KRACK: the 2017 attack that broke your Wi-Fi's WPA2

For more than a decade, WPA2 was the default answer to "how do I secure my Wi-Fi?" New router, strong password, WPA2 on, problem solved. On October 16, 2017, Belgian researchers Mathy Vanhoef and Frank Piessens of KU Leuven published a study that shattered that certainty: the protocol itself had a design flaw. It did not matter how long the password was. The attack was named KRACK, for Key Reinstallation Attack.

What is KRACK?

What is the KRACK attack on WPA2?

KRACK is an attack that tricks a device into reinstalling an encryption key that is already in use, which resets its internal counter and lets the attacker decrypt, and in some cases alter, Wi-Fi traffic. It does not recover the network password. It exploits a step of the connection that the standard described ambiguously.

The attacker has to be within range of the signal and position themselves between the device and the router, so this is a proximity attack, not something launched from the other side of the world. According to the CERT/CC advisory (VU#228519), the problem lay in the protocol specification, not in a single vendor.

How the attack works, step by step

When a phone or laptop joins a WPA2 network, both sides run the four-way handshake, a four-message exchange that agrees on the session key. The weak point is the third message:

1. The router sends message 3, telling the client to install the key.
2. The client installs the key and replies. On installation, it resets the nonce (a counter that should never repeat with the same key) and the replay counter.
3. The attacker blocks or delays that reply. With no confirmation, the router resends message 3.
4. The client installs the same key again and resets the counter once more.

Reusing a nonce with the same key is the classic cryptographic mistake: packets end up encrypted with the same keystream, and comparing two of them lets the attacker recover the content. Depending on the cipher and the device, the attacker could decrypt packets, replay old packets, hijack TCP connections and even inject content into unencrypted HTTP traffic.

The worst case: Android and Linux

According to Vanhoef, the wpa_supplicant implementations used on Linux and Android 6.0 or later had an aggravating bug: when reinstalling the key, they installed an all-zero key. That made it trivial to decrypt the device's traffic. Since this client is the basis of a large share of Android phones, the practical impact was huge, and the fix depended on each manufacturer shipping an update, which on Android has always been slow.

In total, ten CVE identifiers were assigned to the KRACK family, starting with CVE-2017-13077 (reinstallation of the pairwise key in the handshake).

What KRACK did not do

• It did not reveal the Wi-Fi password. Changing the router password fixed nothing.
• It did not break HTTPS. A site using HTTPS stayed encrypted on top of the Wi-Fi, so the attacker saw at most the destination of the connection, not passwords or content.
• It did not work remotely. It required physical range of the signal and a specific position in the communication.

That is why the advice at the time was not "give up on Wi-Fi" but "update your devices." The fix could be applied on the client side (phone, laptop, IoT) in a way that stayed compatible with routers that had not been patched yet.

How do I know if my device is protected against KRACK?

If it has received security updates since October 2017, it is protected against the original KRACK. Microsoft had already patched Windows on October 10, 2017, and Apple included mitigations in iOS 11.1 and macOS 10.13.1. Devices that never received another patch, such as old cameras and IoT gadgets, remain the weak link.

What changed afterward

KRACK sped up adoption of WPA3, announced by the Wi-Fi Alliance in 2018, which replaces the handshake with a method more robust against this kind of manipulation. WPA3 is not a silver bullet (researchers found flaws in early implementations), but the design lesson stuck: security protocols need formal verification, not just good intentions. The study only existed because someone decided to check, methodically, what the specification actually guaranteed.

What to do today

1. Keep your phone, laptop and router updated. Turn on automatic updates and replace any router the manufacturer has abandoned. The guide to home router hardening lists the settings to change.
2. Use WPA3, or WPA2 with AES/CCMP, never WEP or old WPA with TKIP. More in the step-by-step on securing your Wi-Fi router.
3. Prefer HTTPS sites and be suspicious of any certificate warning on an open network. The Evil Twin attack exploits the same public Wi-Fi scenario.
4. On public networks, consider a VPN, understanding what it does and does not protect: Is a VPN worth it? explains.

The bigger lesson

KRACK showed that "using the right protocol" is not enough when the protocol's design is ambiguous, and that the slowest link in any fix is the device nobody updates. A similar pattern appeared in Heartbleed, where a flaw in widely used code took years to disappear from the internet.

To keep going, the article on Wi-Fi router hardening is the next practical step.

Sources: CERT/CC (VU#228519), krackattacks.com (Mathy Vanhoef), Microsoft and CERT-EU (advisory 2017-021).