Syngress - Eleventh Hour Network+ Exam N10-004 Study Guide (11 ...

Network Access Security 137
TACACS+ was the first revision to offer secure communications between
the TACACS+ client and the TACACS+ server. Vulnerabilities and attacks
common with TACACS+ are as follows:
■ The encryption used in TACACS+ is based on a shared secret that is rarely
changed, so a compromise at any point would ultimately expose future
compromises.
■ Birthday attacks The pool of TACACS+ session IDs is not very large;
therefore, it is reasonable that two users could have the same session ID.
■ Buffer overflow Like RADIUS, TACACS+ can fall victim to bufferoverflow
attacks.
■ Packet sniffing The length of passwords can be easily determined by
“sniffing” a network.
■ Lack of integrity checking An attacker can alter accounting records during
transmission because the accounting data is not encrypted during
transport.
EXAM WARNING
Make sure you understand the difference between TACACS and TACACS+. The most important
thing to remember is that TACACS uses UDP as its transport protocol, whereas
TACACS+ uses TCP. Also, TACACS+ is a proprietary version owned by Cisco.
MUTUAL AUTHENTICATION
Mutual authentication is a process where both the requestor and the target entity
must fully identify themselves before communication or access is allowed.
DID YOU KNOW
Characteristics of mutual authentication are as follows:
■ You can share a secret or you can use a Diffie-Hellman key exchange or certificates.
■ To verify the identities, the Certificate Authority (CA) must be known to both parties,
and the public keys for both must be available from the trusted CA.
■ The mutual authentication process is used for access of a user to a network via
remote access or authentication via a RADIUS server.
■ 802.1X and EAP provide for a mutual authentication capability.
■ Mutual authentication assists in the mitigation of attacks from MITM types of
devices.
■ Any of the following EAP methods provide for mutual authentication:
■ TLS requires that the server supply a certificate and establish that it has
possession of the private key.
■ Internet Key Exchange (IKE) requires that the server show possession of a
preshared key or private key (this can be considered certificate authentication).
■ GSS_API (Kerberos) requires that the server can demonstrate knowledge of the
session key.