Weaknesses in LEAP Challenge/Response

[Joshua Wright]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In August 2003, I sent a tool I had written to the Cisco PSIRT team
that exploited weaknesses in the LEAP challenge/response
authentication mechanism. This tool leveraged large password lists
to efficiently launch offline dictionary attacks against LEAP user
accounts, collected through passive sniffing or active
disassociate/reassociate techniques.

The Cisco LEAP challenge/response mechanism is just a modified
version of MS-CHAPv2, as documented on the cisco.com website [1].=20
The MS-CHAPv2 protocol is known to be weak, as documented in many
sources.

My concern when learning about the architecture of the LEAP protocol
was that Cisco was continuing to push LEAP to customers in their CCX
program as a way to gain market share, over stronger wireless
authentication protocols such as PEAP and TTLS. After presenting
this information at the Defcon 11 conference [2], Cisco released a
PSIRT notice that referenced their internal documentation, making
customers aware that LEAP was vulnerable to dictionary attacks [3].=20
This notice was very subtle, and despite my asking Cisco to reword
the notice to include stronger language that would prompt people who
are using LEAP to take the flaw seriously, Cisco would not modify the
notice.

I am not the first person to identify this weakness, and I know that
other people have written code (that is likely far better than my own
code) to exploit this flaw but have remained quiet while Cisco
prepares an alternate, stronger authentication mechanism for
customers. In an effort to give Cisco and their customers time to
react to this flaw, I told Cisco I would not release my attack code
for 6 months, starting in August 2003. I plan to keep this promise,
although it may be moot since other exploit code has been posted to
public forums that exploits the same challenge/response flaw.

Customers using LEAP should be aware that the usernames and password
of their user account are exposed, and should plan for the deployment
of an alternate authentication mechanisms such as PEAP or TTLS.=20
Disabling user accounts after successive failed login attempts will
not help protect against unauthorized access, since this is an
offline attack that can be run at the attacker's leisure. At a bare
minimum, LEAP users should immediately audit and expire user
passwords that are based on dictionary words, or common derivations.

- -Joshua Wright
Senior Network and Security Architect
Johnson & Wales University
Joshua.Wright@jwu.edu=20
http://home.jwu.edu/jwright/

pgpkey: http://home.jwu.edu/jwright/pgpkey.htm
fingerprint: FDA5 12FC F391 3740 E0AE BDB6 8FE2 FC0A D44B 4A73


[1] "802.11 Wireless LAN Security White Paper",
http://www.cisco.com/en/US/netsol/ns110/ns175/ns176/ns178/networking_s
olutions_white_paper09186a00800b469f.shtml (section 5 - "Cisco LEAP
Architecture").

[2] "Weaknesses in LEAP Challenge/Response",
http://home.jwu.edu/jwright/presentations/asleap-defcon.pdf.

[3] "Dictionary Attack on Cisco LEAP",
http://www.cisco.com/warp/public/707/cisco-sn-20030802-leap.shtml.


-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com>

iQA/AwUBP4Fauo/i/ArUS0pzEQJPGgCeMsXRKllukoUWylhsvd/7Y1xxem0AmwYo
ujluL47iYElFAkaFSh7ZTKEV
=3Dsg8y
-----END PGP SIGNATURE-----

[Sharad Ahlawat]

=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This is in response to the mail posted by Joshua Wright. The original mail =
is=20
available at
http://www.securityfocus.com/archive/1/340365/2003-10-03/2003-10-09/0

On Monday 06 October 2003 05:06, Joshua Wright wrote:
> In August 2003, I sent a tool I had written to the Cisco PSIRT team
> that exploited weaknesses in the LEAP challenge/response
> authentication mechanism. This tool leveraged large password lists
> to efficiently launch offline dictionary attacks against LEAP user
> accounts, collected through passive sniffing or active
> disassociate/reassociate techniques.
>=20
> The Cisco LEAP challenge/response mechanism is just a modified
> version of MS-CHAPv2, as documented on the cisco.com website [1].
> The MS-CHAPv2 protocol is known to be weak, as documented in many
> sources.

