nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Severe flaw in WPA2 - cracked

unknown

when can we expect to see update for this https://arstechnica.com/information-technology/2017/10/severe-flaw-in-wpa2-protocol-leaves-wi-fi-traffic-open-to-eavesdropping/

Find more posts tagged with

Accepted answers

All comments

unknown

"One researcher told Ars that Aruba and Ubiquiti, ..., already have updates available to patch or mitigate the vulnerabilities."

Well, let's see how fast our support-contract money work..

unknown

Some vendors like mikrotik have already rolled out patched versions since weeks:

https://forum.mikrotik.com/viewtopic.php?f=21&t=126695

unknown

I too would like an answer to this. And for our patch to be made available quickly. We already have clients asking.

unknown

Me too for my R600 Unleashed ...

unknown

Yes, this breach is annoying.

But .. have been evangelizing for years that wifi should only be used as transport for VPN (OpenVPN).

Have been trying to find more information like press releases or other material on topics like Ruckus and WPA2 krack. (https://www.krackattacks.com/)

Notice that this all has been released earlier to manufacturers and only now will go public, meaning that only some manufacturers have reacted to research papers: https://eprint.iacr.org/2016/475.pdf
Dated May-17 2016 .. it was all there.

unknown

Ruckus, you're late to the party as usual. When will we see firmware updates to address KRACK?

unknown

I would dearly love to see this ASAP as we need to start change management procedures.

unknown

I've raised a P2 Case (ID: 00565627).

According to the security section of the Ruckus site (https://www.ruckuswireless.com/security) the CVE's covered by Krack have not been addressed.

Kind Regards,

Andy.

unknown

This is big, ruckus had better act quickly on this. I also expect them to release patches for some of the older chains of firmware. We have perfectly usable 802.11n access points (7363) in use that are locked to the 9.12.x chain. It would pretty much mean the end of our relationship with ruckus if we were forced to upgrade these for a security patch.

unknown

Aruba has released fixes for older versions of firmware but only ones the deem 'under support'. Ruckus doesn't view firmware in the same way but based on the fact that the recommended 9.13.3.0.121 i would expect them to be going back a little way on the firmware list at least to 9.12

unknown

Yep, end of support for the ZoneDirector 1100 for example is June 30th 2020, and it is stuck on ZD1100 9.10.2.0.29 (MR2 Refresh) Software Release
I would expect an update for this from Ruckus very soon.

mloiterman

My understand is that this issue was something vendors were previously notified about. So, the fact that there doesn't even appear to be a proposed timeline for a fix is not acceptable - especially since some vendors are already releasing patches.

Very frustrating.

unknown

Aruba reports that they were informed by the author of the research paper in July & by CERT in August. Imagine same for all vendors. Plus many (if not all) have been participating in industry level discussions

unknown

Pretty annoying issue and surely not the best time to get it public, but I don't get why this issue is still persistent since it was reported to the vendors in August/Septembre. Actually there's one customer after another calling and asking what they can do and when they can expect a solution. Not cool, to have no answer ready...

unknown

Dont forget though that the infrastructure is only part of this issue. Even after controllers & AP's have had a 'fix' applied there are still vulnerabilities from the client side, which is actually the source of the issue, can only be addressed by the client manufacturers. As i understand it, It affects infrastructure vendors because sometimes their AP's act as a client like when using mesh for example.

Here's a link to their FAQ on the issue: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-007_FAQ_Rev-1.pdf

unknown

And here's Meraki's which is excellent IMO:
https://documentation.meraki.com/zGeneral_Administration/Support/802.11r_Vulnerability_(CVE%3A_2017-...

Deathly silence from Ruckus...

unknown

Agree, they knew about this august 28. Why is a patch not already available.

unknown

From my chat session they plan to take their time... They have a response slated for the second half of today.

unknown

I guess that depends on where you are......In the UK its already the 2nd half of today 🙂

unknown

I should have specified PDT 😛
Not exactly on the ball for a premier wireless vendor nonetheless!

unknown

Exactly. They are one of the last vendors to respond, and not only that, it would appear as though their response won't include links to a fix, unlike every other vendor.

I have budget to replace our Wi-Fi equipment companywide in 2018 and this is the nail in Ruckus' coffin as far as I am concerned.
If the ZD1100 doesn't get a firmware fix today then I'm out.

mloiterman

Here is some additional information:

http://www.revolutionwifi.net/revolut...

unknown

Well, based on Meraki's outstanding document, it only appears to be an issue for access points when using 802.11r Fast-BSS Transition.

unknown

From the white paper:
"Our key reinstallation attack also breaks the PeerKey, group
key, and Fast BSS Transition (FT) handshake. The impact depends
on the handshake being attacked, and the data-confidentiality protocol
in use."

unknown

No its more than that but maybe not effecting Meraki. For example it effects most Vendors who have Mesh functionality.
This Aruba Blogpost gives a good explanation: http://community.arubanetworks.com/t5/Technology-Blog/WPA2-Key-Reinstallation-Attacks/ba-p/310045

mloiterman

I’m sure someone is justifiying a slow response by saying that the client side must also be updated and that Apple and Google have yet to release a fix. To that person I say, provide me with free ongoing support and I will accept that answer.

