Microsoft pptp vpn vulnerabilities Exploits in Action

© SANS Institute 2000 - 200
                                                5
, Author retains full rights.
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
© SANS Institute 2000 - 200
5                                                                                                                 
Author retains full rights.
59
services that would otherwise be wide open to clear text information sniffing.
SKIP
A technology from Sun Microsystems, RFC 2356 
http://www.faqs.org/rfcs/rfc2356.html
describes SKIP in detail. A (very) brief
summary follows:
RFC 2356 Abstract states 
“…Mobile IP specification makes no provisions 
for securing data traffic…”
[SKIP] 
“…allow a mobile node out on a public sector 
of the internet to negotiate access past a SKIP firewall, and construct a secure 
channel into its home network.” “…our mechanisms…” [also] “…allow a mobile 
node to roam into regions that (1) impose ingress filtering, and (2) use a 
different address space.”
Key parts of SKIP are:
Encryption
•
Authentication
•
Sessionless IP security
•
Mobile, dynamic users may connect (compared to other 
•
technologies that require static peers)
ENSkip
Enskip User’s Guide: 
http://www.tik.ee.ethz.ch/~skip/
details Enskip. A 
(very) brief description follows:
An extension of Sun’s SKIP (RFC 2356) to include strong encryption.
It is under GNU license.
Consider very “Alpha” in code development stage.