While Many Devices Have Already Been Patched, Many More May Never Be…
An article review.
When does exploit news cross the line into being a trend? How about when it impacts essentially every single wi-fi enabled device? That’s the takeaway from the recently announced vulnerability in the WPA2 wireless security standard, detailed in this TechCrunch article submitted by our friend Wes Pollard at Home Bank.
While the technical details of this attack are certainly interesting, we’ve been taken aback by the scope of the news in both the number of devices impacted and just how long we may be experiencing the effects: The attack is not in a specific implementation of wi-fi on a specific device but is instead part of the WPA2 protocol itself, every wi-fi enabled device made since the introduction of that standard can fall, victim.
You can, though, breath a little easier knowing that the providers of major operating systems both desktop and mobile have issued security patches, and replacement of those devices won’t be necessary. The problem lies with the millions of wi-fi devices that either have no ability to be updated at all, or simply won’t be receiving an update–think of your Internet-of-Things devices like thermostats, light bulbs, appliances and so on: if it is connected to your network and hasn’t been updated, it will remain an open door to any interested parties.
The situation reminds us of the original Wi-Fi encryption standard, WEP, which was compromised shortly after introduction. Despite widespread knowledge of WEP’s failures, and the relatively small number of deployed wi-fi devices compared to today, one could find WEP-enabled devices during scans for quite some time–and even today. The sobering truth is that for many people “hardware is forever” and as long as the device is functional it will remain undisturbed and vulnerable.
As we continue down the road of adding wireless functionality to everything it may be time to question whether or not we really need to be able to change the color of our bedroom’s lighting from our smartphone, and whether that convenience comes with costs we haven’t anticipated.
Original article by Natasha Lomas writing for TechCrunch.
