Subject: [eap] EAP fuzzer

From: Axel Rengstorf <[email-masked]>
Date: Fri, 14 Sep 2007 12:12:31 +0200

Hi,

anybody knows of a tool to test the security of EAP/802.1X implementations,
like a fuzzer ?

Greetings,
Axel

-- 
Axel Rengstorf
IT Security Consultant
Klosterweg 28 / H608
76131 Karlsruhe
Handy +49-176-29 25 69 42

__________________________________________________________________________
Erweitern Sie FreeMail zu einem noch leistungsstärkeren E-Mail-Postfach!		
Mehr Infos unter http://produkte.web.de/club/?mc=021131

_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/eap

Arhives: http://lists.frascone.com/pipermail/eap

---

From: "Bernard Aboba" <[email-masked]>
Date: Sat, 15 Sep 2007 13:27:13 -0700

I'm not aware of any publicly available EAP fuzzing tools.  However, based 
on my experience testing EAP peer, server and authenticator implementations, 
it is quite likely that such a tool would turn up some significant bugs, 
potentially even ones that would enable development of "EAP malware".

>From: Axel Rengstorf <[email-masked]>
>To: [email-masked]
>Subject: [eap] EAP fuzzer
>Date: Fri, 14 Sep 2007 12:12:31 +0200
>
>Hi,
>

---

From: Alan DeKok <[email-masked]>
Date: Sun, 16 Sep 2007 09:07:34 +0200

Bernard Aboba wrote:
> I'm not aware of any publicly available EAP fuzzing tools.  However,
> based on my experience testing EAP peer, server and authenticator
> implementations, it is quite likely that such a tool would turn up some
> significant bugs, potentially even ones that would enable development of
> "EAP malware".

  There is already software that exploits publicly disclosed issues in
EAP implementations.

  And while implementing EAP methods for FreeRADIUS, I've seen client
crashes when the server didn't quite behave as expected.

  Alan DeKok.