The Register®

Original URL: http://www.theregister.co.uk/2004/04/15/cisco_wlan_snafu/

Cisco thwarts WLAN dictionary attack

Great LEAP forward

By John Leyden

Posted in Enterprise Security, 15th April 2004 10:43 GMT

Free whitepaper – Solid State Drives and High-Speed Memory

Cisco has responded [1] to the release of a dictionary attack tool by encouraging users to migrate to a new more secure encryption scheme for wireless LANs.

The networking giant acknowledged on Monday that shortcomings with its Lightweight Extensible Authentication Protocol (LEAP [2]) create a mechanism for hackers to extract WLAN access passwords through dictionary attacks. Cisco recommends that customers move onto a more secure protocol called EAP-FAST (Extensible Authentication Protocol-Flexible Authentication via Secure Tunnelling), which is capable of frustrating such attacks.

The recommendation comes after developer Joshua Wright released a tool, called asleap, capable of mounting offline dictionary attack sagainst Cisco LEAP networks. Wright demoed the tool at last August's DefCon but held off its release until Cisco was able to make a fix available.

According to Cisco, creating a strong password policy [3] is the most effective way to mitigate against dictionary attacks. ®

Related stories

Tool dumbs down wireless hacking [4]
Cisco Wi-Fi kit in minor security flap [5]
Snag in next-gen Wi-Fi security unearthed [6]
New WPA wireless security on its way [7]