Updated October 2026: This post has been expanded from its original November 2017 version with a full explanation of the KRACK attack, a timeline of the fixes, and practical steps that still apply today. It is a historical account of a 2017 security event.
In November 2017, Google released a security update for Android that closed one of the most widely discussed Wi-Fi vulnerabilities in years. The flaw, called KRACK, short for Key Reinstallation Attacks, affected the WPA2 protocol that protected nearly every password-secured Wi-Fi network in the world. Phones, laptops, routers, smart TVs, and countless connected gadgets all relied on it.
Android devices running version 6.0 or later were hit especially hard. On those phones, a successful attack did not just weaken encryption. It removed it. This post explains what KRACK was, why Android was singled out, how the industry responded, and what lessons from 2017 still matter for keeping your devices safe.
What WPA2 does, in plain terms
When you connect to a password-protected Wi-Fi network, your device and the router need to agree on an encryption key before any data flows. They do this through a short exchange of four messages called the 4-way handshake. The handshake confirms that both sides know the Wi-Fi password and produces a fresh session key used to encrypt everything that follows.
WPA2 had been the standard for securing Wi-Fi since 2004. By 2017, the 4-way handshake had been in use for more than a decade and had even been mathematically analyzed and considered secure. That is part of why KRACK was such a surprise: the weakness was not in a single company's code, but in how the protocol itself was specified.
How KRACK worked
KRACK was discovered by security researcher Mathy Vanhoef, working with Frank Piessens at KU Leuven in Belgium. They described it in a paper titled Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2 and disclosed it publicly on October 16, 2017.
The attack targets the third message of the handshake. Wi-Fi is unreliable by nature, so the protocol allows the router to resend message 3 if it does not receive an acknowledgment. When a device receives message 3 again, it reinstalls the session key it already has.
Reinstalling the key sounds harmless, but it has a side effect. Encryption in WPA2 depends on a counter, called a nonce, that should never repeat for the same key. Reinstalling the key resets that counter to zero. An attacker within Wi-Fi range who blocks and replays message 3 can force the counter to reset again and again. Once nonces repeat, the encryption can be broken, because the same keystream gets reused for different packets.
The researchers showed that the same idea applied to several related handshakes in the Wi-Fi standard, including the group key handshake and the Fast BSS Transition handshake used when devices move between access points. Ten separate CVE identifiers, CVE-2017-13077 through CVE-2017-13088, were assigned to the different variants.
What an attacker could actually do
The impact depended on which encryption cipher the network used:
- AES-CCMP, the most common WPA2 cipher, allowed an attacker to replay and decrypt packets but not forge new ones. That was still enough to read some traffic and, in some cases, hijack TCP connections.
- WPA-TKIP and GCMP were worse. An attacker could replay, decrypt, and forge packets, which meant injecting malicious content into a connection.
Two limits are important. First, the attacker had to be physically close enough to be within Wi-Fi range of the victim. Second, KRACK broke the Wi-Fi layer of encryption, not every layer. Traffic that was separately encrypted, such as websites loaded over HTTPS or connections through a VPN, stayed protected by that additional encryption. Unencrypted traffic, such as plain HTTP sites and some DNS lookups, was the most exposed.
What an attack would have looked like
It helps to picture KRACK in a realistic setting. Imagine a busy coffee shop in late 2017 with a WPA2-protected guest network. An attacker sits at a corner table with a laptop and a pair of inexpensive Wi-Fi adapters.
The attacker sets up a fake copy of the coffee shop's network on a different Wi-Fi channel, a technique researchers call a channel-based man-in-the-middle position. When a customer's phone connects, the attacker's equipment sits between the phone and the real router, passing traffic along while selectively blocking and replaying handshake messages. The customer sees nothing unusual: the network name is right, the password works, and pages load.
If the customer's phone ran an unpatched version of Android 6.0 or later, the replayed message would trigger the all-zero key, and the attacker could read everything not protected by a second layer of encryption. In Vanhoef's own demonstration video, he used this setup against an Android phone to capture login details from a website that was not properly enforcing HTTPS.
The same attack against a fully patched laptop on a site using HTTPS would have yielded little useful data. That contrast is the whole story of KRACK's real-world risk: it was serious for unpatched devices and unencrypted traffic, and largely manageable for everyone else.
Why Android 6.0 and later were hit hardest
Most devices were vulnerable to some version of KRACK, but one implementation made the attack far more severe. Android, starting with version 6.0, used a Wi-Fi component called wpa_supplicant. Versions 2.4 and 2.5 of that software cleared the encryption key from memory after installing it, which is normally a good security practice.
The problem appeared when message 3 was replayed. The device reinstalled the key from memory, but the memory had already been wiped. So the phone installed an all-zero encryption key. From that point on, traffic was effectively encrypted with a key the attacker already knew, which made it trivial to read and manipulate.
The researchers estimated that about 41 percent of all Android devices were vulnerable to this especially damaging variant. Since it affected Android 6.0 and later, some analysts put the effective share closer to half of active Android devices at the time. Linux systems using the same wpa_supplicant versions had the same issue.
iPhones, Macs, and Windows PCs were affected by KRACK as well, but not by the all-zero key problem, so the practical risk on those platforms was lower.
The disclosure and patch timeline
KRACK followed a coordinated disclosure process, in which vendors are warned privately so they can prepare fixes before the public announcement. The process was not perfectly smooth.
