July 2024 - Freeradius-Users - lists.freeradius.org

CRITICAL VULNERABILITY: BlastRADIUS
by Alan DeKok 08 Jul '24

08 Jul '24

If you’re on this mailing list, you need to know about BlastRADIUS. BlastRADIUS is a thirty year-old design flaw in the RADIUS protocol. Exploiting the vulnerability allows an attacker to authenticate anyone to your local network: • Any Multi-Factor Authentication (MFA) can be bypassed • Unknown users can be given network access • Unknown users can be granted administrative login to key networking equipment • Known users can have their traffic redirected to a "honeypot" BlastRADIUS has a CVSS score of 9.0, which is extremely high. This vulnerability affects ALL RADIUS clients and ALL RADIUS servers. It is an issue in the underlying protocol, not any specific implementation. All RADIUS servers are affected and MUST BE UPGRADED as soon as possible. In some cases, it is possible to upgrade clients in a less time critical manner. See our resource hub for more information. https://www.inkbridgenetworks.com/blastradius *** RESOURCES *** freeRADIUS resource page: https://www.freeradius.org/security/ InkBridge Networks BlastRADIUS resource page: https://www.inkbridgenetworks.com/blastradius Official BlastRADIUS site: https://blastRADIUS.fail <https://blastradius.fail/> FREE Webinar TODAY 9am ET with: - Alan DeKok, founder of freeRADIUS and InkBridge Networks CEO - Nadia Heninger, lead cryptographer who discovered the vulnerability Register now: https://alandekok.com/webinar2/ FREE Webinar TODAY 2:00pm ET with Alan DeKok Register now: https://alandekok.com/webinar/ Webinar recordings will be made available if you aren’t able to attend.

1 0

2 IMPORTANT Announcements from Network RADIUS
by Alan DeKok 08 Jul '24

08 Jul '24

**** MAJOR UPDATES BEING ANNOUNCED TOMORROW **** Stay tuned for an important announcement tomorrow regarding some CRITICAL changes you need to know about. We have been working to improve RADIUS security for decades, and we're announcing the results tomorrow. Rest assured that we have been working hard behind the scenes with the community so that everyone is aware of the changes. We’ll be hosting two webinars on Tuesday, July 9th (tomorrow) to explain what is changing.. Both sessions will have similar content, giving background and context for the changes, and information about how you can increase RADIUS security. The first session will have a special guest cryptographer to give some additional background. For both sessions, the intended audience is implementers, system administrators, and people generally familiar with RADIUS. Recordings will be made available if you aren’t able to attend. In short, keep tomorrow open. Be prepared. REGISTER FOR Tuesday, July 9th 9:00am ET. https://alandekok.com/webinar2/ <https://1ae5b3aa-37c8-421a-8a7b-e33cac27e221.mlbtlr.com/p2/G0eViqYKQmazQ_n5…> Alan DeKok, founder of freeRADIUS and CEO of InkBridge Networks (formerly Network RADIUS) and a special cryptographer guest REGISTER FOR Tuesday July 9th, 2:00pm ET. https://alandekok.com/webinar/ <https://1ae5b3aa-37c8-421a-8a7b-e33cac27e221.mlbtlr.com/p2/G0eViqYKQmazQ_n5…> Alan DeKok founder of freeRADIUS and CEO of InkBridge Networks (formerly Network RADIUS) You may also want to check out our RFC for the IETF on deprecating insecure practices in RADIUS: https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/ <https://1ae5b3aa-37c8-421a-8a7b-e33cac27e221.mlbtlr.com/p2/G0eViqYKQmazQ_n5…> *** Network RADIUS has rebranded as InkBridge Networks *** Over the last sixteen years, Network RADIUS has evolved from a freeRADIUS centred consultancy, to one that provides products and services for a wide variety of network protocols. It was time for our brand to reflect our new position as the global leader in foundational network expertise. We are still in the process of migrating our old Network RADIUS site to our new digs at InkBridgeNetworks.com <https://1ae5b3aa-37c8-421a-8a7b-e33cac27e221.mlbtlr.com/p2/G0eViqYKQmazQ_n5…>. You’ll notice some of our pages still link to Network RADIUS site but that won’t be for long. If you have any questions about this, feel free to respond to this email. Visit our new website at https://InkBridgeNetworks.com <https://1ae5b3aa-37c8-421a-8a7b-e33cac27e221.mlbtlr.com/p2/G0eViqYKQmazQ_n5…> Read our press release at: https://alandekok.com/network-radius-becomes-inkbridge-networks-goes-after-… <https://1ae5b3aa-37c8-421a-8a7b-e33cac27e221.mlbtlr.com/p2/G0eViqYKQmazQ_n5…>

1 0

Don't use CHAP or MS-CHAP!
by Alan DeKok 06 Jul '24

06 Jul '24

From https://cybernews.com/security/rockyou2024-largest-password-compilation-lea… ... researchers discovered what appears to be the largest password compilation with a staggering 9,948,575,739 unique plaintext passwords. The only reason that passwords leak is that organizations store clear-text passwords in a database. That approach has been a terrible idea for decades, and this latest leak proves it. With CHAP, passwords *have* to be stored in clear-text in the DB, where attackers can steal them. With PAP, passwords can be stored in "crypted" form. When an attacker steals the DB, the passwords are protected. I've written more in an article on our web site. https://networkradius.com/articles/2022/04/01/pap-vs-chap.html As for MS-CHAP, it can be broken by an attacker with a laptop, in milliseconds. It should be considered to be no more secure than sending clear-text passwords over the wire, without even the protection that RADIUS offers for PAP. Alan DeKok.

1 0

Generating IPs link
by Daniel Garza 03 Jul '24

03 Jul '24

Hello, I was following through the documentation at https://freeradius.org/documentation/freeradius-server/4.0.0/howto/modules/…, and came to the "Generating IPs" section, but it seems the link isn't functioning. Should I be referencing a different link for this documentation? Thanks in advance -- Daniel Garza Network Engineer Netgate IT

2 1