Security experts of KU Leuven found critical vulnerabilities in the WPA2 protocol, which potentially allow for illegal eavesdropping and manipulation of sensitive information by third parties without the necessity of knowing the WiFi password.  What consequences the so called KRACK (Key Reinstallation AttaCK) implies for Smart Home and Internet of Things in general will be explained in the following sections.

But first…

How does it work?

KRACK uses a vulnerability in the design of WPA2 which allows attackers to manipulate certain messages of the 4-way handshake used when a client requests to connect to an access point. In the process of this handshake multiple Nonces (number used once) are used to allow communication participants to negotiate a secure encryption key. KRACK uses a design flaw in this handshake to force the reuse of such nonces and thereby allows for the replay and forging of handshake messages and the eponymous reinstallation of an already-in-use encryption key. A more detailed explanation of KRACK can be found here.

Although all devices (no matter what platform) communicating via WiFi on an WPA2 protected network are potentially affected by KRACK, the attack is exceptionally critical for Android devices. These, as a consequences of another implementation bug, can be tricked into (re)installing an all-zero encryption key – WPA2 encryption is thereby effectively bypassed. The following demonstration shows a full exemplary attack on an Android devices communication:

Is it as bad as it sounds?

Yes, it is indeed quite bad… But actually not really.

It is true that KRACK is able of allowing unauthorised third-parties to read and/or manipulate certain (read: unadequately secured) communication happening on your WPA2 secured WiFi network. But first, the network pre-shared passphrase is not affected and second, every communication that would be secure on an unsecured open WiFi network is still secure even on a KRACK‘ed network. Phew!

A secure HTTPS/TLS protected connection as it is nowadays used for online banking, internet payments or even social networks is not affected by this vulnerability and offers the same security level as ever.

The real problem is communication not adequately secured, i.e. connections which are susceptible to Man-in-the-Middle attacks anyways or as in the demonstration video above, services which allow for a fallback to an unsecure HTTP connection or do not even provide an option for secured communication. For these systems KRACK is not a new problem but just a new manifestation of the same problems they have anyway.

What are the consequences for Smart Home and the Internet of Things?

Actually there is not much changing with KRACK becoming known to the public – Still an adequate and secure use of encryption is the ultimate measure for security of a given Smart Home or IoT product. KRACK does not change anything in this regard, it is just another prime example hopefully showing manufacturers that a solid security concept right from the start is the best protection against future threats.

What are the consequences for tests and ratings on iot-test.org?

Basically none. All tests published here include a test for the possibility of Man-in-the-Middle attacks (which KRACK basically is) and all products passing this test are also practically secure against the consequences of a key reinstallation attack on the network they are operating on. So no changes necessary here.

What might change is the weighting of the local communication security tests for the final rating – In our tests we regularly encounter Smart Home and IoT Systems which completely omit encryption for local communication. In most cases even when informed manufacturers seldom comprehend how important an additional security layer on local level is. Now with KRACK  impressively showing what critical consequences this might have, there is really no acceptable excuse anymore for not protecting local communication.

Bottom Line

No. 1 Principle Of IoT Security by OWASP: Assume a hostile edge!

According to this rule the design of a Smart Home or IoT device should always consider a compromised, not trustworthy and potentially hostile environment in which the device might be operating. With this basic premise in mind the absolute necessity to always encrypt ALL communication, local and online, is evident – KRACK just helps manufacturers to eventually grasp the concept.