Cisco thwarts WLAN dictionary attack
Great LEAP forward
Posted in Enterprise Security, 15th April 2004 10:43 GMT
Free whitepaper – Solid State Drives and High-Speed Memory
Cisco has responded to the release of a dictionary attack tool by encouraging users to migrate to a new more secure encryption scheme for wireless LANs.
The networking giant acknowledged on Monday that shortcomings with its Lightweight Extensible Authentication Protocol (LEAP) create a mechanism for hackers to extract WLAN access passwords through dictionary attacks. Cisco recommends that customers move onto a more secure protocol called EAP-FAST (Extensible Authentication Protocol-Flexible Authentication via Secure Tunnelling), which is capable of frustrating such attacks.
The recommendation comes after developer Joshua Wright released a tool, called asleap, capable of mounting offline dictionary attack sagainst Cisco LEAP networks. Wright demoed the tool at last August's DefCon but held off its release until Cisco was able to make a fix available.
According to Cisco, creating a strong password policy is the most effective way to mitigate against dictionary attacks. ®
Related stories
Tool dumbs down wireless hacking
Cisco Wi-Fi kit in minor security flap
Snag in next-gen Wi-Fi security unearthed
New WPA wireless security on its way
Free whitepaper – Ensuring service assurance in the new normal
Register Research on: Application Platforms
Secure Mobile Working
The Impact of IT Security Attitudes
The Evolving Security Landscape
The Register's Green Computing Debate
