Blast-RADIUS attack

WiKID Systems · one year ago · 87 views

We are currently working on a fix for the Blast-RADIUS attack.  It promises to be problematic and may take some time. However, we do use Message-authentication in all our radius transactions, which is a mitigation strategy for Blast-RADIUS: In the meantime, for those environments that must continue to transport RADIUS over UDP, the researchers recommend that both RADIUS clients and servers always send and require Message-Authenticator attributes for all requests and responses using what's known as HMAC-MD5 for packet authentication. For Access-Accept and Access-Reject responses, the Message-Authenticator should be included as the first attribute. All five of the major RADIUS implementations—available from FreeRADIUS, Radiator, Cisco, Microsoft, and Nokia—have updates available that follow this short-term recommendation.