I can confirm an intrusion from an unknown MAC address (identified as a Realtek device), getting a new, valid IP from the DHCP pool, and using the network for roughly 1 hour.
The network is WPA2 - 1 each for 2.4Ghz and 5Ghz both with the same password. The 2.4Ghz network also includes a TP-Link extender, which creates its own SSID, but again with the same password. So a total of 3 networks with the same password.
WPS is disabled on all 3 networks.
This 40+ random password was set less than 10 days ago. It is certainly random, with the recommended mix of cases, numbers and symbols, generated by a reputed password manager. There are no proximal patterns I can find or think of, and no characters have been repeated - I made sure of that.
How is it possible for this network to have been compromised so quickly?
Is it even theoretically possible for a 40-character random password to be cracked IN 10 DAYS with anything less than a few hundred multi-GPU setups? I don’t think anyone wants to “get” me that badly.
Is it possible for a network to be intruded/joined without knowing the password at all? A version of the KRACK attack or something similar, targeted at the router or perhaps at the repeater.
Is it possible to perform a LOCAL attack similar to KRACK or BlueBorne on one of the 10-ish client devices, that would have allowed the intruder to read the WiFi password off one of these clients, thus compromising the network?
The extended network shows a security setting of [WPA-PSK-CCMP]-TKIP, in addition to [WPA2-PSK-CCMP]-TKIP. Whereas the original networks only have [WPA2-PSK-CCMP]-TKIP. Is this a possible vulnerability?
I do know this question is broad - but I am dealing with a very real intrusion here. I would gladly narrow down the possibilities and subsequently the question based on guidance from the community
Minor addendum: The clients are a typical mix of Android, iOS, streaming sticks, Windows, Mac, Printer. No other IoT or Linux however. There are some Bluetooth accessories strewn about.