Cisco thwarts WLAN dictionary attack
Great LEAP forward
Cisco has responded to the release of a dictionary attack tool by encouraging users to migrate to a new more secure encryption scheme for wireless LANs.
The networking giant acknowledged on Monday that shortcomings with its Lightweight Extensible Authentication Protocol (LEAP) create a mechanism for hackers to extract WLAN access passwords through dictionary attacks. Cisco recommends that customers move onto a more secure protocol called EAP-FAST (Extensible Authentication Protocol-Flexible Authentication via Secure Tunnelling), which is capable of frustrating such attacks.
The recommendation comes after developer Joshua Wright released a tool, called asleap, capable of mounting offline dictionary attack sagainst Cisco LEAP networks. Wright demoed the tool at last August's DefCon but held off its release until Cisco was able to make a fix available.
According to Cisco, creating a strong password policy is the most effective way to mitigate against dictionary attacks. ®