Mathy VanHoef, a researcher with the imec-DistriNet Research Group at University of Leuven, Belgium has released a paper titled Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2 which details a major vulnerability in the WPA2 wireless security protocol. Per VanHoef’s release notes:

[A]ttackers can use this novel attack technique to read information that was previously assumed to be safely encrypted. This can be abused to steal sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on… [And] Depending on the network configuration, it is also possible to inject and manipulate data. For example, an attacker might be able to inject ransomware or other malware into websites.

Van Hoef goes on to point out that, as the vulnerability affects the protocol, rather than any specific implementation, the attack will work against “all modern protected Wi-Fi networks”. Of particular concern are Android cellphones, and any device based upon the Linux operating system with wireless capabilities. This means not only wireless routers, gateways, and access points, but any device that uses wireless technology in any manner.

Due to the far reaching nature of this vulnerability, and the potential for widespread catastrophic impact, Just-Tech strongly urges that everyone contact their equipment vendors to check for updates. Again, it’s not just the devices that provide wirless network connectivity that are affected, but any device that can access those networks as well, including mobile phones and tablets.

You can read more about the technical aspects of the attack here:

Key Reinstallation Attacks: Breaking WPA2 by forcing nonce reuse