It has been 14 years since the WPA 2 security protocol was introduced for Wi-Fi devices across the world, and today our reliance on the wireless Internet is greater than ever before. From smart home appliances to airplane cabins and car seats, it is integrated into almost every facet of our lives. With about 9 billion Wi-Fi devices in use, protecting these systems from hackers is a constant concern for cybersecurity experts.
Over the years, hackers have exploited several weaknesses in WPA2 to gain access to secured networks. Most recently, researchers in Belgium identified a major flaw in the protocol’s encryption processes that allowed outside parties to read, intercept and even manipulate data passed between routers and connected devices. The vulnerability occurs during the four-way handshake, when user credentials are matched against the Wi-Fi network to determine whether to grant access. Once a password is verified, it generates a new cryptographic key to facilitate a secured connection between the user and the network. This key reinstallation attack (KRACK) allows hackers to regenerate previously used keys. With the right key, hackers can replay past sessions to decrypt the data packets related users sent and received. KRACK can be used to monitor and steal information from almost any connected device.
Apart from KRACK, WPA2 has also shown vulnerabilities to hardware-level attacks and brute force password cracking. As these issues become more common, the Wi-Fi Alliance (a conglomeration of leading tech companies) has moved to finalize a new, updated security protocol for Wi-Fi devices called WPA3.
What Makes WPA3 Different
In June 2018, the Wi-Fi Alliance released the full details of its planned WPA3 rollout. The announcement shows that the new security protocol will offer major advantages over WPA2.
Stronger Password Protection
WPA3 will include far more robust password security features that protect even the simplest passwords from being cracked. This protocol uses a simultaneous authentication method (SAE) which prevents hackers from attempting to guess your credentials through dictionary attacks, in which they try several combinations of words and characters to gain access to your network. WPA3 will only allow hackers to make one attempt at a network password before it renders their access point useless. A new attempt will require personal interaction with the Wi-Fi device itself.
SAE will also ensure that previously transmitted data packets remain encrypted even if the related password has been compromised. It should be noted that these benefits will only be available for users that have a WPA3-protected device and router.
Individual Device Encryption
WPA3 goes some way to assuage the various security issues present on open Wi-Fi networks. The security protocol offers individual data encryption for each device, even on public Wi-Fi networks. This feature will be available for any updated device, regardless of whether it connected to a WPA3 or WPA2 network.
WPA2 was designed with mobile phones and computers in mind, so it can be difficult to connect smart home appliances to traditional Wi-Fi networks. Without a screen to manage connectivity, it forces users to enter router details through smartphone apps to secure Internet access. The WPA3 protocol introduces a new feature called Easy Connect which allows you to scan a QR Code on your router to bring the related device onto the same network. While Easy Connect will need to be integrated with existing device apps, the feature promises to simplify the configuration process for many IoT devices.
WPA3 also offers additional protections for networks used to transmit sensitive information. WPA3-Enterprise is an optional mode that offers a range of specialist cryptographic tools built on Commercial Network Security Algorithms (CNSA). These tools are certified for high-level government work, security operations and financial organizations.
When Will WPA3 Be Available?
The sheer scale of the WPA3 rollout means it will take time before the protocol is widely available. Although major tech manufacturers such as Cisco and Qualcomm have already begun planning new products around the WPA3 protocol, users shouldn’t expect to see widespread adoption until at least late 2019. Remember, in most cases a WPA3 device will only be more secure if it connects to a router that features the same capabilities. You will probably need to wait even longer before you can reap the full benefits of your updated security.
Contact us for a security audit of your systems and network. We provide a full range of software and hardware support services that can help guarantee the safety, security and uninterrupted function of your IT systems.