This is not a new attack or new vulnerability of Microsoft MS-CHAP or Cisco=
=20
LEAP and this proof of concept code demonstrates that simple dictionary bas=
ed=20
passwords can be deciphered relatively easily. The most effective way to=20
mitigate against dictionary attacks is to create a strong password policy.=
=20
Cisco discussed Cisco LEAP's vulnerability to dictionary attacks and its=20
mitigation techniques in the SAFE Wireless LAN Security White Paper,=20
originally published in 2001. [1]

> My concern when learning about the architecture of the LEAP protocol
> was that Cisco was continuing to push LEAP to customers in their CCX
> program as a way to gain market share, over stronger wireless
> authentication protocols such as PEAP and TTLS.

Cisco is a co-inventor of PEAP and has invested heavily in developing and=20
implementing PEAP and supports it for deployment today. The CCX program als=
o=20
includes support for PEAP along with LEAP.

Cisco has made multiple EAP protocols available for deployment namely LEAP,=
=20
PEAP and EAP-SIM. It would be incorrect to state that Cisco "pushes" LEAP.=
=20
Cisco strives to provide support for the protocols requested/demanded by ou=
r=20
customers, allowing customers to make the best decisions for their network=
=20
implementations.

> After presenting
> this information at the Defcon 11 conference [2], Cisco released a
> PSIRT notice that referenced their internal documentation, making
> customers aware that LEAP was vulnerable to dictionary attacks [3].
> This notice was very subtle, and despite my asking Cisco to reword
> the notice to include stronger language that would prompt people who
> are using LEAP to take the flaw seriously, Cisco would not modify the
> notice.

Cisco security notices and announcements are only released in response to=20
security vulnerabilities in our products. They state the vulnerability=20
clearly and precisely. They do not contain strong, or for the lack of anoth=
er=20
word, weak language. Cisco posted a security notice for Dictionary Attacks =
on=20
Cisco LEAP on August, 02, 2003 at=20
http://www.cisco.com/warp/public/707/cisco-sn-20030802-leap.shtml to reiter=
ate=20
the susceptibility of LEAP to dictionary attacks in the absence of a strong=
=20
password policy.

> I am not the first person to identify this weakness, and I know that
> other people have written code (that is likely far better than my own
> code) to exploit this flaw but have remained quiet while Cisco
> prepares an alternate, stronger authentication mechanism for
> customers.

Cisco appreciates security researchers who follow the generally acknowledge=
d=20
guidelines of responsible disclosure, giving vendors an opportunity to fix =
a=20
vulnerability before publicizing it.

> In an effort to give Cisco and their customers time to
> react to this flaw, I told Cisco I would not release my attack code
> for 6 months, starting in August 2003. I plan to keep this promise,
> although it may be moot since other exploit code has been posted to
> public forums that exploits the same challenge/response flaw.

Cisco appreciates the offer to not release the proof of concept code till=20
=46ebruary, 2004. Cisco is currently working on a software upgrade for our=
=20
customers that would address this vulnerability of LEAP being susceptible t=
o=20
dictionary attacks. This software release is expected to be available by=20
March, 2004. Releasing the proof of concept code before users have migrated=
=20
to a dictionary attack proof implementation is like releasing exploit code=
=20
and I am not sure of any beneficial purpose that would serve.

> Customers using LEAP should be aware that the usernames and password
> of their user account are exposed, and should plan for the deployment
> of an alternate authentication mechanisms such as PEAP or TTLS.

This is an incorrect statement. Cisco LEAP is a secure 802.1X EAP=20
authentication solution-when accompanied with a strong password policy. Use=
rs=20
can confidently deploy and continue to use Cisco LEAP in conjunction with a=
=20
strong password policy and do always have the choice of deploying any other=
=20
EAP protocol.

> Disabling user accounts after successive failed login attempts will
> not help protect against unauthorized access, since this is an
> offline attack that can be run at the attacker's leisure. At a bare
> minimum, LEAP users should immediately audit and expire user
> passwords that are based on dictionary words, or common derivations.

Using a strong password policy for protection from dictionary attacks has=20
always been Cisco's recommendation to customers.

