Re: [Full-Disclosure] Cisco LEAP exploit tool...

[mmo@xxxxxxxxxxxxxxxxxx]

Well so into more detail for you. There is a key rotation for WEP keys 
maybe (depends
on your setup). But remember there is more than one wepkey to look at.

Let's say there is a "broadcasting wepkey" and a client specific one. 
Most installations
rotate only the client specific one. So any known attack is still valid 
on the broadcast one.

EAP-TLS itself issues other problems depending on the setup.
Also traffic injection is in some specific variants also possible.
(Tools like wepwedgie are demonstrating this, but only a part of the 
whole possible
attacks).

At least PEAP should be used to cover most of the logon credentials, 
but there is also
a minor problem on that.

My shortly released tool hotspotter is also a problem regarding to your 
plans.
It is not possible for me to mention you in detail where the prob is in 
your setup,
but until now, i dont see good EAP setups around.

Hope this helps you a bit in giving your boss a clear, please dont do 
it.

Greetings

Max
http://www.remote-exploit.org
_
On Apr 14, 2004, at 5:19 PM, Dave Howe wrote:

> Curt Purdy wrote:
> > Agreed.  If the packets/hashes can be accessed it can be compromised.
> > "Unbreakable" has been touted from the 48-bit Netscape encryption
> > that took USC's distributed network a week to crack, to Oracle 9i
> > that took one day to compromise, I believe.
> You are preaching to the choir there - however, my boss is preferring 
> to
> believe the consultant's claims that the 10 minute key cycle 
> (communicated
> by TLS) makes the system unbreakable.... so it doesn't need to be on a 
> DMZ
> and can work "just like they were on the lan"
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html