KRACK Detector: Detect and prevent KRACK attacks
KRACK Detector is a Python script to detect possible KRACK attacks against client devices on your network. The script is meant to be run on the Access Point rather than the client devices. It listens on the Wi-Fi interface and waits for duplicate message 3 of the 4-way handshake. It then disconnects the suspected device, preventing it from sending any further sensitive data to the Access Point.
KRACK (Key Reinstallation Attack) exploits a vulnerability in the standardized WPA2 authentication algorithm state machine. WPA2 is the industry-standard for encrypting and securing our Wi-Fi traffic for the past 14 years and supposedly didn’t fail us (unlike it’s predecessor, WEP, that was proved to be quite easy to decrypt in a matter of seconds). All true up until now. By exploiting the standard re-transmission mechanism of our wireless networks (that basically send again data packets in case they were lost due to bad reception or other interferences), the attacker causes the home-network access-point to resend one of the 4 data packets used for authenticating a device. These 4 packets are used to exchange authentication information (e.g. your wireless home-network password) and initiate an encrypted session between your wireless device and your home-network’s access point. Re-sending packet 3, in this case, causes the authentication algorithm state machine to fall into a special state in which the generated encryption keys are being re-installed and other counters and measurement initiated. This allows the attacker to weaken the encryption and in some cases even downgrade the entire encrypted session to be using an all zero encryption key which is straightforward to decrypt.
KRACK Detector currently supports Linux Access Points with hostapd. It uses Python 2 for compatibility with older operating systems. No external Python packages are required.
Download
git clone https://github.com/securingsam/krackdetector.git
Usage
Run as root and pass the Wi-Fi interface as a single argument. It is important to use the actual Wi-Fi interface and not any bridge interface it connects to.
python krack_detect.py wlan0
If you do not wish to disconnect suspected devices, use the -n flag
python krack_detect.py -n wlan0
Known Issues
Message 3 of the 4-way handshake might be retransmitted even if no attack is performed. In such a case the client device will be disconnected from the Wi-Fi network. Some client devices will take some time to re-authenticate themselves, losing the Wi-Fi connection for a few seconds.