/Sharad


> -Joshua Wright
> Senior Network and Security Architect
> Johnson & Wales University
> Joshua.Wright@jwu.edu
> http://home.jwu.edu/jwright/
>=20
> pgpkey: http://home.jwu.edu/jwright/pgpkey.htm
> fingerprint: FDA5 12FC F391 3740 E0AE BDB6 8FE2 FC0A D44B 4A73
>=20
>=20
> [1] "802.11 Wireless LAN Security White Paper",
> http://www.cisco.com/en/US/netsol/ns110/ns175/ns176/ns178/networking_s
> olutions_white_paper09186a00800b469f.shtml (section 5 - "Cisco LEAP
> Architecture").
>=20
> [2] "Weaknesses in LEAP Challenge/Response",
> http://home.jwu.edu/jwright/presentations/asleap-defcon.pdf.
>=20
> [3] "Dictionary Attack on Cisco LEAP",
> http://www.cisco.com/warp/public/707/cisco-sn-20030802-leap.shtml.

=2D --=20
Sharad Ahlawat
Cisco Product Security Incident Response Team (PSIRT)
http://www.cisco.com/go/psirt
Phone:+1 (408) 527-6087
PGP-key: http://pgp.mit.edu:11371/pks/lookup?op=3Dget&search=3D0xC12A996C
=2D----BEGIN PGP SIGNATURE-----
Comment: PGP Signed by Sharad Ahlawat

iD8DBQE/gw/KGoGomMEqmWwRAh28AKDHwVebQ+tIzarsX/G4a4BlLqc1xQCg95R/
C8isa5c4ZrLUwI5Vp1ToNWc=3D
=3DY6SB
=2D----END PGP SIGNATURE-----

[Sharad Ahlawat]

=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This is in response to the mail posted by Joshua Wright. The original mail =
is=20
available at
http://www.securityfocus.com/archive/1/340365/2003-10-03/2003-10-09/0

On Monday 06 October 2003 05:06, Joshua Wright wrote:
> In August 2003, I sent a tool I had written to the Cisco PSIRT team
> that exploited weaknesses in the LEAP challenge/response
> authentication mechanism. This tool leveraged large password lists
> to efficiently launch offline dictionary attacks against LEAP user
> accounts, collected through passive sniffing or active
> disassociate/reassociate techniques.
>=20
> The Cisco LEAP challenge/response mechanism is just a modified
> version of MS-CHAPv2, as documented on the cisco.com website [1].
> The MS-CHAPv2 protocol is known to be weak, as documented in many
> sources.

This is not a new attack or new vulnerability of Microsoft MS-CHAP or Cisco=
=20
LEAP and this proof of concept code demonstrates that simple dictionary bas=
ed=20
passwords can be deciphered relatively easily. The most effective way to=20
mitigate against dictionary attacks is to create a strong password policy.=
=20
Cisco discussed Cisco LEAP's vulnerability to dictionary attacks and its=20
mitigation techniques in the SAFE Wireless LAN Security White Paper,=20
originally published in 2001. [1]

> My concern when learning about the architecture of the LEAP protocol
> was that Cisco was continuing to push LEAP to customers in their CCX
> program as a way to gain market share, over stronger wireless
> authentication protocols such as PEAP and TTLS.

Cisco is a co-inventor of PEAP and has invested heavily in developing and=20
implementing PEAP and supports it for deployment today. The CCX program als=
o=20
includes support for PEAP along with LEAP.

Cisco has made multiple EAP protocols available for deployment namely LEAP,=
=20
PEAP and EAP-SIM. It would be incorrect to state that Cisco "pushes" LEAP.=
=20
Cisco strives to provide support for the protocols requested/demanded by ou=
r=20
customers, allowing customers to make the best decisions for their network=
=20
implementations.

> After presenting
> this information at the Defcon 11 conference [2], Cisco released a
> PSIRT notice that referenced their internal documentation, making
> customers aware that LEAP was vulnerable to dictionary attacks [3].
> This notice was very subtle, and despite my asking Cisco to reword
> the notice to include stronger language that would prompt people who
> are using LEAP to take the flaw seriously, Cisco would not modify the
> notice.

