KRACK Attack Broke WPA2 Wi-Fi Security by Exploiting Key Reinstallation Flaw

In October 2017, security researcher Mathy Vanhoef revealed KRACK, a vulnerability that compromised WPA2, the encryption standard securing Wi-Fi networks worldwide since 2004. Rather than cracking passwords, the attack exploited the WPA2 four-way handshake by forcing client devices to reinstall an already-used session key, which reset the nonce counter to a previously used value. This nonce reuse broke the encryption's core guarantee, allowing attackers to recover plaintext and, in some cases, forge or replay packets. The flaw existed in the WPA2 standard itself, meaning every correctly implemented device was affected. The impact was especially severe on Android 6.0 and later devices using the wpa_supplicant software, which reinstalled an all-zero key, enabling attackers within Wi-Fi range to fully decrypt network traffic.