Follow Slashdot blog updates by subscribing to our blog RSS feed


Forgot your password?
Math Security The Internet Science

New Moxie Marlinspike Tool Cracks Crypto Passwords 71

Gunkerty Jeb writes "Moxie Marlinspike, the security and privacy researcher known for his SSLStrip, Convergence and RedPhone tools, has released a new tool that can crack passwords used for some VPNs and wireless networks that rely on encryption using Microsoft's MS-CHAPv2 protocol. Marlinspike discussed the tool during a talk at DEF CON over the weekend, and it is available for download."
This discussion has been archived. No new comments can be posted.

New Moxie Marlinspike Tool Cracks Crypto Passwords

Comments Filter:
  • by winkydink ( 650484 ) * <> on Monday July 30, 2012 @01:16PM (#40819685) Homepage Journal

    but whenever I read his name, my mind keeps wandering to Stephen R. Donaldson novels and off the point he's trying to make.

    • Re: (Score:2, Funny)

      by EdIII ( 1114411 )

      I just keeping thinking it is a Ubuntu release

  • by Anonymous Coward

    He really seems down-to-earth and balanced, and all the stuff he's done have been spot-on so far.

  • so what? (Score:3, Insightful)

    by jehan60188 ( 2535020 ) on Monday July 30, 2012 @01:25PM (#40819813)

    not trying to be brash, or curt or whatever, but can someone explain the larger implications?

    what does this mean for me (the average non-very-savvy-when-it-comes-to-security person)?
    should I stop using tor (is tor pptp?)?
    should I stop using vpn, or wpa wireless networks?

    this actually doesn't seem that interesting, I mean, if you use a cloud-based cracker, couldn't you have submitted the wpa handshake there already?

    • Re:so what? (Score:5, Informative)

      by BagOBones ( 574735 ) on Monday July 30, 2012 @01:32PM (#40819891)

      PPTP is a type of VPN still used by some companies and included with windows...
      MS-CHAPv2 is the default / most common authentication option when using PPTP with windows. Thus organizations still using PPTP for remote access may be at risk.

    • Re: (Score:2, Informative)

      by Anonymous Coward

      If I understand it correctly, one implication is that if you:

      1. use Micrsoft Windows' built-in VPN client (Network Connections -> Connect to...)
      2. to connect to Microsoft Windows' built-in VPN server ("Remote Access")
      3. and someone snifs your traffic (like on a public Starbucks hot-spot)

      then they can decrypt that VPN traffic.

      One would assume that usage of Microsoft's built-in stuff is pretty prevalent, so the implications of this are pretty big.

      • by Sir_Sri ( 199544 )

        One would assume that usage of Microsoft's built-in stuff is pretty prevalent, so the implications of this are pretty big.

        so too then is it relatively easy to replace, with a windows update rollout.

      • by Amouth ( 879122 )

        if it was only reading the VPN traffic i wouldn't be worried about it so much. the larger implication is that it derives the user credentials.

        having on the session traffic leaves it open to only momentary chance that the person would get some juicy data.. but having the user credentials allows for far more issues.

    • Re:so what? (Score:5, Informative)

      by skids ( 119237 ) on Monday July 30, 2012 @04:07PM (#40821639) Homepage

      For VPN use IPSEC, not PPTP, either with certificate-based outer tunnel, or with an outer tunnel using a PSK that you trust will not be compromised. The latter is near impossible in enterprise setups, so the certificate approach is superior, albeit harder to administer.

      WPA2-PSK is insecure due to a separate issue entirely (see Firesheep).

