BlastRADIUS is a Blast From the Past: New Attack Shatters Decades-Old Network Security

A recently discovered vulnerability, dubbed "BlastRADIUS," or CVE-2024-3596 threatens to wreak havoc on networks worldwide. This attack exploits a fundamental flaw in the Remote Authentication Dial-In User Service (RADIUS) protocol, a cornerstone of network security for over 30 years. The problem being MD5, yes you heard right MD5.

What is RADIUS?

RADIUS acts like a gatekeeper, authenticating users and devices before granting them access to a network. Imagine a business with a secure Wi-Fi network. When you try to connect, your device sends its credentials (like a password) to a RADIUS server. The RADIUS server verifies these credentials and decides whether to grant access.

The RADIUS protocol also uses MD5 hashed requests and responses when performing the authentication on a device, to verify the authenticity of the request and response in the handshake, this is where the issue lies.

The BlastRADIUS Threat

The BlastRADIUS attack exploits a known MD5 collision attack which has been known since around 2003 to allow a malicious actor, positioned between a device and the RADIUS server (think "man-in-the-middle"), to forge a valid access message. They then use hardware available today (GPU's or FPGA's or other modern systems) to quickly generate a MD5 collision and inject the forged packet back to the device. This essentially tricks the device into believing the attacker is authorized, granting them access to the network – all without needing a valid password.

Why is BlastRADIUS so Serious?

Here's what makes BlastRADIUS so concerning:

• Widespread Impact: RADIUS is extensively used in corporate networks, internet service providers (ISPs), and telecom companies. A successful attack could grant access to sensitive data or disrupt critical services.
• Exploiting a Legacy Flaw: The vulnerability stems from the way RADIUS handles authentication, making it a design flaw impacting all RADIUS implementations.
• No Easy Fix: Patching individual devices might not be enough. Organizations likely need to upgrade RADIUS servers and potentially implement additional security measures like encryption protocols.

Protecting Yourself from BlastRADIUS

While a definitive fix is still under development, here are some steps to mitigate the risk:

• Stay Informed: Keep yourself updated on the latest patches and advisories from RADIUS server vendors and device manufacturers.
• Prioritize Updates: Apply security patches promptly, especially those addressing RADIUS vulnerabilities.
• Consider Encryption: Explore implementing encryption protocols like TLS or IPSec to secure communication between RADIUS clients and servers.

The BlastRADIUS attack serves as a stark reminder of the importance of continuous vigilance in cybersecurity. By staying informed, applying updates, and exploring additional security measures, organizations can fortify their defenses against this and future threats.