09/02/2026
To protect your companyβs IT infrastructure and corporate Wi-Fi from Blast-RADIUS, it is essential to implement immediate mitigations:
Require the Message-Authenticator attribute (RFC 3579): Adds an integrity check (ICV) to all protocol packets, preventing an attacker from forging responses.
Migration to EAP-TLS: Replace username/password-based authentication with individual digital certificates (mutual authentication), eliminating the password attack surface.
Strengthening Shared Secrets: Adopt complex shared keys (with more than 20 characters) between NAS devices (switches/access points) and the RADIUS server.
Segmentation and Dynamic Control (CoA/PoD): Implement RFC 3576 for immediate revocation of suspicious sessions in real time.
Want to know more? Read our blog!