科学美国人60秒 让你的Wi-Fi远离KRACK

It seems every week we find out that someone broke into a big company’s databases—like the recent Equifax data breach—and made off with millions of credit card numbers, passwords and other valuable info. And now a new kind of worry: someone could hijack¹ your wireless² home network and steal your info from under your nose.

似乎每周我们都会发现，有人入侵了某家大型公司的数据库——例如最近的Equifax(是一家美国知名的征信机构)数据泄露事件——导致数百万个信用卡号、密码和其他珍贵的信息被泄露。现在有这样一种新的忧患：有人会入侵你家的无线网络，就从眼皮子底下盗取你的信息。

That’s the possibility raised by a couple of cybersecurity researchers from the Catholic University of Leuven in Belgium. The problem, they say, is a flaw in the very protocol³ meant to make wi-fi secure. That protocol is called Wi-Fi Protected Access II, WPA2. And WPA2’s weakness could allow an attacker within physical range of your wi-fi network to make a copy of that network that they could then control. The researchers call their approach a key reinstallation attack, or KRACK.

比利时鲁汶大学的数位网络安全研究人员提出了这种可能性。他们表示，加密协议的漏洞是是让网络安全。这种加密协议成为WPA2. WPA2的缺陷是攻击者可以在你的Wi-fi覆盖范围内制作一个他们可以控制的网络副本。研究人员将这种方法称为KRACK。

It’s important to know that a KRACK attack remains⁴ a hypothetical for now. The scientists realized the threat while investigating wireless security. They’ll present this research on November 1st at the Computer and Communications Security (CCS) conference in Dallas and in December at the Black Hat Europe conference in London.

重要的是，需要知道KRACK攻击现在还只是一个假设。科学家们在调查无线网络安全时，意识到这种威胁。研究人员会将研究结果在11月1日在达拉斯举行的计算机与通信安全会议以及12月份在伦敦召开的欧洲黑帽会议上公布研究结果。

In their KRACK scenario⁵, wireless devices would be fooled into connecting to the bogus network. And the attacker would be able to access all of the info that devices send and receive while connected to that network—even if that info has been encrypted. Android and Linux would be especially vulnerable because of how their encryption keys are configured.

在研究人员虚拟的KRACK场景中，无线设备将会被误导去连接虚拟网络。这时，攻击者可以获取连接该网络设备收发的所有信息——即使这些信息已经被加密。因为安卓和Linux的加密方法，这两种系统特别的脆弱。

One measure of protection against such an attack would be to make sure they you’ve installed the most up-to-date versions of your apps, browsers⁶ and wireless router software. Updated software is most likely to include the security patches needed to avoid falling victim to a KRACK attack. Because chances are that KRACK won’t remain simply a proof-of-concept for long.

防止这种攻击的一种方法是确保你已经安装了最新版本的应用程序、浏览器和无线路由器软件。更新后的软件很可能包含避免KRACK攻击的安全补丁。因为KRACK攻击不会只以一个概念的形式存在太久的~

1 hijack   

v.劫持，劫机，拦路抢劫

参考例句：

• Most countries refuse to give sanctuary to people who hijack aeroplanes.大多数国家拒绝对劫机者提供庇护。
• The hijack take place just after the plane take off.劫持是飞机刚起飞后发生的。

2 wireless   

adj.无线的；n.无线电

参考例句：

• There are a lot of wireless links in a radio.收音机里有许多无线电线路。
• Wireless messages tell us that the ship was sinking.无线电报告知我们那艘船正在下沉。

3 protocol   

n.议定书，草约，会谈记录，外交礼节

参考例句：

• We must observe the correct protocol.我们必须遵守应有的礼仪。
• The statesmen signed a protocol.那些政治家签了议定书。

4 remains   

n.剩余物，残留物；遗体，遗迹

参考例句：

• He ate the remains of food hungrily.他狼吞虎咽地吃剩余的食物。
• The remains of the meal were fed to the dog.残羹剩饭喂狗了。

5 scenario   

n.剧本，脚本；概要

参考例句：

• But the birth scenario is not completely accurate.然而分娩脚本并非完全准确的。
• This is a totally different scenario.这是完全不同的剧本。

6 browsers   

浏览器

参考例句：

• Three-layer architecture is a model made up of browser, web server and background database server. 这种体系结构是由Browser、Web Server、Database Server组成的浏览器／Web服务器／后台数据库服务器三层模型。 来自互联网
• Another excellent approach is to abandon the browser entirely and, instead, create a non-browser-based, Internet-enabled application. 另一个非常好的方法是干脆放弃浏览器，取而代之，创建一个不基于浏览器，但却是基于互联网的应用。 来自About Face 3交互设计精髓