Algorithms to be used later the attacker can force

Info iconThis preview shows page 1. Sign up to view the full content.

View Full Document Right Arrow Icon
This is the end of the preview. Sign up to access the rest of the document.

Unformatted text preview: ters exchanged by server and client can be substituted in the beginning of a connection. (algorithms to be used later) The attacker can force the client to initialize a SSH1 connection instead of SSH2. n The server replies in this way: SSH-1.99 -- the server supports ssh1 and ssh2 SSH-1.51 -- the server supports ONLY ssh1 n The attacker makes a filter to replace “1.99” with “1.51” Possibility to circumvent known_hosts IIT Kanpur Hacker’s Workshop 2004 23, 24 Feb 2004 58 Downgrade attack examples IPSEC Failure Block the key material exchanged on the port 500 UDP End points think that the other cannot start an IPSEC connection If the client is configured in rollback mode, there is a good chance that the user will not notice that the connection is in clear text IIT Kanpur Hacker’s Workshop 2004 23, 24 Feb 2004 59 Downgrade attack examples PPTP attack (1) During negotiation phase n n n Force PAP authentication (almost fails) Force MS-CHAPv1 from MS-CHAPv2 (easier to crack) Force no encryption Force re-negotiation (clear text terminate-ack) n n Retrieve passwords from existing tunnels Perform previous attacks Force “password change” to obtain password hashes n n Hashes can be used directly by a modified SMB or PPTP client MS-CHAPv2 hashes are not useful (you can force v1) IIT Kanpur Hacker’s Workshop 2004 23, 24 Feb 2004 60 Downgrade attack examples PPTP attack (2) Force PAP from CHAP start Server req | auth | chap MITM Client req | auth | fake nak | auth | pap nak| auth | chap req | auth | pap req | auth | pap ack | auth | pap ack | auth | pap We don’t have to mess with GRE sequences... IIT Kanpur Hacker’s Workshop 2004 23, 24 Feb 2004 61 Downgrade attack examples L2TP rollback L2TP can use IPSec ESP as transport layer (stronger than PPTP) By default L2TP is tried before PPTP Blocking ISAKMP packets results in an IPSec failure Client starts a request for a PPTP tunnel (rollback) Now you can perform PPTP previous attacks IIT Kanpur Hacker’s Workshop 2004 23, 24 Feb 2004 62...
View Full Document

This document was uploaded on 03/17/2014 for the course CS 393 at NYU Poly.

Ask a homework question - tutors are online