An expert cybersecurity researcher has discovered a series of twelve vulnerabilities that affect all devices with WiFi and has reported that these can lead to the theft of sensitive information, access to home network devices and exfiltration of transmitted data.
The discovery of the so-called FragAttacks has been made by Mathy Vanhoef, the same researcher who discovered in 2017 KRACK, a vulnerability that affected the WPA2 protocol of the WiFi network and that allowed access to user traffic.
As Vanhoef explained on a website created to report on these vulnerabilities, of those identified, three are design flaws in the WiFi standard, which is why they affect most devices. Others are due to widespread programming failures.
The researcher assures that, according to the experiments carried out, “all WiFi products are affected by at least one vulnerability, and most products are affected by various vulnerabilities. ”
The vulnerabilities can affect sensitive user information such as usernames and passwords and to “exfiltrate transmitted data”, although it ensures that if a website always uses HTTPS as an extra layer of security, data cannot be stolen.
In addition, the researcher explains that the “greatest risk” is in the vulnerabilities of the home network, since attackers can access devices of the “Internet of things “taking advantage of the fact that these devices are not usually updated and that WiFi security is their” last line of defense. ”
The researcher has identified twelve Common Vulnerabilities and Exposures (CVEs) whose identifiers he has shared on the FragAttacks website. Hackers can intercept sensitive information or show fake websites to users with WiFi networks protected by WPA2 such as WPA3.
The vulnerabilities also affect the first WiFi protocol, WEP, which means that part of these design flaws date back to 1997, as Vanhoef has indicated, although he clarifies that these types of flaws are “difficult to abuse. “
The researcher reports that there is a series of updates prepared over a period of nine months and a half monitored by the Wi-Fi Alliance and the Industry Consortium for the Advancement of Internet Security (ICASI) to protect users from this threat.
If a user still cannot update their ‘router‘or WiFI device, recommends general security practices such as updating devices, not reusing passwords and not visiting suspicious websites. But to mitigate the effect of the attacks, he suggests using the encryption protocol on the web. HTTPS.
Vanhoef considers these vulnerabilities to be a surprise”, given that “WiFi security has improved significantly in recent years”, and these episodes demonstrate the importance of regularly testing WiFi products for vulnerabilities.