KRACK lets someone within range of a Wi-Fi network read traffic that WPA2 should protect. Install updates for phones, laptops and routers as they arrive; changing the Wi-Fi password does not help.

What was announced on Monday

On Monday, researchers published details of a weakness in WPA2, the security that protects almost every Wi-Fi network in offices, shops and homes. They named it KRACK.

The flaw is in the handshake that devices use to agree on encryption keys when they connect.

By interfering with that handshake, someone nearby can make a device reuse values that should never repeat. That lets them read some of what it sends over Wi-Fi, and in some setups alter it.

It is not a fault in one brand of equipment. It is in the standard itself, which is why it reaches phones, laptops, tablets and routers alike.

The fixes are software updates. Some were ready before the announcement, more are promised for the coming weeks, and some older devices will never receive one.

What it does and does not mean

The second is the one to tell staff. After security news the instinct is to change passwords, and here that achieves nothing: the weakness is in the connection process, so a new password falls the same way.

Why the devices matter most

The main attack targets the device joining the network rather than the router, so the most important updates are for phones, laptops and tablets.

Routers and access points need updates too, particularly ones that extend a network, bridge two networks, or connect to another network themselves.

In a typical office or shop, the list of devices on Wi-Fi is longer than anyone expects: printers, cameras, a front desk tablet, a television in the waiting room, a thermostat.

Each has its own software and its own maker, and some will never be updated.

Updates, in order

Phones and laptops first. Install system updates as they arrive over the coming weeks, and turn on automatic updates wherever they are off.

Then the router and any access points. Many routers never update themselves, so check the maker's support page for new firmware, the software inside the router, and note when it was promised if it has not arrived.

Then everything else on the list. For any device that will not get an update, move it to a wired connection, keep it on a separate network, or plan to retire it.

A router so old that its maker no longer supports it needs replacing, not waiting on.

Why HTTPS still protects your visitors

What a visitor sends to a website over HTTPS is encrypted between their browser and your server, separately from the Wi-Fi. A weakened Wi-Fi connection does not expose it.

A site still on plain HTTP has no such second layer. On an affected network, someone nearby could read what a visitor types into its forms.

One gap is worth closing. If a site still answers on plain HTTP, someone on the same network can sometimes push a visitor onto that plain version. A setting called HSTS tells browsers to use only the secure one.

Ask whoever maintains the site whether every page redirects to HTTPS and whether HSTS is switched on.

A worked example

A makerspace in a light industrial unit has about eighty members, a members' Wi-Fi network, a guest network for visitors and tours, and a tablet at the front desk where members sign in.

On Tuesday the volunteer who looks after the network listed everything connected to it. The list ran to two pages.

Members' own phones and laptops were their own responsibility, so a sign went up by the door asking everyone to install updates as they arrive.

The space's own equipment was harder. The laptop that drives the laser cutter had updates waiting since the summer, and the front desk tablet was four years old and no longer received any.

Two 3D printers had Wi-Fi modules nobody had thought about since setup.

The laptop was updated that evening and moved onto a cable. The printers went back to taking jobs from memory cards. Until it is replaced, the tablet opens only the sign-in page on the space's website, which runs on HTTPS.

The router's maker has promised new firmware. The volunteer checks its support page every Friday.

Customers on your Wi-Fi

Many shops, cafes and waiting rooms offer Wi-Fi to customers. Their phones are theirs to update; the router that serves them is yours.

If a customer asks about this week's news, the honest answer is short: it affects Wi-Fi everywhere, sites using HTTPS stay protected, and updating their phone is the fix.

And avoid promising secure Wi-Fi on a sign or a menu. Say that it is available, and leave the security to the HTTPS sites people use.

Staff working away from the office

The same weakness applies to every Wi-Fi network a laptop joins: the coffee shop, the hotel, the client's boardroom.

Until a laptop or phone is updated, sensitive work is better done over the phone's own data connection, or through a VPN, a secure tunnel back to the office, than over someone else's Wi-Fi.

The counter-case

The risk is real but bounded. The attacker has to be physically within range and aim at a particular network; this is not something that sweeps across the internet hitting thousands of businesses at once.

A small shop with current phones, an updated router and a website on HTTPS is in a far better position than the headlines suggest.

Updates are still the answer, though, and they still need someone to install them. Many devices will not update on their own, and a few never will.

Install the updates as they arrive, keep a list of what is on the network, and keep the website on HTTPS.

The week's work

  1. List every device on your Wi-Fi.
  2. Turn on automatic updates on phones and laptops.
  3. Check the router maker's page for new firmware.
  4. Move devices without updates onto a cable.
  5. Confirm the website uses HTTPS on every page.
  6. Ask whoever maintains the site about HSTS.
  7. Tell staff a new password will not help.

Step one is where everything else starts. Few offices can say what is connected to their Wi-Fi, and the devices nobody remembers are exactly the ones that never get updated.

The other everyday route into an office, a password typed into the wrong page, is covered in fake login pages for office email.

Frequently asked questions

What exactly is KRACK?

A weakness in WPA2, the security used by almost every Wi-Fi network, disclosed on Monday. Someone within range can read some of what a device sends over Wi-Fi.

Should we change the Wi-Fi password?

It will not help. The weakness is in how devices and routers set up encryption when they connect, not in the password, so a new one falls the same way.

Is updating the router enough?

No. The main attack targets phones, laptops and tablets, so each device needs its own update. Routers need updates too, especially ones that extend or bridge networks.

Does HTTPS on my website still protect visitors?

Yes. HTTPS encrypts what visitors send between their browser and your server, separately from the Wi-Fi, so a weakened Wi-Fi connection does not expose it.

What about devices that never get updates?

Move them to a wired connection or a separate network, limit them to secure sites, or plan to retire them. Older tablets and printers are common examples.

How worried should a small business be?

Enough to install updates promptly, not more. The attacker has to be within range of the network, so this is not an attack that sweeps across the internet.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Website still answering on plain HTTP?

Send us the address. We will check that every page and form is encrypted, whatever Wi-Fi visitors are on.

Start a Conversation