I selected Ruckus because I wanted premium support when faced with these kinds of issues. I’m not getting that and we all need to pound this thread, email and call until they release a fix. This is not acceptable.

unknown

Still nothing on their security page. Their response to this is a joke.
https://www.ruckuswireless.com/security

unknown

I'm reading it the same way. From the infrastructure side, if you don't use 802.11r you aren't vulnerable/liable? The other parts are all on the client manufacturers?

unknown

Right from the first paragraph:
"Of the ten vulnerabilities, Meraki access points (AP) are only affected by one (CVE: 2017-13082)."

CVE: 2017-13082

802.11r Fast-BSS Transition(FT)

Access Points

unknown

If you want a chuckle then email security@ruckuswireless.com and you'll get an Out of Office reply.
Nice to know that security is handled by a single person and that they chose to go on vacation on the day that this vulnerability was to be disclosed.
Ruckus, and other vendors, have known about this vulnerability since July, and also knew well in advance about the disclosure date.

Hi All,

I will be on PTO from 14-Oct to 23-Oct would have limited accesst to emails / calls. Please expect delays in my responses.

For Security Issues: mail to security@ruckuswireless.com

For any other queries: contact Keshava.Murthy@brocade.com

Regards,

Hemant Bhatnagar

unknown

The agent I spoke to had no idea there was an issue, nor any idea if there would even be a response. I had him create a ticket at priority 2 and I am waiting on an engineer to call me back.

This is rather frustrating.

unknown

I opened a case and called our Rep and was told there will be a patch by the end of the day.

unknown

Chatted with a rep who said there will be a "response" by the end of the day.

I, too, don't understand how you can have 2.5 months to come up with something and "wait til the end of the day" is what they came up with.

You KNOW there is a MAJOR issue. You KNOW your customers and competitors will be looking at your response. You know exactly WHEN the announcement will be made. And yet, you have NOTHING available.

"At Ruckus Support, we value Security above all else. The WPA2 vulnerabilities were just released to the public, but Ruckus engineers have had this information for much longer and have been working tirelessly to address, correct, and test patches for all of our systems. We will have these available very soon. Thank you for your patience, we want to make sure we get this one right."

There, took me 2 minutes.

unknown

I'll bet they copy and paste that for email replies......

supmang

You're hired!

unknown

Dear
Please help with a firmware update for the ZF7363 and ZF7321 models for this new vulnerability found in WPA-2. Is there any way to contact them or all those who are registered will we get an email automatically when they have the update to know that is already available?

unknown

While I agree Ruckus you have had an plenty of notice to address this, Ruckus support - PLEASE do not rush something out the door just to stem the flow of these complaints. I've been VERY happy with Ruckus code the last few years. I want code that has been thoroughly tested and is ready for production. From the few articles I've read today it seems like this is more of a knee jerk reaction as this has only been proven in a lab, but proven none the less and security is not soemthing to take lightly but lets remember CIA, in this instance I also want good code for availalbity purposes. My business runs on reliable wifi.

unknown

Agreed. Especially since this has been a known issue for the manufacturers for a while now. Certainly they should have been quicker at patching the flaw.

unknown

Maybe thats why the Ruckus website is absent of any mentioning the security flaw - probably not posting anything until they have a fix. Pretty damn late to the party if you ask me.

Maybe switching our campus wifi infrastructure to Ruckus was a BAD idea last year. Fortunately I only started with a few buildings. If they don't put out a patch ASAP, it's good riddance Ruckus and Hello Aruba or someone else.

charles_sprick1

Ruckus makes some great gear, but good god do they suck at communicating with their customers - both issues like this and general transparency.

unknown

Open-Mesh announced a firmware upgrade by the end of today (10/17/2017) and there is no support contract involved. A free lifetime cloud controller license comes with each hardware purchase.

Our Meraki devices received their firmware upgrade within hours of reading about the security vulnerability.

unknown

Just for kicks and grins, I found his LinkedIn... anyone want to pester him on Vaca? https://www.linkedin.com/in/bhatnagarhemant

charles_sprick1

I had no idea that Ruckus offshored their development. That explains SO MUCH. Cheap bastards. In all my experience with offshore development, there's good tech talent, but they lack a certain amount of imagination. I don't know if that's the result of an education that values STEM above all else or if it's cultural or what, but I can really see the attitudes I've encountered with Indian devs ("well what user would do that? that makes no sense, don't worry!") being terrible with security ("who would send THAT packet? That's crazy! we're following the spec, go away!").

michael_brado

UltraTraveller keep it Professional.. Charles, we have development centers around the world. Most DevEng are here in Sunnyvale.

unknown

Too bad they didn't tell by the end of which day..