KRACK is one of the more insidious router vulnerabilities to crop up lately. You can read more about it in our full report, but briefly: An attacker within physical range of a Wi-Fi network could create a rogue “copy” of the network to fool vulnerable devices and gather all their information.
It’s a clever flaw that bypasses most of the safeguards that keep wireless routers and connected devices protected.
There are two pieces of good news, however. The first is that the flaw was discovered by a security researcher, and there’s no evidence that it’s ever been exploited in the wild. The second is that major companies have known about the flaw for months, and some of them have already released patches for affected software and hardware. ZDNet took a stab at a comprehensive list, and Tom’s Guide has contacted a few additional manufacturers to see how they’re coming along.
MORE: Best Wi-Fi Routers
First, take a deep breath: Your computer is probably OK. Both Apple and Microsoft have released patches to address the issue. As long as you keep your system updated regularly, you won’t have to worry about your computer falling prey to the rogue networks. Newer builds of Linux are also in good shape, but to be fair, Linux is hardly a hotbed of attacks to begin with.
Your smartphone may be a different story. While iOS is fully secured, newer versions of Android are not yet. Since every smartphone manufacturer and wireless carrier uses a slightly different version of the Android OS, it’s difficult to say when your device will be patched, if ever. Google is currently “aware of the issue,” according to ZDNet, but it’s hard to say what steps the company will take next. Your best bet would be to use mobile data whenever possible instead of Wi-Fi, unless you’re at home or the office. (Unless you’ve made some very dire enemies, the attack is really only useful in public, highly trafficked Wi-Fi locations.)
Surprisingly, only a handful of router manufacturers have taken proactive steps to address the flaw. Arris is “evaluating” its options, ZDNet reported, but hasn’t actually released any patches. Cisco has confirmed that many of its products are vulnerable, and has released patches for some of them — but not others. If you have a Cisco system, keep it updated, and hope that your device is one of the safe ones. Netgear has likewise updated some of its devices, but others are still vulnerable, and may be for some time.
Tom’s Guide contacted D-Link, Linksys and TP-Link to see if those companies have released patches yet, or are planning to soon. The responses we've received are below.
From Linksys:
“Belkin International (Belkin, Linksys, and Wemo) is aware of the WPA vulnerability. Our security teams are verifying details and we will advise accordingly. Also know that we are committed to putting the customer first and are planning to post instructions on our security advisory page on what customers can do to update their products, if and when required.”
From D-Link:
"On Oct. 16, 2017, a WPA2 wireless protocol vulnerability was reported. D-Link immediately took actions to investigate the issues. This appears to be an industry-wide issue that will require firmware patches to be provided from the relevant semiconductor chipset manufacturers. D-Link has requested assistance from the chipset manufacturers. As soon as patches are received and validated from the chipset manufacturers, D-Link will post updates on its website support.dlink.com immediately. "
The fact is that there will probably never be complete protection against KRACK among routers and mobile operating systems, simply because the market is so enormous and fractured. The best you can do is avoid public Wi-Fi whenever possible (even if it’s secured with a password), use mobile data if you can and keep the firmware updated on your own router at home. If the flaw starts becoming common in the wild, other manufacturers will (probably) step up their patching game; if not, you can’t fall prey to a hack that no one is using.
UPDATE: US-CERT has a long list of vendors sorted according to whether they've updated the KRACK flaws in their products. Windows Central has a similar, but shorter, list of router makers that have issued patches.
