What difference a week makes!  New information has surfaced on the cybersecurity risks of the WPA2 vulnerability announced last week.  As it turns out Neoscope is down-grading the risk from a Level 4 to a Level 7 (less risk) on our Cybersecurity risk scale of 0 – 9.

There are six (6) reasons for this change by Neoscope:

  • Attackers must perform a sophisticated Man-In-The-Middle (MiTM) attack between Access Point (“AP”) and Client to exploit this set of vulnerabilities.
  • Attackers must create a rouge Access Point, cloning the same MAC Address and SSID as the AP under attack, but on a different channel.
  • Attackers must be in physical proximity to your Access Point(s) to perform these attacks.
  • Attackers must witness a 4-way hand-shake between client and AP which are performed infrequently but can likely be induced with other attacks.
  • Windows and MacOS (including iOS) do not access retransmission of Message3 requests in the 4-Way Handshake. Linux and Android are not as robust in this regard and do allow for this.
  • Many devices are not at risk if they are setup with Bridge-Mode disabled, or with 802.11r (Fast roaming) disabled. For businesses with a single Access Point, these two protocols should be disabled by default.

What’s this all mean – am I home free or do I have work to do?

Unfortunately, the reality is most Access Points have not been patched in some time.  It’s more likely that your AP is at risk from other security issues in addition to this WPA2 4-Way Handshake attack called KRACK.  As a security professional, I’m still advising ALL my clients to upgrade their AP’s, but to do so at their earliest convenience.  How long you take depends upon your risk tolerance.