The DHS/US Computer Emergency Readiness Team (CERT) issued a warning this morning that literally every Wi-Fi connection is potentially vulnerable to an unprecedented security flaw that can enable hackers to steal sensitive data passing over the network, including passwords, credit card numbers, chat messages, emails, photos, etc...

This "key reinstallation" vulnerability in the Wi-Fi Protected Access II (WPA2) security protocol exists on all modern protected Wi-Fi networks and devices, including Android, Apple, Linux, Windows, OpenBSD, MediaTek, Linksys, and many others.

The vulnerability exists within the Wi-Fi standard itself, and not within individual products. This means that any correct implementation of WPA2 is likely affected.

WHAT NOW ?

First, here is some general guidance that should always be followed:

1. Make sure you have a password on all personal Wi-Fi networks such as in your home or if you use your mobile device for wireless tethering.

2. Try not to connect to unsecured Wi-Fi networks such as those provided in hotels, coffee shops and other public spaces. 

3. If you frequently use unprotected Wi-Fi networks, DISABLE the AUTOCONNECT option for that pathway. 

VULNERABILITY-SPECIFIC GUIDANCE

A. Pay close attention to your email and other communications from your cable / internet service provider. Patches correcting this vulnerability have been or are in the process of being prepared by hardware manufacturers and internet service providers.

B. Update the firmware of your router(s) and all other wireless devices when security updates are made available. DO NOT IGNORE THESE UPDATES. Check who makes your router or with your internet service provider and try their website to find out how to patch it. You may also wish to proactively reach out to the respective customer service groups and inquire about patches and security updates for the "WPA2" vulnerability.

For more specific technical information about this vulnerability, see the resource links below:

DHS/CERT Vulnerability Announcement

https://www.us-cert.gov/ncas/current-activity/2017/10/16/CERTCC-Reports-WPA2-Vulnerabilities

DHS/CERT/CMU Detailed Vulnerability Note

https://www.kb.cert.org/vuls/id/228519/

Detailed Research Paper on the Vulnerability (PDF DOCUMENT)

http://papers.mathyvanhoef.com/ccs2017.pdf