KRACK attack on WPA2

[Johannes_Dennin]

Hello everyone,
I have some questions due to the expected disclosure today on the attack possible on WPA2 SSIDs.

US-CERT has become aware of several key management vulnerabilities in the 4-way handshake of the Wi-Fi Protected Access II (WPA2) security protocol. The impact of exploiting these vulnerabilities includes decryption, packet replay, TCP connection hijacking, HTTP content injection, and others. Note that as protocol-level issues, most or all correct implementations of the standard will be affected. The CERT/CC and the reporting researcher KU Leuven, will be publicly disclosing these vulnerabilities on 16 October 2017.

Link: https://arstechnica.com/information-technology/2017/10/severe-flaw-in-wpa2-protocol-leaves-wi-fi-tra...

- Is Extreme aware of this?
- Are Fixes ready to be released?
- Is a software fix sufficient or does hardware need to be replaced?

Thanks and best regards,

Johannes

[Bin]

Hello Geovane,

Unfortunately, RFS7000 is already end of engineering support. Please contact our local account team to migrate RFS7000 to another platform, such as NX7500 or VX9000.

Best regards,
Bin

[Bin]

How to mitigate KRACK vulnerability when update of WiNG is not possible?
https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-mitigate-KRACK-vulnerability-when-u...

[Bin]

Hi Geovane,

For the question 1:
Opportunistic key caching (OKC) is a non-standard but widely-implemented method for achieving fast roaming. It existed before the creation of 802.11r.

Therefore, fast roaming - OKC does not use the FT handshake and is not affected by the FT handshake vulnerability.

For the question 2:
The configuration will mitigate, but not eliminate, the vulnerability.

Of course, the recommending action that still leaves the network vulnerable is risky.

Best regards,
Bin

[Geovane_Gonçalv]

Hi Bin,

About your last tips:

• disable broadcast key rotation to migrate WING-36013

In my config, key rotation options are disabled . Do you believe it can be dangerous to enable "Fast roaming"?

• disable 802.11r to migrate WING-36014

In my config Fast BSS Transition is disable.

• disable MeshConnx to migrate WING-36016

We don't have mesh configured.

Does this mean that we are immune from WPA2 vulnerability exploit, even though we do not have the fix firmware installed?

Thanks,

Geovane

[Pierre_LAURENT]

Confirm what Karol says the only thing that drive as a dead end is using AP300 combined with AP75xx , the Firmware should be 5.5.x and no more .