Slashdot Mirror
Cisco's LEAP Authentication Cracked
mtrisk writes "Just a day after Cisco released a security warning about its WLSE access point management tool, a tool to crack wi-fi networks using LEAP authentication has been released, reports Wi-Fi Networking News. The tool, called Asleap and developed by Beyond-Security, actively de-authenticates users, sniffs the network when the user re-auntheticates, and performs an offline dictionary attack upon the password."
Man to say this isn't Cisco's week would be an understatement. It can also read saved libpcap and airopeek captures. It also can save the required data only to a file for later processing so you can use it on a Palm or WinCE device. Also, for those who just want to get started: Windows Binary | Source.
As a small business, i use a Linksys wireless router. Cisco now owns Linksys. Can anyone alleviate my "phears" and tell me that this vulnerability is more for the hardware found in big companies like Bell Canada, and not my WEP 64 wireless? I'd really appreciate a summary of what all the fuss is about and how it affects people who don't run mega corps. Thanks.
What are these guys, the Microsoft of hardware?
I'm not normally an irrational zealous dickhead, but I figure "When in Rome..."
Wifi is once again unsecure.
-Grump
Is it true that more people vote for the winner of American Idol, than vote for the president? -Ali G.
Sure, this is a well done cracking tool, but isn't "cracked" a bit sensationalistic considering it still requires brute forcing the password? The weakness remains the password here, hardly the authentication scheme... good luck dictionary attacking a good password!
Cos the very very large corporation which I very recently used to work for has just rolled out Cisco based wireless across *all* of it's sites worldwide.
Government of the people, by corporate executives, for corporate profits.
Because if you are using a Cisco network it is self-defending, self-securing and self-healing. No, really. I saw it on TV.
They had this little girl on the computer and she like, downloaded a worm. But, the network saw it and popped up a message on her screan that the worm was there. Then it said that it was like, isolating the worm and everything. Then it like, popped up another message that said the worm had been destroyed. It was like, way cool and I didn't even know that Cisco like, made antivirus software.
Of course the above is a joke but, what is not funny is that the television advertisement is well done and likely to be very influential to the typical PHB who will buy it hook, line and sinker.
A more detailed source.
Bin it now! Not because it's insecure, bin it cos it's crap.
BTW, if you're running standard WEP it's pretty easy to get into your network anyway.
Government of the people, by corporate executives, for corporate profits.
It's WHY you really, really ought to have a cryptologist design your subsystems if at all possible. If it's not possible, you need to have them AUDIT it at the very least. Suffice it to say, each and every one of the wireless designs so far seem to be fairly flawed- and I don't believe that a single one was designed by or audited by a competent cryptographer (Someone like Schneier comes immediately to mind- never mind how expensive this sort of person will be for you with the design work or an audit, the embarassment and increased liability for exploits on the system make it far, far more expensive to NOT hire them...).
I'm a fairly competant amateur- I know better than to assume anything I or anyone else that's not an SME produces in this arena is anything but vulnerable until proven otherwise.
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
Script kiddies using canned cracks on me from Windows machines would just make me feel dirty.
I seen the leap cracker downloadable for at least several months now. This means it has been in use for quite some time no sense in worrying about it now.
Got Code?
This is an offline dictionary attack, not a cryptographic break as has been done to WEP. If you use a strong password (one not in the dictionary), this won't break it. I don't know if preventing offline attacks was a goal of LEAP; if it was, it's fair to describe this as a crack, but if not, this is really just a tool to automate what was already known to be possible.
Microsoft Hardware Worldwide.
And yes, they've got wireless routers running you-know-what!
The more you know, the less you need. [Admin added: from me.]
Since large businesses use secure VPN over any insecure channel (wireless, internet, dialup, even inside their own wired network) then it will only affect small businesses or those with poor security specialists who try to save money by putting the security into the network infrastructure.
Unfortunately while the firmware may be upgradeable, the cryptographic functions are usually implemented in hardware (better performance) and it may be hard, if not impossible, to secure the authentication so this kind of attack is harder.
What they really should do is have a public/private key for each access point, with the SSID set to the public key. Then any client can transmit to the access point without possibility of eavesdropping. This would be used to set up the secure LEAP session. Since the password is never sent back to the client then it's not going to be breakable by offline brute force attacks.
Of course, in the end anything is breakable given enough time and/or money.
