Don’t Get KRACK-ed

In All, Blog, BYOD, Manage Risk by Alex Kallimanis

By now you may be aware of the recent discovery of a security vulnerability in the WPA2 security standard for Wi-Fi networks, as reported by CNN, Fox News, cnet and other news sources. WPA2 has been the accepted standard for security since it’s 2004 inception, which means that the vast majority of networks run the protocol and an even larger number of connected devices are at risk for vulnerability.

The exploit (the Key Reinstallation Attack or KRACK) requires physical proximity to your network, but the results of a breach are varied in scope and severity. The KRACK vulnerability “means hackers could steal your passwords, intercept your financial data, or even manipulate commands to…send your money to themselves.” (Wired.com)

As you are reading this hardware companies are working on individual patches for hardware devices, ranging from Wi-Fi routers, to servers, to the phone in your pocket. In order to protect yourself from the risk of a security breach it is imperative that your hardware is updated as soon as patches become available.

For our clients on managed services this means that for the next week (and every time there is a security update being pushed out) you should follow this protocol:

  1. Leave your hardware (laptops, desktops, routers, access points, etc.) plugged in and on overnight
  2. If your device is configured to “Sleep” after a period of time, make sure that you’ve changed your setting to never sleep when plugged in by:
    1. Opening the Control Panel
    2. Clicking Hardware and Sound
    3. Clicking Power Options
    4. Clicking “Change when the computer sleeps” on the left panel
    5. Using the drop-down menu under “Plugged in” to change the sleep setting to Never
    6. Keeping your battery and”Turn of the Display” setting the same
  3. Reboot your device at the end of each day and allow the machine to stay in that state overnight. There is no need to log in to Windows.

Adhering to these directions will allow updates to be pushed out to your machine, while not following them directly could result in your hardware remaining vulnerable.

In order to protect personal devices — BYOD laptops, cell phones, home networking devices — make sure to run updates as they become available.

  • Windows 10 PC’s:
    1. Make sure your device is plugged in (with at least 50% battery if a laptop)
    2. Search for “update” in your Cortana tool bar
    3. Select Check for Updates
    4. When the window opens read when the last check for updates was, and click the check for updates button
    5. Make sure to save anything that you are working on, in case your machine needs to restart
    6. Allow your computer to update itself
  • MacOS:
    1. Make sure your device is plugged in (with at least 50% battery if a laptop)
    2. Open the App Store
    3. Click Updates in the navigation bar
    4. Download and install updates as they become available
  • Android:
    1. Open Settings
    2. Open System Update
    3. Click Check for System Update
    4. Download and install updates as they become available
  • iOS:
    1. Open Settings
    2. Click General
    3. Click Software Update
    4. Download and install updates as they become available