Cisco security notices and announcements are only released in response to=20
security vulnerabilities in our products. They state the vulnerability=20
clearly and precisely. They do not contain strong, or for the lack of anoth=
er=20
word, weak language. Cisco posted a security notice for Dictionary Attacks =
on=20
Cisco LEAP on August, 02, 2003 at=20
http://www.cisco.com/warp/public/707/cisco-sn-20030802-leap.shtml to reiter=
ate=20
the susceptibility of LEAP to dictionary attacks in the absence of a strong=
=20
password policy.

> I am not the first person to identify this weakness, and I know that
> other people have written code (that is likely far better than my own
> code) to exploit this flaw but have remained quiet while Cisco
> prepares an alternate, stronger authentication mechanism for
> customers.

Cisco appreciates security researchers who follow the generally acknowledge=
d=20
guidelines of responsible disclosure, giving vendors an opportunity to fix =
a=20
vulnerability before publicizing it.

> In an effort to give Cisco and their customers time to
> react to this flaw, I told Cisco I would not release my attack code
> for 6 months, starting in August 2003. I plan to keep this promise,
> although it may be moot since other exploit code has been posted to
> public forums that exploits the same challenge/response flaw.

Cisco appreciates the offer to not release the proof of concept code till=20
=46ebruary, 2004. Cisco is currently working on a software upgrade for our=
=20
customers that would address this vulnerability of LEAP being susceptible t=
o=20
dictionary attacks. This software release is expected to be available by=20
March, 2004. Releasing the proof of concept code before users have migrated=
=20
to a dictionary attack proof implementation is like releasing exploit code=
=20
and I am not sure of any beneficial purpose that would serve.

> Customers using LEAP should be aware that the usernames and password
> of their user account are exposed, and should plan for the deployment
> of an alternate authentication mechanisms such as PEAP or TTLS.

This is an incorrect statement. Cisco LEAP is a secure 802.1X EAP=20
authentication solution-when accompanied with a strong password policy. Use=
rs=20
can confidently deploy and continue to use Cisco LEAP in conjunction with a=
=20
strong password policy and do always have the choice of deploying any other=
=20
EAP protocol.

> Disabling user accounts after successive failed login attempts will
> not help protect against unauthorized access, since this is an
> offline attack that can be run at the attacker's leisure. At a bare
> minimum, LEAP users should immediately audit and expire user
> passwords that are based on dictionary words, or common derivations.

Using a strong password policy for protection from dictionary attacks has=20
always been Cisco's recommendation to customers.

/Sharad


> -Joshua Wright
> Senior Network and Security Architect
> Johnson & Wales University
> Joshua.Wright@jwu.edu
> http://home.jwu.edu/jwright/
>=20
> pgpkey: http://home.jwu.edu/jwright/pgpkey.htm
> fingerprint: FDA5 12FC F391 3740 E0AE BDB6 8FE2 FC0A D44B 4A73
>=20
>=20
> [1] "802.11 Wireless LAN Security White Paper",
> http://www.cisco.com/en/US/netsol/ns110/ns175/ns176/ns178/networking_s
> olutions_white_paper09186a00800b469f.shtml (section 5 - "Cisco LEAP
> Architecture").
>=20
> [2] "Weaknesses in LEAP Challenge/Response",
> http://home.jwu.edu/jwright/presentations/asleap-defcon.pdf.
>=20
> [3] "Dictionary Attack on Cisco LEAP",
> http://www.cisco.com/warp/public/707/cisco-sn-20030802-leap.shtml.

=2D --=20
Sharad Ahlawat
Cisco Product Security Incident Response Team (PSIRT)
http://www.cisco.com/go/psirt
Phone:+1 (408) 527-6087
PGP-key: http://pgp.mit.edu:11371/pks/lookup?op=3Dget&search=3D0xC12A996C
=2D----BEGIN PGP SIGNATURE-----
Comment: PGP Signed by Sharad Ahlawat

iD8DBQE/gw/KGoGomMEqmWwRAh28AKDHwVebQ+tIzarsX/G4a4BlLqc1xQCg95R/
C8isa5c4ZrLUwI5Vp1ToNWc=3D
=3DY6SB
=2D----END PGP SIGNATURE-----