-Adam
Many people here are talking about the length of time it takes to brute the password. I saw a demonstration of the asleap tool about 1/2 a year ago and it took 15 seconds to reveal the password. Something you need to keep in mind is the fact that there is no salt involved in the password hash for LEAP. So a precached hash of the possible passwords is very easy. All you need is lots of disk space and a well written index of the hashes.
There are quite a few others that are saying well thats only if you let your users pick bad passwords... Come on guys, have you actually worked in the real world? Normal users can't remember crazy passwords, they are going to pick their dog and their favorite football player's number put together. Or their aniversary and the current food they are eating.
Keeping a dictionary of enough passwords to get into the network would be trivial. All you need is one user with a weak password to get in, after that who cares how strong the rest are.
A conspiracy theory.
WEP is broken by design. A few engineers who don't know anything about cryptanalysis making their own encryption system that turns out to be broken is quite plausable however wifi standards are set by the IEEE. The IEEE is not stupid.
Was WEP deliberatly broken to make government snooping easier?
That may seem ludicrus now but what if the likes of consume suceed in their goal of building mesh networks across citys? Securing wireless connections at VPN or application level is so much hassle that only 0.01% of users bother.
The reaction of the American government to the new Chinese wifi encryption standard lends weight to this theory. Supporting WAPI just means hardware manufacturers have to write a bit more software. Once it's in the software it will no doubt be supplied as standard worldwide. It may actuall be secure with little work. Why else would the American government threaten retailation over somthing so obscure?
Comment removed based on user account deletion
The site which accidently looks a lot like slashdot, focuses on quality security news; no vuln reports people don't care about... all the latest news and white papers.
A cool white paper on utf-8 shellcodes was released on it too.
EAP-TLS, EAP-TTLS, and other EAP/802.1x authentication mechanisms are also supported by Aironet 1100 and 1200 series APs. These use strong certificate-based authentication, which isn't practially vulnerable to dictionary attack. This, of course, requires you run a certicifate authority for your network, and means more work - but most companies running a VPN will already be doing this, and those that are not will do this to avoid having to put APs outside the firewall and maintain a VPN infrastructure for WLANs.
Whee! /. goes security journalism:
Dictionary attack == LEAP is cracked!
So NOW I know why everyone's telling me that LEAP is not the end-game, and we need to move to systems based on PEAP (which is supposed to be an open standard, as opposed to LEAP which is proprietary) or some other, even newer variant.
Security protocols are like windows (the physical kind). Once they're broken, duct tape is not the answer.
I can't alleviate your fears with regard to your wireless router.
While Cisco owns Linksys, they don't use LEAP on that device (LEAP is typically used in enterprise contexts for wireless access...). However, your WEP based device is actually every bit as vulnerable because WEP's been cracked for pretty much any number of bits and has been for some time. LEAP was being touted as the fix to the problem and Cisco was flogging it pretty heavily- we now know that LEAP's not any better than WEP in all practical use.
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
Now there's something I never thought of - bajillions of possible passwords, what with mixing of case, numbers, and a few special characters across an unknown number of characters...
Why not sit down ONCE, and create your own dictionary of all possible passwords - which would be a huge job, but afterwards you could just do a simple lookup on the hash and your database would return the unencrypted password.
Considering an OS like Windows can last almost a decade before most people are upgraded to the next version, it might be worth spending a couple of years building such a dictionary to have as a resource.
Now, I eagerly await all those who wish to respond with either A) It's long since been done or, B) It's not practical yet due to the required processing & storage. In my ignorance, I don't know which is the case.
Offline Dictionary Attacks do work on "strong" passwords. I got the hash of my Dad's strong Mac OS X password (something like "l;770gH>K") and cracked it using John the Ripper in about 45 days using an old Power Mac G4 400mhz machine. It's not hard, you just have to be patient. To be fair, I think OS X uses SHA1 as opposed to MD5 (which would have taken a lot longer to crack probably)
The LEAP problem is pretty egregious because PEAP and EAP-TTLS are in wide use -- both of which encrypt the authentication process protecting against just sucking down a transaction for offline analysis. PEAP was supposedly supported by Microsoft and Cisco, but I don't see how Cisco is supporting it by releasing EAP-FAST, which is an alternate approach that's not as strong as PEAP. (PEAP is also supported by Mac OS X 10.3, just by the way, as well as third parties who made 802.1X authentication software clients.)