- July 2017
Researchers privately notify the first vendors, including OpenBSD - August 2017
CERT/CC sends a broad notification to affected vendors - October 10, 2017
Microsoft ships its fix in Patch Tuesday, ahead of disclosure - October 16, 2017
KRACK is disclosed publicly; Linux distributions push wpa_supplicant updates - November 2017
Google's November security update fixes KRACK on supported Android devices (patch level 2017-11-06) - 2018 onward
WPA3 certification launches; older unpatched gadgets stay exposed
- July 2017: The researchers notified the first vendors whose products they had tested, including the OpenBSD project.
- August 2017: CERT/CC, which coordinates vulnerability disclosures, sent a broad notification to affected vendors.
- Before public disclosure: OpenBSD objected to the length of the embargo and was allowed to ship a quiet fix early. Vanhoef later said that was a mistake, because a published patch can tip off others to the underlying bug.
- October 10, 2017: Microsoft included a fix in its monthly Patch Tuesday update, days before the announcement.
- October 16, 2017: KRACK was announced publicly. Major Linux distributions such as Debian and Ubuntu released updated wpa_supplicant packages the same week.
- Late October 2017: Apple released fixes in its iOS and macOS updates.
- November 2017: Google's November Android security bulletin included the KRACK fixes. Devices that reached the November 6, 2017 security patch level were protected. Google's own Pixel and Nexus phones received the update first.
The Android update problem
Google's fix was the easy part. Getting it onto phones was harder. Android updates at the time had to pass through phone manufacturers and, often, wireless carriers before reaching users. Many popular phones received the November patch weeks or months later. Many older phones, especially budget models that were no longer supported, never received it at all.
KRACK became one of the clearest public examples of a problem security researchers had warned about for years: a vulnerability is only fixed when the patch actually reaches the device. In the years that followed, Google pushed more security components into updates it could deliver directly, and phone makers began committing to longer, predictable update schedules.
Routers and smart devices: the long tail
KRACK mainly targeted Wi-Fi clients, the devices that connect to a network, rather than routers themselves. But routers that act as clients, such as Wi-Fi repeaters and mesh extenders, and routers supporting Fast BSS Transition were also affected. Some router makers shipped firmware updates quickly. Others took months.
The bigger worry was the enormous number of connected gadgets that rarely, if ever, get updates: security cameras, smart plugs, printers, and other Internet of Things devices. Many of these were never patched. Vanhoef's advice at the time was simple and still applies: update every device you can, including the router's firmware. Changing your Wi-Fi password, on the other hand, did nothing to stop KRACK, because the attack did not rely on knowing the password.
What came after KRACK
KRACK changed how the industry thought about Wi-Fi security:
- WPA3 arrived. In 2018, the Wi-Fi Alliance introduced WPA3, a new security standard with a stronger handshake. Certification of WPA3 devices began that year, and it has since become standard on new routers and phones.
- The research continued. Vanhoef and colleagues kept examining Wi-Fi security. In 2018 they published improved key reinstallation techniques. In 2019, the "Dragonblood" research found weaknesses in early WPA3 implementations, which were fixed in updates. In 2021, the "FragAttacks" research revealed design and implementation flaws in how Wi-Fi handles fragmented data, some of which dated back to the original Wi-Fi standard.
- HTTPS became the norm. Encrypting web traffic by default spread rapidly in the years around KRACK. Today, the vast majority of web pages load over HTTPS, which limits what a Wi-Fi-level attack can reveal.
Lessons that still apply
KRACK is mostly history now, but the steps that protected people in 2017 are the same ones that protect against today's Wi-Fi flaws.
1. Check your phone's security patch level
On Android, open Settings, go to About phone (or Software information on some models), and look for Android security update or Security patch level. The date shown tells you how current your protections are. If it is more than a few months old, check for system updates. If your phone no longer receives updates at all, it is worth considering a replacement for anything security-sensitive, such as banking.
2. Update your router
Log into your router's admin page or app and check for firmware updates. Many newer routers update automatically, but older models often require you to do it manually. If your router no longer receives updates from its manufacturer, replacing it is one of the most effective security upgrades you can make.
3. Use WPA3 if your devices support it
If your router supports WPA3, turn it on. Many routers offer a "WPA2/WPA3 mixed" mode that keeps older devices working while giving newer ones stronger protection.
4. Rely on encryption beyond Wi-Fi
Prefer apps and websites that use HTTPS, which is nearly all of them now. On public or untrusted Wi-Fi, a reputable VPN adds another layer of encryption between your device and the internet.
5. Don't forget smart home devices
Check the companion apps for cameras, doorbells, plugs, and other connected devices for firmware updates. If a manufacturer has stopped supporting a device, consider putting it on a separate guest network so a compromise cannot easily reach your phones and computers.
The bottom line
KRACK showed that even a well-studied, decade-old security protocol can contain a fundamental flaw. It also showed that a fix is only as good as its delivery. Google's November 2017 patch closed the hole on Android, but millions of devices stayed exposed because updates never reached them. The most durable lesson is the simplest one: keep your devices updated, and retire the ones that no longer get updates.
Sources
- Mathy Vanhoef and Frank Piessens, Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2, and the researchers' disclosure site krackattacks.com.
- Android Security Bulletin, November 2017.
- Bruce Schneier, "New KRACK Attack Against Wi-Fi Encryption" and LWN.net coverage.
- Android Authority on the share of affected Android devices.
Top image: "TP-Link WR841ND WiFi router" by Florian838, CC BY 4.0, via Wikimedia Commons (resized, background added). Charts by Thank You Robot.
0 Comments