their traffic, many large sites such as ESPN still leave their users unsecure through HTTP.
In the meantime, there are some steps that anyone with a router and Wi-Fi signal should take to lower their chances of attack.
First, users should get rid of the 20-digit key that came with router. The randomly generated passwords provided by the router brand often have patterns that hackers can crack through brute force attacks with the help of a password decoding tool.
Instead, generate your own random key. Make sure it’s long and complicated (20 to 30 characters is recommended), but different than the originally assigned key. There are plenty of websites and tools that can do this for you.
Additionally, a VPN is always the best move for stopping cybercriminals at the final step of attack. Even if they gain access to your Wi-Fi connection after interfering with the handshake and decoding the password, a VPN prohibits them from seeing your traffic or browser data.
The advent of WPA3 will trump all of these measures in importance. However, even after we run on WPA3-secured Wi-Fi, engaging in these best practices is still recommended. In our rapidly changing cybersecurity world where new hacking strategies seem to emerge every day, users can never be too careful about their security habits.
What’s different about WPA3?
The release of WPA3 is aimed to improve on security vulnerabilities, and it does a good job of it. This is the first new revision to Wi-Fi security since WPA2 arrived in 2004. In October 2017, the KRACK vulnerability was discovered in WPA2. After these attacks the Wi-Fi Alliance realized it was time for a new standard, as opposed to a simple device upgrade, hence WPA3.
When WPA3 arrives, existing router manufacturers should release firmware upgrades to allow WPA/WPA2 routers to run on the new standard. Devices will also need upgrades to run on WPA3.
While the experience won’t change on the user’s end, WPA3 upgrades create a bigger burden for hackers in a couple of different ways. For one, hackers won’t have an opportunity to guess the password over and over again until they crack it — instead they’ll have limited attempts.
Secondly, they won’t have free-for-all access to browsing data as they currently do on WPA/WPA2 connections. Now, hackers can look back at old traffic data from past sessions. With WPA3, they’ll only have access to the current traffic from that individual browsing session, a feature called “forward secrecy.”
These changes mostly apply to home-based Wi-Fi, but the Wi-Fi Alliance has noted that increased security changes are coming to internet access for enterprise environments as well.
The cybersecurity landscape grows more threatening all the time thanks to new vulnerabilities that bad actors discover. Newer, more secure protections are always on the horizon, but that’s no excuse to expose yourself or your business to risks because you didn’t take the time to proactively protect your information. While WPA3 is on the way, ensure best practices are embedded throughout your organization for a strong cybersecurity foundation.
Andrew Proctor is IT operation & support at OpenVPN, Private Tunnel
- These are the best wireless routers of 2018
