full-disclosure - Cisco LEAP exploit tool...

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: mmo at remote-exploit.org (mmo@...ote-exploit.org)
Subject: Cisco LEAP exploit tool...

Well so into more detail for you. There is a key rotation for WEP keys 
maybe (depends
on your setup). But remember there is more than one wepkey to look at.

Let's say there is a "broadcasting wepkey" and a client specific one. 
Most installations
rotate only the client specific one. So any known attack is still valid 
on the broadcast one.

EAP-TLS itself issues other problems depending on the setup.
Also traffic injection is in some specific variants also possible.
(Tools like wepwedgie are demonstrating this, but only a part of the 
whole possible
attacks).

At least PEAP should be used to cover most of the logon credentials, 
but there is also
a minor problem on that.

My shortly released tool hotspotter is also a problem regarding to your 
plans.
It is not possible for me to mention you in detail where the prob is in 
your setup,
but until now, i dont see good EAP setups around.

Hope this helps you a bit in giving your boss a clear, please dont do 
it.

Greetings

Max
http://www.remote-exploit.org
_
On Apr 14, 2004, at 5:19 PM, Dave Howe wrote:

> Curt Purdy wrote:
>> Agreed.  If the packets/hashes can be accessed it can be compromised.
>> "Unbreakable" has been touted from the 48-bit Netscape encryption
>> that took USC's distributed network a week to crack, to Oracle 9i
>> that took one day to compromise, I believe.
> You are preaching to the choir there - however, my boss is preferring 
> to
> believe the consultant's claims that the 10 minute key cycle 
> (communicated
> by TLS) makes the system unbreakable.... so it doesn't need to be on a 
> DMZ
> and can work "just like they were on the lan"
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html