Dolos Cloak : Automated 802.1x Bypass
10-02-2019 08:04 AM
Hi, I've read the following article and I'm wondering how Clearpass is reacting on this? Can profiling help to prevent this kind of attacks?
Re: Dolos Cloak : Automated 802.1x Bypass
10-02-2019 11:46 PM
Profiling and proper responses can help and will prevent the attack as described. The core of what is exploited here is that on wired 802.1X the authentication is not bound to encryption. MACSec would offer such binding of encryption with authentication, similar to how it works on WLAN which can't be attacked in this way. However, it is hard to build a solution with that as many switches don't have the encryption capacity needed (hardware support) and I'm not aware of a standard client that supports MACSec.
This risk should be evaluated as part of your larger risk assessments, and a possible compensating control can be to limit, monitor and inspect the physical access to your network and devices attached to it.
If you have urgent issues, please contact your Aruba partner or Aruba TAC (click for contact details).