nerdexam
GIAC

GPEN · Question #16

Which of the following statements are true about MS-CHAPv2? Each correct answer represents a complete solution. Choose all that apply.

The correct answer is B. It can be replaced with EAP-TLS as the authentication mechanism for PPTP. C. It provides an authenticator-controlled password change mechanism. D. It is subject to offline dictionary attacks.. MS-CHAPv2 is a connection-oriented mutual authentication protocol used with PPTP that supports password change mechanisms but contains well-known cryptographic weaknesses enabling offline attacks.

Exploitation & Post-Exploitation Techniques

Question

Which of the following statements are true about MS-CHAPv2? Each correct answer represents a complete solution. Choose all that apply.

Options

  • AIt is a connectionless protocol.
  • BIt can be replaced with EAP-TLS as the authentication mechanism for PPTP.
  • CIt provides an authenticator-controlled password change mechanism.
  • DIt is subject to offline dictionary attacks.

How the community answered

(62 responses)
  • A
    19% (12)
  • B
    81% (50)

Why each option

MS-CHAPv2 is a connection-oriented mutual authentication protocol used with PPTP that supports password change mechanisms but contains well-known cryptographic weaknesses enabling offline attacks.

AIt is a connectionless protocol.

MS-CHAPv2 is connection-oriented, operating within PPTP which establishes a persistent tunnel - it is not a connectionless protocol like those built on UDP.

BIt can be replaced with EAP-TLS as the authentication mechanism for PPTP.Correct

EAP-TLS can be configured as a replacement for MS-CHAPv2 as the inner authentication method within PPTP tunnels, substituting certificate-based mutual authentication for the weaker password-based exchange.

CIt provides an authenticator-controlled password change mechanism.Correct

MS-CHAPv2 includes an authenticator-controlled password change mechanism defined in RFC 2759, allowing the authenticating server to mandate a password update during the authentication handshake.

DIt is subject to offline dictionary attacks.Correct

MS-CHAPv2 challenge and response values captured from network traffic can be subjected to offline dictionary or brute-force attacks, a well-documented weakness that tools such as asleap actively exploit.

Concept tested: MS-CHAPv2 authentication properties and known vulnerabilities

Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-chap/4740bf05-6b67-40ee-872b-e0a30f526f9e

Topics

#MS-CHAPv2#PPTP#EAP-TLS#dictionary attack

Community Discussion

No community discussion yet for this question.

Full GPEN Practice