Noted security expert Mathy Vanhoef recently discovered a Wi-Fi security vulnerability, that if exploited, it would allow an attacker within radio range to steal user information or attack devices.

The security vulnerability, known as FragAttacks - fragmentation and aggregation attacks - are design flaws in the Wi-Fi standard and therefore affects most devices. In addition, Vanhoef discovered several other vulnerabilities that are caused by widespread programming mistakes in Wi-Fi products. 

According to Vanhoef, the discovered vulnerabilities affect all modern security protocols of Wi-Fi, including the latest WPA3 specification. Even the original security protocol of Wi-Fi, called WEP, is affected, the security expert says, meaning that several of the newly discovered design flaws have been part of Wi-Fi since its release in 1997. 

"Fortunately, the design flaws are hard to abuse because doing so requires user interaction or is only possible when using uncommon network settings. As a result, in practice the biggest concern are the programming mistakes in Wi-Fi products since several of them are trivial to exploit," the security experts writes.

Yaniv Bar-Dayan, CEO and co-founder at Vulcan Cyber, a vulnerability remediation orchestration provider, explains, "Frag attacks against WiFi devices are concerning because they stem from widespread usage of the WiFi standard that can be exploited to steal user data or attack devices. This is a serious vulnerability; however, it takes a perfect storm of physical access (attackers must be in radio range),  misconfigured network settings, and direct interaction with a user for exploitation. This has the potential to seriously disrupt a large swatch of users, however, it’s unlikely that the exploitation of these vulnerabilities will be successful in the wild."

Bar-Dayan adds, "That doesn't mean that these vulnerabilities can be ignored. This latest discovery should be a reminder that cyber hygiene best practices are critically important. End users and administrators alike need to be coordinated in their efforts to regularly patch connected devices, which include routers, IoT devices and smartphones. While vendors of these devices work to bring patches to market, be sure to rely on tried-and-true WiFi security best practices in the meantime. Make sure your router is encrypting data, use a sophisticated and unique password or multi-factor authentication, don't broadcast your network ID, double check configurations are secure, and, above all else, patch early and often."

For the full blog and more information about the vulnerabilities, please visit https://www.fragattacks.com/