Some may remember the great problem that apple had with this vulnerability called KRACK, which was published in 2017, which was a serious vulnerability that affected the confidentiality and integrity of the WPA2 standard, which protects most modern WiFi networks. This WPA2 vulnerability affected millions of routers, mobile devices, computers, and other devices, including Macs, iPhones, and iPads.
This attack was achieved by exploiting this vulnerability in the WPA2 protocol and thanks to this, other types of attacks could be carried out at that moment such as: SSL Strip or SSL Strip 2. With certain network configurations, attackers could also inject data into the network, modify certain packages, even being able to insert malware. Because these vulnerabilities affected all devices using WPA2, it was an issue that manufacturers had to quickly address.
Many vendors had patched KRACK on their respective products prior to the October 16 public disclosure. And indeed, researcher Mathy Vanhoef from Belgium found and disclosed privately to numerous organizations starting in July helping to coordinate disclosure.
Something that was a relief (at some point) was that KRACK could not be exploited remotely and an attacker had to be within range of the Wi-Fi network, this somewhat mitigated the severity of the problem. Additionally, VPN and TLS connections add layers of encryption to communication from home and business networks to the Internet. But unsurprisingly companies were more in the line of fire when it came to the KRACK bug.
The vulnerabilities that were used by this threat were:
▸CVE-2017-13077: Peer-to-peer encryption key (PTK-TK) reinstallation on 4-way handshake.
▸CVE-2017-13078: Reinstall Group Key (GTK) on 4-way handshake.
▸CVE-2017-13079: Reinstallation of the Integrity Group Key (IGTK) on the 4-way handshake.
▸CVE-2017-13080: Reinstallation of the group key (GTK) in the group key handshake.
▸CVE-2017-13081: Reinstallation of the integrity group key (IGTK) in the group key handshake.
▸CVE-2017-13082: Accept a retransmitted BSS Fast Transition (FT) Reassociation Request and reinstall the Peer Encryption Key (PTK-TK) while processing it.
▸CVE-2017-13084: Reinstallation of the STK key in the PeerKey handshake.
▸CVE-2017-13086: Reinstallation of Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) in TDLS handshake.
▸CVE-2017-13087: Reinstallation of group key (GTK) when processing a response frame in wireless network management (WNM) sleep mode.
▸CVE-2017-13088: Reinstallation of the integrity group key (IGTK) when processing a response frame in wireless network management (WNM) sleep mode.
Related reads:
XcodeSpy new malicious project against MacOS
Silver Sparrow, A malware that affected macOS
