This Wi-Fi Vulnerability Means You Need to Update Your iPhones, iPads and Macs ASAP

If you haven’t updated your iOS, iPadOS or macOS devices in a while, a recently disclosed Wi-Fi vulnerability is a good excuse to do so now.

The vulnerability was present in Wi-Fi and Bluetooth chips manufactured by Broadcom and Cypress Semiconductor. And as a result of the security flaw, at least a billion devices were vulnerable to an attack that could allow nearby hackers to see sensitive data over the air. And that may be a conservative estimate.

According to ARS Technica, the flaw was first publicly disclosed at an RSA security conference today by security researchers at ESET Research. Dubbed “Kr00k,” the flaw allowed nearby attackers to read what would otherwise be encrypted data sent or received via the internet.

More specifically, the vulnerability caused impacted devices to use an encryption key that consisted of a bunch of zeroes, which made decrypting that data a breeze for attackers.

As the researchers point out, a successful exploit of Kr00k “degrades your security a step towards what you’d have on an open Wi-Fi network.” And as long as an attacker is within range of your Wi-Fi network or signal, they wouldn’t need to know your Wi-Fi password.

In addition to Apple devices like iPhones and MacBooks, security researchers confirmed that the vulnerability also affected Amazon Kindles and Echoes, Google Nexus devices, Samsung Galaxy devices, and wireless access points made by Asus and Huawei.

Researchers note that many more devices other than those are equipped with the same vulnerable Broadcom and Cypress chips.

Before going public, the researchers responsibly disclosed the bug to both Broadcom and Cypress, as well as any other affected parties.

Luckily, Apple patched the flaw back in late October with its iOS 13.2 and macOS 10.15.1 updates. But, of course, there’s a chance that many users haven’t installed the proper patches yet.

Because the bug is so widespread, it might be a good idea to ensure that all of your Wi-Fi-connected devices are running up-to-date software.

The vulnerability was first discovered by ESET Research and most prominently researcher Miloš ?ermák. The team has published a dedicated webpage with a lot more technical details on the bug.