What are the risks with PPTP (MS-CHAPV1/V2)? Are the only ways that it can be exploited are if someone already has access to the network and can ARP poison etc or capture packets some way? Or can it be exploited with it only being open to the internet, RCE wise, or letting people capture packets for further decoding etc?
1 Answer
MS-CHAP is completely insecure and has practical attacks. The protocol in many ways resembles NTLMv1.
Both protocols use unsalted, uniterated MD4 hashes of the password (secure password hashing requires a secure salt and effectively requires some sort of iteration) and the encryption of a challenge with DES using the hash as the key. The attack on this stage of the protocol requires about USD 20 to perform and there are sites offering it at this price. In addition, MD4 and single DES are completely obsolete and MD4 has been known to be insecure since 1995. There is no justifiable reason to continue using it.
You should assume that if anyone can see a single exchange, they can break the protocol, so you should not use it. It is actually a better idea to send an encrypted password over a secure connection (e.g., using PAP and EAP-TTLS) because then the password can be stored securely on the server side.
