Earlier this week, Mathy Vanhoef of the Imec-DistriNet research group, discovered serious weaknesses and vulnerabilities in WPA2, a protocol which is used to secure all modern Wi-Fi networks.

Vanhoef’s paper noted:

“An attacker within range of a victim can exploit these weaknesses using key reinstallation attacks (KRACKs). Concretely, attackers can use this novel attack technique to read information that was previously assumed to be safely encrypted. This can be abused to steal sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on. The attack works against all modern protected Wi-Fi networks.”

How Does it Affect Devices and are Bitcoin Wallets in Danger?

As Vanhoef explained in his paper, any device from mobile phones to computers using public Wi-Fi connections can be vulnerable to data theft. Many analysts including CNET executive editor Roger Cheng explained that at this point, any device that is connected to a public Wi-Fi connection is vulnerable.

“This is pretty serious. The bad news is pretty much every Wi-Fi enabled device is vulnerable. The good news is that it has to be local. The hacker has to be near the Wi-Fi network. It can’t launch a widespread attack,” said Cheng in an interview with CBS.

Analysts have explained that hackers targeting local Wi-Fi connections in public areas such as airports can breach the local systems of Wi-Fi-enabled devices, and as such, hackers can steal information ranging from passwords to local app data. Furthermore, because Android and Linux devices are more vulnerable to KRACKs than other devices or operating systems, Bitcoin and cryptocurrency wallets installed on Android and Linux devices could easily become vulnerable to local attacks.

Vanhoef’s paper explained that around 50 percent of Android devices are vulnerable to KRACKs and other types of attacks that are capable of extracting sensitive information efficiently.

“Because Android uses wpa_supplicant, Android 6.0 and above also contains this vulnerability. This makes it trivial to intercept and manipulate traffic sent by these Linux and Android devices. Note that currently 50% of Android devices are vulnerable to this exceptionally devastating variant of our attack,” read Vanhoef’s paper.

2 Factor Authentication (2FA) For Bitcoin Wallets, Preferably Apps like Google Authenticator

In order to prevent KRACKs and targeted Wi-Fi attacks from revealing the passwords and pin numbers used for Bitcoin wallets it is important that users enable multiple-layered 2FA for maximum protection. Blockchain, the second largest Bitcoin wallet application behind Coinbase in terms of user base, recommends that users enable both email and Google Authenticator protection along with two passcodes, establishing four layers of security that are extremely difficult to breach.

Generally, Bitcoin wallet developers and experts recommend users avoid 2FA via SMS, because phone vulnerabilities or social engineering can lead to numbers being compromised

Read more