But remember that this problem isn't limited to LEAP. As Robert Moskowitz of ICSA Labs wrote last November, poor WPA preshared key passphrase choice can allow WPA keys to be cracked. WPA (Wi-Fi Protected Access) is a fix to WEP that involves dramatically more complexity and sophistication in deriving per-packet keys.
However, if you choose a dictionary-crackable passphrase of under 20 characters in WPA, you hit the same problem as LEAP: a cracker can trigger a deauthentication, capture the reauthentication in less than a minute, and then crack at their leisure.
WPA-PSK will probably only be used in home and small office networks, where passphrases may be poorly chosen. I have spoken to manufacturers about changing the presentation layer: don't let users pick bad passwords. So far, to no avail. Not even a recommendation from the Wi-Fi Alliance.
Freelance tech journalist for the Economist, MIT Technology Review, Macworld, and others
I always thought LEAP's strengths were in the time based key exchange. If the keys are exchanged some aribtrarily short period of time, you won't have the time to do a 128-bit crack.
Not having used LEAP, during a 'deauthentication' is there any notification to the client that the wireless subsystem is 're-authenticating'?
"Draco dormiens nunquam titillandus."
Wow, this is slow on the uptake even for slashdot. This was demonstrated last year at DefCon in August. It works because, as somebody else mentioned, there is no salt on the hash so you can pre-compute massive hash dictionaries. Also, it's a bastardized MS-CHAP which stupidly pads the hash with two constant characters so you can almost instantly cut down the keyspace you need to brute force by a huge margin.
The limiting factor is how fast your attack machine can read your pre-computed dictionaries off the disk.
- RustyTaco
This is yet another example of why you need to hire security programmers with actual experience in the field, not just outsource it to a cheap Indian programming group with no real experience writing robust protocols.
I'm an ex Cisco security programmer, and thats exactally what was happening before I quit. I wish I could say more...
There is a VAST difference
Yes, it's the difference between fscking 300 milion Joe's who cannot sue you and don't really know the difference between a CPU and an operating system, and trying not to piss off big $$$ companies which can, eventually, sue. Microsoft is also helpful towards big $$$, rest assured.
"In this age it is becoming possible to precompute the hashes and then look them up, in that case the "strength" of the password becomes less important."
I would love to know how this works -- I thought it was pretty much useless. First because the storable keyspace is so much tinier than the total keyspace, and second because of salts.
IANACrypto person, but the basic idea with salts is that the router would say 'please send me your password hashed with the string "abcdefg".' The client then says, "oh, of course, that's hash('passwordsexgodabcdefg')". The evil sniffer has hash('passwordsexgod') stored in their lookup table, but that's totally useless in discovering what the client used. Since 'abcdefg' is a different string in each transaction, the lookup table becomes irrelevant.
I wasn't being sarcastic above -- I would love to know if this technique has somehow been overcome.
It's funny how much effort people put into solving the wrong problem - if you simply treat your wireless network like the Internet and secure your actual services, none of this is a concern.
but... ... ... :o)
I am Japanese...
_
# CheapGbE!GbE!!TheKLF!KLF!!TheRMS!RMS!! And a meme sparks
I feel for you man. But my teacher told me, and I stick to this in my life: "The cream will always rise."
Cisco -> Ci sco -> Ci SCO -> SCO
Civilian control monkey.
> Happy birthday to me.
> Happy birthday to me.
> I paid for some pussy,
> but you got some for free.
u-mmmm.
That song is like a
"DENKI GROOVE - Happy Birthday.mp3"
Japanese music.
I think.
Dig.
o.
_
by okayiaT ver.65535
# CheapGbE!GbE!!TheKLF!KLF!!TheRMS!RMS!! And a meme sparks...
anyone think this is due to outsourcing besides me?
just after cisco started utsourcing, their products have become faulty, sure, the programmers in india are pretty smart, but most are quickly trained amatuers who are usually new to coding secure applications. anyone else think this may be the case?
Maybe people should stop using dictionary words for passwords?
I think of a phrase and take first letter of each word, like
Top of the morning to you ==> totmty
etc..
The problem is that most will spinkle some salt on the password, resulting in a new hash value.
So, let's say my password is "dog". I'll put a random but publicly known salt in front of it: "abc". The hash algorithm will then hash "abcdog".
If that's the case, then it gets very expensive to hash every password... you basically need s^n copies of your hash dictionary. If you pick a suitably large numbers for s & n, that can become unreasonably large.
How widespread is knowledge of the hardcoded login and password? I haven't run across it yet, but that doesn't mean it isn't floating around.
