Vulnerabilities found with Wi-Fi networks
The VUMC IT Security Operations team is issuing this communication regarding a vulnerability discovered with secure Wi-Fi networks. The event is related to a weakness exposed in the WPA and WPA2 security protocols. At the current time, Vanderbilt University Medical Center Wi-Fi networks are not affected.
On October 16, 2017, security researchers released a demonstration on how to exploit Wi-Fi Protected Access (WPA & WPA2) utilizing key re-installation attacks (KRACKS). The attack allows a person within range of a user to potentially intercept, alter and decrypt traffic thought to be secure. An attacker who uses KRACKS could steal sensitive information, or even redirect traffic to malicious sites.
Since the security protocol itself is considered vulnerable, any device that has Wi-Fi capabilities and can connect to networks that utilize the WPA or WPA2 protocol should be considered vulnerable to the attack. This includes but is not limited to the operating systems for:
- Windows
- OSX
- iOS
- Android (6.0 and above)
Vendors are developing and providing patches to mitigate the issue. Microsoft released an update on October 10, 2017, for supported operating systems. If you have not applied this patch, it’s recommended you do so as soon as possible. All other users are encouraged to patch as soon as an update is available for their operating system. If a patch is not yet available for your device, please exercise caution when connecting to wireless networks.
Reduce the risk of a KRACKS attack by:
- Utilizing the VUMC VPN, or another trusted VPN
- Tethering your mobile device and connecting it to a computer to utilizing its Wi-Fi
- Using a wired connection
- Assuring that you are utilizing https:// when browsing websites
Security Operations is working with various VUMC IT support teams to assure all protections are in place for VUMC IT-supported equipment.
If you have any questions or concerns, please call the Help Desk at 615-343-HELP (3-4357).
Sources and References:
https://www.krackattacks.com/
https://www.kb.cert.org/vuls/id/228519
https://www.forbes.com/sites/thomasbrewster/2017/10/16/krack-attack-breaks-wifi-encryption/#7dd832bb2ba9
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-13080
https://securingthehuman.sans.org/blog/2017/10/16/28748/