topic Re: WPA2 KRACK Questions & Answers - Resource page in Wireless Questions and Best Practices

WPA2 KRACK Questions & Answers - Resource page

michael_brado — Wed, 18 Oct 2017 23:48:33 GMT

Greetings,

Much concern about possible impact of announced WPA2 KRACK vulnerabilities, and Ruckus would
like to provide information and answer your related questions. Please view the WPA2 KRACK support
resource center page:

https://support.ruckuswireless.com/krack-ruckus-wireless-support-resource-center

There are knowledge base articles that describe Rogue Detection, and details on checking 802.11r
enable/ disable state, link to a TME blog on the problem, and industry links related to WPA2 KRACK flaws.
Information regarding specific platform firmware patch release availability will be provided shortly.

Re: WPA2 KRACK Questions & Answers - Resource page

steven_veron — Thu, 19 Oct 2017 14:40:55 GMT

Is there anything on the 7731 bridge? The only thing listed in the patches is the P300 bridge.
For the 7731
End of Software Development & Maintenance: October 31, 2017

Re: WPA2 KRACK Questions & Answers - Resource page

michael_brado — Thu, 19 Oct 2017 15:00:15 GMT

While mgt determines how to provide a 9.2 version patch, you aren't at much risk since clients who can be compromised aren't likely connecting to your PtP bridges...

Re: WPA2 KRACK Questions & Answers - Resource page

steven_veron — Thu, 19 Oct 2017 15:02:57 GMT

This bridge provides internet to a building that contains our HR department. Anything greater than 0 is considered a risk.

Re: WPA2 KRACK Questions & Answers - Resource page

michael_brado — Thu, 19 Oct 2017 16:31:42 GMT

If the bridge or mesh AP channel is static, the AP is not vulnerable to MITM attack, which is a necessary part of the replay attack. Find your best PtP link channels, and lock them down for 0 risk.

Re: WPA2 KRACK Questions & Answers - Resource page

grodog-prod — Thu, 19 Oct 2017 22:23:35 GMT

We have updated the KRACK - Ruckus Wireless Support Resource Center page with the following additional technical information and documents:

Current schedule for patch release dates for the following products: P300, SmartZone, Ruckus Cloud, Unleashed, Xclaim, and ZoneDirector
KRACK WPA/WPA2 Vulnerability Mitigation "Cheat Sheets" for the following products: Unleashed, vSZ 3.5 (vSZ-E, vSZ-H, SZ-100), vSZ 3.4 (vSZ-H, SCG200, SZ300), and ZoneDirector

Allan.

Re: WPA2 KRACK Questions & Answers - Resource page

monnat_systems — Fri, 20 Oct 2017 06:50:56 GMT

steven...
since ZF7731 does not use mesh and 802.11r... hence this product is not vulnerable..

Re: WPA2 KRACK Questions & Answers - Resource page

steven_veron — Fri, 20 Oct 2017 13:00:18 GMT

I don't believe that is correct. The non-root bridge behaves just as a client would, and an attacker could force a channel change then intercept the new 4-way handshake.

Also, if bridges aren't affected why is the P300 being patched...

Re: WPA2 KRACK Questions & Answers - Resource page

michael_brado — Fri, 20 Oct 2017 16:37:09 GMT

Monnat is correct. P300 algorithm *is* based on Mesh, zf7731 is not, but.. they do behave like a client-AP and uses 4 way handshake. We will need to patch the client side code in 7731 too. Still, lock down your channels and protect physical proximity.

Re: WPA2 KRACK Questions & Answers - Resource page

steven_veron — Fri, 20 Oct 2017 17:52:38 GMT

That's good to know, I appreciate it. You mention locking the channel, I was unable to find a setting within the GUI and the guide doesn't mention it that I have found. Is this a CLI only command? If so can you point me to some documentation on it?

Re: WPA2 KRACK Questions & Answers - Resource page

lawrencebyrd — Fri, 20 Oct 2017 20:15:48 GMT

It would be nice if KB articles referred to here did not have "To access that KB Article please upgrade your support account" level access. Open them up.

Re: WPA2 KRACK Questions & Answers - Resource page

michael_brado — Fri, 20 Oct 2017 20:42:59 GMT

You're correct Lawrence, thanks.

I've set the relevant KBAs open to Public viewing, and they should be visible to guests after the next 6hr Support site update period.

Re: WPA2 KRACK Questions & Answers - Resource page

lawrencebyrd — Fri, 20 Oct 2017 21:17:32 GMT

Thank you. Long time Ruckus AP user for my home (!) and non-profit political campaigns, so don't pay for any support :).

Re: WPA2 KRACK Questions & Answers - Resource page

michael_brado — Fri, 20 Oct 2017 21:18:37 GMT

I just created a public visible KBA-6480 with this content:

If you have been instructed to "lock down" the 7731 point to point bridge frequency channel,
you can view the current channel in use, and configure the bridge to stay on this channel.

Figure 1: Status::Wireless

Current channel in use is Channel 100, and the 7731 is currently set for SmartSelect channel algorithm.

Figure 2: Configuration :: Wireless :: Root Bridge

Use the Channel drop-down list to find the Channel 100 currently in use and click on it.
This will keep the Root Bridge AP setting on Channel 100. (SmartSelect is default).

Re: WPA2 KRACK Questions & Answers - Resource page

michael_brado — Fri, 20 Oct 2017 21:38:45 GMT

Our Forum Community can help you out with most anything but bugs.

Re: WPA2 KRACK Questions & Answers - Resource page

arthur_hulsman — Mon, 30 Oct 2017 16:23:36 GMT

Michael Brado, the Target Patch Release Date https://support.ruckuswireless.com/krack-ruckus-wireless-support-resource-center for ZD version 10.0.1 is 30 october 2017.
It is now 30 october end of business day in europe but i do not see any download links or updates that the patch has been postponed.
When are the download links available for public ?

Re: WPA2 KRACK Questions & Answers - Resource page

grodog-prod — Mon, 30 Oct 2017 23:31:21 GMT

Downloads are being posted from PDT timezone, and announced as they hit the support portal, Arthur.

Allan.

Re: WPA2 KRACK Questions & Answers - Resource page

arthur_hulsman — Fri, 03 Nov 2017 10:23:29 GMT

Allan Grohe, thank you for the update, we have updated our acceptance and production environment. Is it possible to communicate the timezone at the rucksu website when the patch is available for download when there is an critical update.

Re: WPA2 KRACK Questions & Answers - Resource page

michael_brado — Fri, 03 Nov 2017 17:03:37 GMT

You may assume all activity on Ruckus Support is based on our HQ timezone, Pacific Daylight Time (PDT) until Sunday night, when Daylight Savings time falls back one hour.

When you see my software announcements to the Forums groups, all documents and firmware will have been posted and are available for downloading.

Re: WPA2 KRACK Questions & Answers - Resource page

grodog-prod — Sat, 04 Nov 2017 02:47:36 GMT

New content for the KRACK Resource Center web page: KRACK Explained - YouTube video.

Allan.