A serious weakness in the WPA2 protocol, widely implemented as the recommended default security protocol for all Wi-Fi networks, was disclosed publicly yesterday. This advisory seeks to inform you of the vulnerability and advise what steps have been taken by Milnsbridge to address this issue and also to notify you of potential security risks and how best to mitigate them. This advisory is a high-level overview and is not intended as in-depth analysis of the vulnerability.
What is a KRACK attack?
KRACK stands for Key Reinstallation AttaCKs. Put simply this type of vulnerability can be abused to potentially steal sensitive information such as credit card numbers, usernames and passwords. It can also be potentially used to inject and manipulate data sent to or from affected devices. (Man in the middle)
Who and what are affected?
The attack works against all modern protected WI-FI Networks, this includes wi-fi enabled devices at work and home, as well as mobile devices. An attacker needs to be in range of your wireless network therefore shared multi-tenant buildings are particularly vulnerable. The vulnerability can be exploited via the client operating system such as Microsoft Windows (All versions), Apple IoS, Google Android or via the wireless access points, so updating both is highly recommended at this stage.
Is my Wi-Fi password at risk?
No. The wi-fi password is not recovered in these attacks so is not at risk. However, as a good practice it is also recommended to regularly review and change static passwords used on Wi-Fi networks.
What has Milnsbridge done already?
- All Milnsbridge managed Unifi Wi-Fi devices are currently in the process of being updated to the latest firmware patch (released publicly overnight) which fixes this issue for access points. Devices will be updated across all applicable customers in the next 24hours. Ubiquiti was one of the first vendors globally to have a publicly tested and available firmware patch to address this issue.
- For Milnsbridge managed Forti AP devices, a firmware update will be released in coming weeks to address this issue but is not yet available. If you are currently using Forti Access points then your onsite engineer will be in contact once the update is released to organise a time to upgrade these
- For Microsoft Windows Devices. Microsoft released updates as of October 10 2017 that addresses this issue. These patches have been reviewed and approved for installation across all managed customers as of October 17 2017 via the Milnsbridge Patch Management system.
What about mobile devices?
- Android version 6.0 and above are particularly affected by this vulnerability. Google are yet to release a patch but when the patch is released we recommend updating to this ASAP
- For Apple IOS devices, a fix is being tested in beta and will be made available to the public in coming weeks. Recommendation is to update your devices once available
What do I need to do in the meantime?
- Avoid using public Wi-Fi access points or hotspots
- Ensure home devices such as Routers, Wi-fi Access points are updated if/when updates are released
- Ensure that all home PC’s and Laptops are up to date with windows patches
- If you’re still concerned about your security please get in touch and learn how we can help to protect your business.
Call 1300 300 293 or contact us to find out more.
