Whenever someone joins a Wi-Fi network, it executes this 4-way handshake to produce a fresh encryption key for all subsequent traffic. To guarantee security, a key should be installed and used only once.
But in a key reinstallation attack (KRACK), attackers trick a victim into reinstalling an already-in-use key. As a result, they can steal sensitive information or, depending on the network configuration, inject malware into a website.
All modern protected Wi-Fi networks currently use the 4-way handshake. This means that all these networks are vulnerable, and that any device that uses Wi-Fi is most likely vulnerable.
Does that mean we should all change our Wi-Fi passwords? Vanhoef: “Changing the password of your Wi-Fi network does not prevent attacks. Instead, users have to update all their devices as soon as security updates becomes available.”