Cisco thwarts WLAN dictionary attack

Great LEAP forward

Cisco has responded to the release of a dictionary attack tool by encouraging users to migrate to a new more secure encryption scheme for wireless LANs.

The networking giant acknowledged on Monday that shortcomings with its Lightweight Extensible Authentication Protocol (LEAP) create a mechanism for hackers to extract WLAN access passwords through dictionary attacks. Cisco recommends that customers move onto a more secure protocol called EAP-FAST (Extensible Authentication Protocol-Flexible Authentication via Secure Tunnelling), which is capable of frustrating such attacks.

The recommendation comes after developer Joshua Wright released a tool, called asleap, capable of mounting offline dictionary attack sagainst Cisco LEAP networks. Wright demoed the tool at last August's DefCon but held off its release until Cisco was able to make a fix available.

According to Cisco, creating a strong password policy is the most effective way to mitigate against dictionary attacks. ®

Related stories

Tool dumbs down wireless hacking
Cisco Wi-Fi kit in minor security flap
Snag in next-gen Wi-Fi security unearthed
New WPA wireless security on its way