Does using a VPN protect against KRACK? How does this work? How can it be bypassed?
I use a commercial VPN on my laptop and on Android. Is an OpenVPN connection to your home a good way to protect your devices?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
A (properly configured, secured protocol) VPN connection will not protect you from being "forced" to join the malicious access point, but it will prevent your communications from being eavesdropped on. The same is true for properly configured SSL / TLS.
The attacker in the KRACK attack sets up a malicious access point, which your device connects to as part of the attack (note that your device must have already connected to this device and trust it). Because your VPN tunnel encrypts communications between your device and the tunnel end point, while you may have fallen victim to joining a malicious access point all communications through that tunnel would not be susceptible to MITM attacks.
VPNs can provide protection but the protection provided is often rather fragile.
The problem is that many VPN systems only redirect network traffic when the VPN is connected. If the VPN becomes disconnected then direct traffic flow returns. So if the attacker can disrupt the connection to the VPN they can potentially intercept your traffic.
How it work and How can it be bypassed?
https://www.krackattacks.com/ (official website)
In the text it say:
Our attack is not limited to recovering login credentials (i.e. e-mail addresses and passwords). In general, any data or information that the victim transmits can be decrypted. Additionally, depending on the device being used and the network setup, it is also possible to decrypt data sent towards the victim (e.g. the content of a website). Although websites or apps may use HTTPS as an additional layer of protection, we warn that this extra protection can (still) be bypassed in a worrying number of situations. For example, HTTPS was previously bypassed in non-browser software, in Apple's iOS and OS X, in Android apps, in Android apps again, in banking apps, and even in VPN apps.
And the word VPN in this text has this link: https://arstechnica.com/information-technology/2017/01/majority-of-android-vpns-cant-be-trusted-to-make-users-more-secure/