      For WPA2-Enterprise the MSCHAPv2 session is usually wrapped in a PEAP (SSL) session. This should be safe as long as your client is configured to validate the server-side certificate only against CAs that are not likely to be compromised (i.e. a rougue cert generated). Preferably, one should also validate the certificate's subject (usually the name of the RADIUS server). If this is not the case (and Apple makes this particularly hard, especially on the new Lion setup that requires an 802.1x profile generated by a Lion Server installation) then an MITM attack is possible, where someone pretends to be your AP+RADIUS, and since your client does not check the certificate they offer, it will happily start the MSCHAPv2 session with them, at which point the exchange becomes vulnerable to attempts to hijack it.

      WPA2 using EAP-TLS with certificates is safe, but does not offer the ability to check user passwords, so it is usually only favored by institutions that do not worry too much about stolen equipment. (Given that everyone seems happy to let the OS remember their passwords, however, the added benefits of the password becomes dubious.) WPA2 with EAP-TTLS should be unaffected by any of this. The precautions about validating server certs remain relevant, however.

      It is possible to configure WPA2-Enterprise with just a raw MSCHAPv2 exchange and no protective PEAP wrapper around it. That would be what the OP's tool is for. It would also be completely insane, and given many native clients do not support that, rather a lot of effort to invest in being insane.

      • by GSloop ( 165220 )

        WPA2-PSK is insecure due to a separate issue entirely (see Firesheep).

        Citation needed.

        Not to be harsh, but WPA2-PSK has NOTHING to do with firesheep. JUST NOTHING.

        Firesheep is a takover of a non SSL wrapped session. So, someone on a non-switched ethernet network can take-over a session. Same is true for any shared medium network, like wireless.However, since WPA2 uses weak individual session encryption you can perhaps determine the PWMK and then sniff all other sessions.

        But to determine the PWMK you need

        • by GSloop ( 165220 )

          To amplify that:

          If the attacker already knows the PSK, then your whole network is screwed and individual session security, while important, becomes far less important.

          So, yes, individual sessions are important - but this really isn't any/much different than ARP poisoning on a switched network. You shouldn't rely on such methods for real security.

          However, for small networks - ergo home/small business networks - using WPA2-PSK is perfectly fine - just be careful who you share the key with, just like you'll be

        • by skids ( 119237 )

          I'm sorry, for some reason I misremembered that the Tews/Beck WPA-PSK cracking material had been integrated with Firesheep. I was thinking of the latter.

  • this is the same (Score:5, Interesting)

    by nimbius ( 983462 ) on Monday July 30, 2012 @01:27PM (#40819853) Homepage
    poor guy who is actually more well renound for deciding to help wikileaks and spending most of his 2010 travel itinerary detained and threatened by customs agents.

    for me, he falls somewhere between hero and legend. im certain for the government he falls somewhere between drone strike and gulag.
    • poor guy who is actually more well renound for deciding to help wikileaks and spending most of his 2010 travel itinerary detained and threatened by customs agents.

      for me, he falls somewhere between hero and legend. im certain for the government he falls somewhere between drone strike and gulag.

      Are the Russians interested, or do you mean Guantanamo?

  • Build a better lock, someone will learn to open it, That's it then. Time for everybody in the world to go on the honor system! (And NO crossing your fingers/toes.)
  • DES has been well known for vulnerabilities for some time. I don't know of many businesses using MS PPTP for remote VPN because it is usually cheaper and easier to just purchase licenses from their firewall / gateway vendor. Certainly no company with strong crypto needs such as HIPAA, PCI, and similar compliance are using anything but dedicated VPN appliances with AES or similar based encryption. Heck, most of those have moved to 2-factor authentication and are using at least TLS 1.0 / SSL 3.0 at layer 4

    • Re:Nice hack, but... (Score:5, Informative)

      by Anonymous Coward on Monday July 30, 2012 @01:47PM (#40820043)

      Actually, lots of companies still use MS PPTP precisely because it's cheaper and easier than the alternatives. MS PPTP server is built into RRAS, so it's free, and the client is built into every version of Windows since XP.

    • by swb ( 14022 )

      I've worked with more than one company that has wanted to actually return to using PPTP after bad experiences with IPSec client VPNs.

