Nearly all Wi-Fi enabled devices, including PCs, Macs, iPhones, Android phones, most routers, and smart home devices, have up to 12 serious security flaws, according to Belgian security researchers update, but most other devices will have to wait for patches

Mathy Vanhoef, who co-discovered the KRACK flaw prevalent in Wi-Fi in 2017, groups these 12 new flaws under the name "FragAttacks" He has put a huge amount of documentation online to describe the flaws, including a website dedicated to FragAttacks, academic research papers, presentation slideshows, two YouTube videos, and software tools to detect vulnerable devices

In brief, FragAttacks, some dating back to the first version of Wi-Fi in 1997, allow nearby devices "within wireless range" to attack Wi-Fi networks, stealing information and sending devices to bad places online

Particularly vulnerable, Van Hoff says, are smart home devices that have difficulty receiving software updates; all Wi-Fi security protocols, including WEP, WPA2, and WPA3, can be breached by at least some of these attacks

"All Wi-Fi products are affected by at least one vulnerability, and most are affected by multiple vulnerabilities," Vanhoef wrote on the FragAttacks website

As far as Vanhoef knows, none of these flaws have been exploited by malicious hackers However, the possibility that some of the more device-specific flaws have already been discovered and exploited cannot be ruled out

Below is a video of Vanhoef using one of these flaws to attack a Mac, forcing the Mac to connect to a rogue Wi-Fi network and sending it to a potentially malicious website

In a security update yesterday (May 11), Microsoft patched Windows 10, Windows 81, and Windows 7 against the three most common FragAttacks flaws Update your Windows devices now

Enterprise networking hardware makers Cisco and Sierra Wireless are planning patches, and rival Juniper Networks has already released several

Among consumer router makers, Netgear has an advisory page and says firmware updates are already available for some of the routers listed on that page The company adds that it is "developing and testing additional firmware fixes and will release them as soon as they become available"

No patches appear to be available yet for Macs, iPhones, iPads, Android devices, or other major brands of home Wi-Fi routers (We checked a recent security advisory) We will update this article as more information becomes available

In the meantime, Vanhoef says, you can protect yourself by making sure you have a strong, unique Wi-Fi network password and only connect to websites that have the HTTPS encryption protocol enabled by default

The latest version of Chrome (and Edge and Brave as well) enforce HTTPS connections whenever possible For other browsers, Vanhoef recommends the HTTPS Everywhere plugin If you are fairly technically savvy, you can manually configure your router's DNS to prevent it from being changed by others

Vanhoef states in his online slideshow that the good news is that "widespread flaws [are] actually relatively tricky to exploit" and easily exploitable flaws are "not really widespread"

The most serious flaws are "programming errors" in certain Wi-Fi devices and software implementations, he states on the FragAttacks website He refuses to reveal the affected products, but suggests that there are many of them

[UPDATE: Devices affected by the flawed software implementation include Samsung Galaxy S3 smartphones, Windows driver software for the Alfa Wi-Fi dongle, and Linux, NetBSD and OpenBSD kernels The company is said to be ]

"The impact of our findings depends on the specific target," Van Hoff wrote For some devices the impact will be minor, while for others it will be disastrous"

Van Hoff has been working with the Wi-Fi Alliance, the Industry Consortium for the Advancement of Security on the Internet, and various vendors for the past nine months to implement fixes for these flaws He has been working on this

He will present his findings at the USENIX Security and Black Hat USA conferences in August, and you can already watch a 12-minute USENIX presentation on YouTube