Attacks Using the Request Authenticator
There are several possible methods of attack on using the request authenticator portion of a RADIUS packet. In reality, all security in RADIUS is based on these authenticator fields, as they serve as unique and random “identifiers” (not to be confused with the ID field of the packet) for each packet. However, the ultimate security depends on how randomly these authenticators are generated. Most of the inherent security collapses when random number generators are used with cycles that are too short or values that are repeated. In this section, I’ll take a look at some of the more probable attacks a hacker could wage against your systems through the request authenticator.
Repeated request authenticators and the User-Password attribute
It is possible to generate a bank of request authenticators and
corresponding User-Password attributes if a hacker
can sniff traffic on the wire between a RADIUS client and RADIUS
server during a transaction. He can then see if any repeated values
are used for the request authenticator; if they are, he can remove
the shared secret from the first 16 octets of the password. In doing
this, he gets the first 16 octets of two completely unprotected
passwords that are XORed together.
Now, the bottom line here is that the attacker has gotten the first 16 octets unprotected. Most passwords that users choose, unfortunately, aren’t even this long; even if they were, the hacker at least has a firm basis for a later brute-force ...