A recent discovery by a research team led by University of California San Diego computer scientists has revealed vulnerabilities in the Remote Authentication Dial-In User Service (RADIUS) protocol, dating back to 1991. The team identified a vulnerability called Blast-RADIUS, which could potentially expose networked devices to attacks and allow unauthorized access to an organization’s network.
The findings, presented at the USENIX Security 2024 conference, have prompted over 90 vendors to release patches and issue security bulletins to address the issue. The researchers emphasize the importance of system administrators checking for patches and implementing updated configuration options to mitigate the risk.
“This is among the largest and most complex vulnerability disclosure processes that we have been involved in,” said Nadia Heninger, a professor at UC San Diego. The team highlighted the gap between those who deploy protocols like RADIUS and those who study them, underscoring the need for greater collaboration in addressing security vulnerabilities.
The vulnerability stems from the use of an insecure construction based on the MD5 hash function, which has been known to be compromised for two decades. Despite this, the RADIUS protocol was not updated when MD5 was broken in 2004, leading to potential security risks.
The research team includes experts from Cloudfare, Centrum Wiskunde & Informatica, BastiionZero, and Microsoft Research. Their work sheds light on the importance of ongoing security analysis and updates in critical protocols like RADIUS to ensure the protection of networked devices and services.