Security

Reply
Highlighted
New Contributor

Dolos Cloak : Automated 802.1x Bypass

Hi,  I've read the following article and I'm wondering how Clearpass is reacting on this? Can profiling help to prevent this kind of attacks?

 

https://kalilinuxtutorials-com.cdn.ampproject.org/c/s/kalilinuxtutorials.com/dolos-cloak-automated-802-1x-bypass-network-penetration/amp/

 

Highlighted
MVP Guru

Re: Dolos Cloak : Automated 802.1x Bypass

Profiling and proper responses can help and will prevent the attack as described. The core of what is exploited here is that on wired 802.1X the authentication is not bound to encryption. MACSec would offer such binding of encryption with authentication, similar to how it works on WLAN which can't be attacked in this way. However, it is hard to build a solution with that as many switches don't have the encryption capacity needed (hardware support) and I'm not aware of a standard client that supports MACSec.

 

This risk should be evaluated as part of your larger risk assessments, and a possible compensating control can be to limit, monitor and inspect the physical access to your network and devices attached to it.

--
If you have urgent issues, please contact your Aruba partner or Aruba TAC (click for contact details).
Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: