Subject: man in the middle attack with CHAP or MS-CHAP?

From: "Wang, Cliff" <[email-masked]>
Date: Wed, 20 Jun 2001 20:55:17 -0000

Let's say a remote user connects to a RAS concentrator using either PPP or
PPTP.
In the case of PPTP, user has internet access already, but wants to set up a
PPTP
tunnel to his corporate gateway.

He uses CHAP or MS-CHAP to authenticate himself. The RAS concentrator
depends on
an external RADIUS server for authentication verification. There might be
proxy RADIUS servers
between the RAS and the final RADIUS.

My questions are:
1) any man-in-the-middle attack possible between a user and his RAS server?
   Seem to be fairly hard.
2) any man-in-the-middle attack possible between a RAS server and the remote
RADIUS server
    because of RADIUS proxy in the middle?
   If the proxy is compromised, this is possible. But when a proxy is
compromised, the attacker
   can directly issue a fake RADIUS accept response anyway.

What I am looking is that somebody may intercept the challenge and response
and use it
for himself, especially when multiple simultaneous sessions are allowed. But
this may seem
to be extremely difficult because of the one time only nature of the
challenge.

Thanks!