By now you've probably seen the KRACK headlines. Monday morning a researcher out of KU Leuven dropped a paper on a flaw in the WPA2 handshake itself, not some vendor's sloppy implementation, the actual protocol that basically every wifi device on earth uses. I'm not going to re-explain the whole key reinstallation thing here, half the internet already did that better than I could, with diagrams. What I want to write down is what I actually did about it Monday night through tonight, because "patch your router" turned out to be a lot more annoying in practice than in theory.
First, the honest bit: this isn't the end of the world. If a site uses HTTPS properly, KRACK doesn't hand over your banking password just because someone's parked outside with a laptop. The real damage is on stuff that doesn't encrypt at the app layer, and on Android specifically, because of how wpa_supplicant 2.4 and up reinstalls an all-zero key. I'm running a Nexus 6P as my daily phone, which means I'm sitting in the worst-case bucket. Great.
So here's what changed at my place over the last two nights.
Monday night: read the actual paper (skimmed, let's be real), then went looking for firmware updates. My router is a Netgear Nighthawk R7000, which I bought for about $180 back in early 2015 and have mostly ignored since. Checked the admin page. Nothing. Checked Netgear's own security advisory page. They'd posted an acknowledgment, no fix yet, "working on it." Fine, I get it, it's Monday.
Tuesday: still nothing from Netgear. Meanwhile Ubiquiti had firmware out within about a day for their UniFi line, and Microsoft's fix had actually already shipped quietly in the October 10th Patch Tuesday, before the public disclosure even happened, because they were looped in early. Which tells you something about how coordinated disclosure is supposed to work and mostly does, except when your vendor is a consumer router company that treats firmware updates like a once-a-year chore.
Tonight (Wednesday), what I actually settled on doing since I'm not waiting around forever:
- Turned off WPS entirely on the router. It was already off, honestly, I turn that off on every router the day I set it up, it's a mess.
- Went through every device on the network and checked for pending OS updates. iOS had nothing new yet, Apple says a fix is already sitting in a beta. Android, as expected, nothing, and Google's own statement was basically "coming in the following weeks," which for a security bug is not a great answer.
- Started actually paying attention to which sites I visit at coffee shops and on my own network don't force HTTPS. There are more than I'd like. A local news site I read most mornings still serves plain HTTP for no reason I can figure out in 2017.
- Did not throw out my router and buy a new one, despite being tempted, because the flaw is in the protocol, not this specific box, so a new router bought today has the exact same problem until it gets patched too.
One thing that's bugging me completely unrelated to any of this: since the iOS 11 update my phone has started autocorrecting a capital "I" into a weird black box with a question mark in it, mid-sentence, no warning. It's been doing it for almost a week now and it makes texting anyone feel like I'm sending ransom notes. Apparently a fix is coming in 11.1. I bring this up only because it's the kind of thing that makes you realize how much dumb, unglamorous bug-fixing work is happening behind the scenes at these companies at any given moment, security disclosure or not.
Anyway. If you run your own network, go check your router vendor's advisory page tonight, not tomorrow. If you've got a Netgear box like mine, don't expect much yet. And if your phone runs Android, maybe don't do your online banking over open coffee shop wifi for a couple of weeks. Ethernet cables are cheap and boring and, this week especially, kind of appealing.