Speaker 1: When you set up a Wi Fi network, you should
Speaker 1: always create a unique admin and password to protect it,
Speaker 1: and you should also know that that doesn't really matter
Speaker 1: anymore for now. I'm Jonathan Strickland, and this is tech
Speaker 1: Stuff Daily. If you've ever used a Wi Fi network
Speaker 1: with security settings, you're likely relying upon a protocol called
Speaker 1: w p A two. It stands for WiFi Protected Access
Speaker 1: and it's a security certification program that's supposed to allow
Speaker 1: for secure communication between devices and the Internet. Only now,
Speaker 1: there's a workaround that makes w p A two about
Speaker 1: as safe as a vault door made of tissue paper.
Speaker 1: Some researchers uncovered the security flaw and wrote a paper
Speaker 1: about it, publishing that paper in October. The flaw means
Speaker 1: that devices running on Android, Lennox, Open BSD, and a
Speaker 1: few other operating systems may send information to something that
Speaker 1: appears to be a specific WiFi access point, but in
Speaker 1: fact is a malicious clone. Some operating systems, like iOS
Speaker 1: and Windows are immune against certain implementations, but are still
Speaker 1: vulnerable to others. Here's what's going on. The attacker runs
Speaker 1: special software called key reinstallation attacks or cracks k R
Speaker 1: A c k S. The crack will allow the attacker
Speaker 1: to clone the network, fooling certain electronics into connecting with
Speaker 1: the malicious clone rather than the legitimate network. It does
Speaker 1: this by interrupting a process called the four way handshake.
Speaker 1: This is a process through which a device and a
Speaker 1: network verify that they are having legitimate communication with each other.
Speaker 1: The crack technique manipulates and then replays this cryptographic handshake message,
Speaker 1: resetting the devices encryption process and intercepting all communication between
Speaker 1: that device and the network. This is a type of
Speaker 1: attack known as a man in the middle attack. Worse
Speaker 1: than that, the clone network will be able to decrypt
Speaker 1: communications sent through it. Pairing this with some other well
Speaker 1: known hacker software, such as s s L strip allows
Speaker 1: the cloned network to downgrade traffic to the HTTP protocol
Speaker 1: instead of h T t P S. You may have
Speaker 1: been told to keep an eye on the address bar
Speaker 1: of your browser to verify the presence of that little
Speaker 1: lock symbol next to the HTTPS. This tells you that
Speaker 1: you've got a secure connection to that particular web page.
Speaker 1: S s L strip pushes traffic to an HTTP protocol,
Speaker 1: removing that extra level of security. However, this is reflected
Speaker 1: in the address bar, so if you're paying attention, you
Speaker 1: may notice the problem right away. The solution to this
Speaker 1: problem involves updating devices with security patches that remove the vulnerability.
Speaker 1: Changing your networks log in and password information doesn't help
Speaker 1: all by itself, as this attack sidesteps those measures in
Speaker 1: the first place. You have to doll updates to your
Speaker 1: various devices. Those updates take time to develop and roll out,
Speaker 1: and by the time you hear this, there may still
Speaker 1: be some devices you own that lack of patch. It's
Speaker 1: a good idea to be careful about using Wi Fi
Speaker 1: networks in the meantime, particularly in public spaces. Though this
Speaker 1: attack can turn any Wi Fi network into a vulnerability,
Speaker 1: even in your home network. Switching to wired connections would
Speaker 1: also prevent any unintended communication with malicious networks. The flaw
Speaker 1: illustrates how difficult network security can be. First, you need
Speaker 1: a reliable system that isn't easily breached or manipulated, and
Speaker 1: until recently, w p A two seemed to put the bill. Now,
Speaker 1: it's clear that the system had some major flaws, but
Speaker 1: let's assume that the security protocol is top notch and
Speaker 1: has no other known vulnerabilities. There are still plenty of
Speaker 1: opportunities for malicious hackers to get unauthorized access to a system.
Speaker 1: Legitimate users who choose weak login and passwords are a liability.
Speaker 1: Humans are pretty bad remembering complicated passwords, and so it's
Speaker 1: natural for us to get a little lazy and come
Speaker 1: up with passwords that aren't very tricky at all. The
Speaker 1: truly foolish never bothered to change their access points passwords
Speaker 1: from the default, which means an attacker with knowledge of
Speaker 1: the default passwords can get easy access to that network.
Speaker 1: Others will take a minor step forward and use a
Speaker 1: new password but rely on actual simple words. Hacker using
Speaker 1: a brute force attack in which a machine puts forward
Speaker 1: various words at high speeds and an attempt to find
Speaker 1: the password, could gain access to such an account. Strong
Speaker 1: complex passwords are more reliable, particularly if they are longer
Speaker 1: than eight characters, but these are much more difficult to remember,
Speaker 1: particularly if you're practicing good security etiquette and you've created
Speaker 1: a new password for every site or service. You can
Speaker 1: build complex passwords out of collection of common words, and
Speaker 1: that helps, but you still need to remember what those
Speaker 1: passwords are and not rely on the same one for
Speaker 1: two or three for all of your law and information,
Speaker 1: and keep in mind that the weakest point in any
Speaker 1: security system tends to be people. There have been plenty
Speaker 1: of systems that were breached, not through some hacker running
Speaker 1: a slide piece of code to probe for passwords, but
Speaker 1: rather a person just chatting with a company's employee and
Speaker 1: an effort to get more information. The worst thing about
Speaker 1: the w P A two flaws that you could be
Speaker 1: practicing extremely healthy security habits and it doesn't even matter
Speaker 1: because the vulnerability exists in the protocol itself. It just
Speaker 1: doesn't seem fair. Fortunately, with some software updates, companies can
Speaker 1: remove this possibility and you can rest easy. Just another
Speaker 1: reason why it's always important to install those updates. That's
Speaker 1: all for today. To learn more about hacking, security and malware,
Speaker 1: check out tech Stuff. It's my long form podcast that
Speaker 1: publishes on Wednesdays and Fridays and explores all topics in
Speaker 1: the world of technology. I'll see you again soon. Eight