Responding to KRACK: Wi-Fi Security Awareness in Private Households

Abstract

In this paper, we study the update and security practices of individuals in private households with an exploratory interview study. In particular, we investigate participants' awareness regarding KRACK, a patched key vulnerability in the WPA/WPA2 protocol, and similar vulnerabilities in the context of usage and management scenarios in Wi-Fi networks. We show that while most people are aware of certain dangers, they struggle to address Wi-Fi related vulnerabilities. The findings could prove to be beneficial in identifying not only the current security status of average users regarding Wi-Fi security, but also to improve update and information propagation to mitigate related threats in the future.

A Survey of User Perspectives on Security and Privacy in a Home Networking Environment

“…Zeng et al [199] (interview, 𝑛 = 15), suggested how users' vulnerability depends on the level of their privacy knowledge, and pointed out a clear mismatch between the awareness and power of the owner/administrator of the smart home in comparison to other home users. Freudenreich et al [58] (interview, 𝑛 = 16), studied security practices of home users related to Wi-Fi security and found that, although they were mostly aware of the vulnerabilities, they found it difficult to address these issues.…”

“…This is another popular area of research, with 66 papers. Some papers (32) focused majorly on this RQ and others (34) reflected on security and privacy behaviors while discussing other concepts such as privacy concerns, awareness, multi-users issues and related conceptual frameworks [4,47,58,61,63,68,70,84,98,100,103,105,114,116,118,123,126,130,134,135,141,144,146,150,164,167,173,178,181,183,187,188,195,200,202]. Here, we will focus on the 32 papers in the former group.…”

“…They observed that the participants became familiar with new devices very soon and were generally happy with sharing data as long as it is properly de-identified (e.g., via aggregation) and they were aware of the purpose of collection. Risks associated with Wi-Fi vulnerabilities in home users were explored by Freudenreich et al [58] (survey and interview, 𝑛 = 16), who found that, although generally aware of the privacy risks, people were not knowledgeable or skilled to address such problems.…”

A Signature-Based Wireless Intrusion Detection System Framework for Multi-Channel Man-in-the-Middle Attacks Against Protected Wi-Fi Networks

“…Although patches are available for both KRACK and FragAttacks, the critical problem is that they are not applicable on every Wi-Fi or IoT device because of factors like resource constraints, deprecated security protocols, expired product support periods, etc. Four years after KRACK first appeared, it is estimated that more than 75 per cent of Wi-Fi enabled devices still remain vulnerable to it [10], [11].…”

A Signature-Based Wireless Intrusion Detection System Framework for Multi-Channel Man-in-The-Middle Attacks Against Protected Wi-Fi Networks

“…Although patches are available for both KRACK and FragAttacks, the critical problem is that they are not applicable on every Wi-Fi or IoT device because of factors like resource constraints, deprecated security protocols, expired product support periods, etc. Four years after KRACK's appearance, it is estimated that more than 75 percent of Wi-Fi-enabled devices still remain vulnerable to it [10], [11].…”