Blast RADIUS: a critical security vulnerability

BlastRADIUS is a thirty year-old design flaw in the RADIUS protocol.  Exploiting the vulnerability allows an attacker to authenticate anyone to your local network:

• Any Multi-Factor Authentication (MFA) can be bypassed
• Unknown users can be given network access
• Unknown users can be granted administrative login to key networking equipment
• Known users can have their traffic redirected to a “honeypot”

BlastRADIUS has a CVSS score of 9.0, which is extremely high.  Alan DeKok and Nadia Heninger are literally the world experts on Blast RADIUS. They will explain what BlastRADIUS is, who is at risk, and how to protect yourself. The audience for this webinar is implementers, system administrators, and people generally familiar with RADIUS. Alan DeKok is the CEO of Network RADIUS and the founder of the FreeRADIUS open source project. Alan DeKok first signaled the alert for this security flaw in 1998, and wrote an RFC for the IETF with a proposal to address it in 2007. After the exploit was developed by Nadia’s team, all RADIUS vendors have followed our vendor guide to update their products. The RADIUS standards will be updated based on the RFC document Alan DeKok authored for the IETF. See the InkBridge Networks BlastRADIUS resource page. Nadia Heninger is an Associate Professor of cryptography at UC San Diego. She led the team that discovered the Blast RADIUS vulnerability  The session will be 60 min. We will start with a 30 min presentation and leave the remaining time for Q&A.