KRACK attack on WPA2

[Johannes_Dennin]

Hello everyone,
I have some questions due to the expected disclosure today on the attack possible on WPA2 SSIDs.

US-CERT has become aware of several key management vulnerabilities in the 4-way handshake of the Wi-Fi Protected Access II (WPA2) security protocol. The impact of exploiting these vulnerabilities includes decryption, packet replay, TCP connection hijacking, HTTP content injection, and others. Note that as protocol-level issues, most or all correct implementations of the standard will be affected. The CERT/CC and the reporting researcher KU Leuven, will be publicly disclosing these vulnerabilities on 16 October 2017.

Link: https://arstechnica.com/information-technology/2017/10/severe-flaw-in-wpa2-protocol-leaves-wi-fi-tra...

- Is Extreme aware of this?
- Are Fixes ready to be released?
- Is a software fix sufficient or does hardware need to be replaced?

Thanks and best regards,

Johannes

[Johannes_Dennin]

I was just asking because other vendors apparently have updates available / in beta. But I guess we'll see soon what all the fuss is about!

[Ronald_Dvorak]

Hi Johannes,

Extreme is fast but not that fast, from what I'd read in the web the guys that found the vulnerability will release more information how it works in 5 hours.

I'm very confident that Extreme will implement a fix.

Cheers,
Ron

[Ronald_Dvorak]

Please take a look into the Vulnerability Notice.....

https://extremeportal.force.com/ExtrArticleDetail?n=000018005

[Karol_Radosovsk]

I suppose, engineering team would be releasing patches not only to latest WING firmware (5.9.1) but also to previous series (i.e. 5.8.4) as we have some VX-based installations with multiple types of APs in place (622,650,75xx). Thanks for confirmation.

[Drew_C]

Extreme Networks was notified by the CERT regarding the KRACK vulnerability, which was subsequently communicated to the Engineering team. The team is working on a solution to be completed by end of this week (10/20). We are reviewing procedures to confirm vulnerability response urgency meets expectations. Thanks for your patience.