Is the Dynatrace UFO vulnerable to the KRACK WPA2 exploit?

[peter_gerhards]

Are the Dynatrace UFO's vulnerable to the recently published weakness in the WPA2 specification? And if so, will there be an updated firmware available any time soon?

Details on the weakness: https://www.krackattacks.com/

[JamesKitson]

I only have an interest in this topic - I do not work on any products or the UFO personally so keep that in mind with my response, but any standard WPA2 implementation would be vulnerable to this exploit. I see that the UFO supports https though so as long as that encryption is used then I would not expect it to be a major risk as an attacker would need to get within range of your wireless, and be able to circumvent https before being able to view the traffic.

Of course it is best to have as many layers of security as possible though so it would be good to get a more authoritative response to this.

James

[peter_gerhards]

It is true that any standard implementation of WPA2 is at risk.
It is also true that the Linux software package wpa_supplicant was recently updated to prevent the KRACK attack.
Patching the UFO firmware is in my opinion the fastest and easiest way to avoid any lengthy discussion with my customers Security Officers.

Peter

[helmut_spiegl · Accepted solution]

I can confirm that the UFO is vulnerable to the KRACK WPA2 exploit as it is using the esp32.
According to the esp32 documentation the UFO firmware just uploaded solves this issue (by using a new esp32 firmware version)

[peter_gerhards]

And with that my question hes been answered. Many thanks Helmut!