Gonna be a long day for anybody with CPE that does WPA2..

Sean Pedersen spedersen.lists at gmail.com
Mon Oct 16 14:39:48 CST 2017

Cisco's PSIRT:

Some fixes appear to be available, or will be soon.

-----Original Message-----
From: NANOG [mailto:nanog-bounces at nanog.org] On Behalf Of
valdis.kletnieks at vt.edu
Sent: Monday, October 16, 2017 12:38 AM
To: nanog at nanog.org
Subject: Gonna be a long day for anybody with CPE that does WPA2..

Looks like WPA2 may have just become the new WEP.

And it looks like we're all going to be reflashing a lot of devices.

"The proof-of-concept exploit is called KRACK, short for Key Reinstallation
Attacks. The research has been a closely guarded secret for weeks ahead of a
coordinated disclosure that's scheduled for 8 a.m. Monday, east coast time.
advisory the US CERT recently distributed to about 100 organizations
the research this way:

"US-CERT has become aware of several key management vulnerabilities in the
4-way handshake of the Wi-Fi Protected Access II (WPA2) security protocol.
impact of exploiting these vulnerabilities includes decryption, packet
TCP connection hijacking, HTTP content injection, and others. Note that as
protocol-level issues, most or all correct implementations of the standard
be affected. The CERT/CC and the reporting researcher KU Leuven, will be
publicly disclosing these vulnerabilities on 16 October 2017."


More information about the NANOG mailing list