Cisco Systems knew it was coming and this week it has finally arrived: a hacking tool for performing dictionary attacks on 802.1X systems using Cisco’s LEAP protocol is now available.
LEAP, short for Lightweight EAP, is one of many extensible authentication protocols (EAP) used to relay port access requests between clients, switches, access points and RADIUS servers on wired and wireless systems using 802.1X for authentication.
LEAP is owned by Cisco, so vendors who want to use it must pay a licensing fee — and many vendors have done so. But last year it was reported to Cisco that LEAP was vulnerable to hackers “dictionary attack”, wherein weak passwords — words that can be easily found in the dictionary — can be easily pilfered.
The released hacking tool, called “asleap”, runs on Linux and makes it simple for hackers to scan the network.
The release of asleap comes on the heels of another vulnerability in Cisco wireless products, which the company notified customers about this week. Default user names and passwords that are “hardwired” into the Cisco Wireless LAN solution engine make some products vulnerable to anyone who wants to log on. Cisco says it found the flaw itself and doesn’t know of anyone using it in real-world networks. A software release is available to fix the problem.
According to a post a Bugtraq at Insecure.org, the tool was written in August of 2004 by network engineer Joshua Wright, who demonstrated it that month at the DEFCON conference. He said by using the tool he “was able to search through large dictionary files very quickly for user passwords” … 45 million passwords per second on meager hardware.
Wright didn’t immediately release asleap, but instead informed Cisco. The company asked him to wait a few months before making it publicly available, giving Cisco time to create EAP-FAST.
EAP-Fast (flexible authentication via secure tunneling) is not a fix for LEAP, but a whole new protocol. It doesn’t use certificates and Cisco is making the specification available without licensing fees. FAST will also be part of future versions of Cisco compatible extensions (CCX), the set of specifications Cisco wants vendors, from chip makers to laptop manufacturers, to build into their Wi-Fi products. CCX is meant to ensure Wi-Fi products will work seamlessly with the Cisco infrastructure products.
As of this week, Wright has released the source code for asleap version 1.0, and included a port to the Win32 platform. In his post at Bugtraq, Wright says “I encourage LEAP users to install and use asleap to evaluate the risks of using LEAP as a mechanism to protect the security of wireless networks.”
He adds at the SourceForge.net site: “I’m releasing asleap now to motivate the non-believers into moving away from LEAP.”
This article was compiled and edited by CIO Update staff. See the orginal story on WiFi Planet.com.