      It's typically because the client software blows or isn't available on their platform or hasn't been updated for an OS rev change (we saw this with Vista/Win7).

      Most of these were small shops that couldn't afford the freight on a dedicated VPN setup and were stuck with whatever their firewall would do. Cisco's IPSec implementation seems widely supported, but you have to be wi

      • by Eskarel ( 565631 )

        I've had great success with shrewsoft [] Has worked for me with a few different VPN vendors and it's available in 32 and 64 bit for a bunch of platforms. Works better for me than the CISCO client.

        • Odd, I've used Shrewsoft on a few vendor's firewalls and run into all manner of incompatibilities. I suppose once you figure out all the quirks for a given device, you would be solid to deploy elsewhere.

          On the small scale, I would probably opt for an OpenVPN setup, perhaps on a VM hosted on the base server for insulation. It's easier to setup a fresh server and client than shrewsoft's client in my experience.

  • by MyLongNickName ( 822545 ) on Monday July 30, 2012 @01:43PM (#40820005) Journal

    I read the headline and wondered why a crack was released for Ubuntu only and such an old version...

  • I have to send my handshake file on that website ? Isn't that unsecure ? The website owner could keep the data and do whatever he wants with it ?
  • by Anonymous Coward

    I know that security people who build these things get vexed whenever a vulnerability is posted in the wild along with a cracking mechanism, but so often in the past we have seen security researchers have the cops called on them for notifying companies in advance (as if they were a shakedown racket demanding money). And its either that, or they ignore the vulnerability researcher till the 'post in the wild'. Better to post right away, get it out in the open, and move on. Many companies behave identically

    • by TheCarp ( 96830 )

      Very true (also true about sunlight being a great disinfectant, at least, if you are not trying to use it through UV blocking glass :)

      I remember, what a decade ago? It used to be different. You used to see anouncements that said "This vulnerability was given to so and so on date X, they worked out a patch, now here is the full vulnerability". Or "This was sent on X date, it was ignored, They ignored several warnings, here it is".

      Sure sometimes someone just released a vulnerability without any of this dilige

  • Who uses MS-CHAPv2? (Score:5, Interesting)

    by D3 ( 31029 ) <daviddhenning@[ ] ['gma' in gap]> on Monday July 30, 2012 @02:05PM (#40820277) Journal
    I was there and he answered this in his talk. There were hundreds of VPN services that still supported using it. He pointed out that iPredator (VPN service for the Pirate Bay) ONLY supports MS-CHAPv2. The ubiquity of use and support has created a loop where people keep using it (another point of his talk).
  • When using DES or a similar broken algorithm to secure communications you subject yourself to the the weaknesses of that algorithm. DES has been broken since the advent of the Core 2 from Intel or the FX series from AMD. Basically as Moore's Law pushes computing power ever further it also obsoletes weaker encryption algorithms. This is true for all crypto systems that are based on the use of the Discrete Logarithim Problem; It's based on the fact that it's difficult to compute large prime numbers. (ie; NP-H
  • OK, so what does it cost to buy 12-24 hrs of time on this FPGA set? Their dictionary attack service is $17/20 minutes on commodity hardware. At that rate this attack would cost $25K and I care much less about it than if the attack costs $25.

    • by yuhong ( 1378501 )

      $200 was the price I saw in most report.

  • Having just implemented a PEAP-TLS (mutual-certificate based authentication), I can say that what I really want is a combination PEAP-TLS-MSCHAPv2 solution (which doesn't exist to my knowledge). I want mutual-certificate authentication (proving a "Corporate Issue" device which has a typical-end-user non-exportable private key is in use, effectively "something you have"', especially on encrypted drives with no user admin-access) wrapping around a MSCHAPv2 authentication of username/password pairs. While ce

Q: How many IBM CPU's does it take to execute a job? A: Four; three to hold it down, and one to rip its head off.