"Upon attaching the waterblock to my penis, I began to notice that I know nothing about computers." -- JRockway
Sadly the problem is consumers don't care enough to require companies to put the effort into caring about real security. How many people who buy these products actually know what a brute-force or dictionary attack is? In my comp sci course we, doing a time-space tradeoff problem cracked a subset sum password scheme (iirc, subset-sum is NP-complete so there's currently no known polynomial time algorithm) fairly quickly (it was one that M$ used to use). I bet most people who purchase these products have on knowledge/no interest in what makes a security scheme vulnerable as long as it works for them.
/. crowd cares because we're all computer geeks and we read /., but until mainstream consumers care, there's not much incentive to correct things.
Furthermore, aside from the tinfoil hat crowd, do most people really have a need for their systems to be crack-proof. Granted, I use various randomly generated passwords (but I use them all enough that my fingers remember them even if I forget them) but in all honesty, if someone cracked my computer password, unless they were just an asshole trying to wreak havoc for no reason, there's not much they could grab that would bother me (pr0n is not something I'm embarassed about having on my computer and anything really private, I have encrypted another way - I used to keep a journal on my comp but I never wrote in English in case someone saw it because that was way private).
Companies respond to consumer pressure. If people really wanted these things to be super secure, there'd be a consumer backlash and then Cisco would realize that things should be super secure. Problem is, most people don't seem to care. How many management people have any idea what their IT person is talking about when he mentions public-key or asymetric key versus symmetric key encryption? Furthermore even if they do, do you think they honestly understand what makes certain protocols more secure than others?
The
And in France, Cisco is now passing TV Ads about total security in their networks, and self-healing systems. Not a good claim to do these days...
Of course, in the end anything is breakable given enough time and/or money.
Or a big enough hammer.
paintball
Wireless security is broken beyond repair, and incremental attempts to fix it, like LEAP, just aren't working.
I think we should just treat all networking transports (wired, wireless) as inherently insecure and implement security separately with systems like IPsec, ssh, and SSL.
Then, we won't have to upgrade our hardware every time another flaw surfaces. Or is that perhaps the plan, actually?
Security is best done end-to-end. As significant amounts of traffic requiring security cross layer 2 boundaries (ie. the wired or wireless networks you are talking about), it is far better to implement the protocols you are taking about, which usually provide end-to-end, or near end-to-end protection.
The Internet's nature is peer to peer - 20050301_cs_profs.pdf
The real question though is what does this *really* mean to wireless security? The answer is: not much. Most large enterprises that were using LEAP migrated to Cisco PEAP (or MS PEAP), or EAP-TLS in recent months or just simply unplugged their wireless from the network in some instances.
The state and history of wireless security is this. First there was static WEP, and static WEP had a technical problem (not to mention the social vulnerability of a shared key) with weak IVs, but any modern implementation has fixed this and is immune to wepcrack/airsnort. In response to this, three different technical solutions were created:
1. Dynamic WEP (change out key via 802.1x framework every 4 minutes).
2. WPA 1.0/TKIP (new key every packet, new MIC, 48-bit IV).
3. WPA 2.0/802.11i (802.1x, RSN, and AES). The standard is being finalized and products will begin to appear at the end of the year.
With the addition of new wireless IDS's and 802.11 aware stateful firewalls, (like Aruba), wireless gets even more secure then it ever has been before.
Using your situation, couldn't you argue that Cisco made some false claims, engaged in false advertising, and if you got a contract with them... negotiated in bad faith? This seems like it should be s serious issue for their 'newer' customers and maybe they deserve some sweeteners to be added to their contracts.
[Fuck Beta]
o0t!
1) Some of the fastest hard crypto (i.e. military grade...) came from the very person I mention as an example.
2) Variety can only take you so far- chaff, etc. can make it difficult, but in the end, you basically end up with the same level of vulnerability you had in the system to begin with. Even variety doesn't make up for a weakness in your system.
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
Microhard? Sounds like the main ingredient for a few crass jokes, so I'll keep this short. Never mind.
Neunhauer doesn't use signatures
Comment removed based on user account deletion
But what he is saying is that if the hash is md5, you find one string that corresponds to each possible hash. Then it doesn't matter if it is salted or not, because the salted version would be in the dictionary as well. This isn't really feasible with current technology for md5, but it is part of the reason the old unix crypt has a limited shelflife.
====
Crudely Drawn Games