Re: Probable SSH Vulnerability
On Sun, Jun 15, 2003 at 09:01:00AM +0200, Florian Weimer wrote:
> Tim Peeler <thp@linux00.LinuxForce.net> writes:
>
> > I've come to the conclusion that the SSH1 protocol is the most
> > likely cause of this problem.
>
> Attacks on the SSH v1 protocol are relatively sophisticated. It's
> more likely that some token used for authentication (password, RSA or
> DSA key) has leaked, that a machine used to access the attacked
> machines has itself been compromised (e.g. a home machine of an
> employee), or a trojanized OpenSSH versions exist on your local Debian
> mirror.
>
> Of coure, it _could_ be the protocol, but you would be the first to
> observe attacks on the inherent protocol weaknesses (not
> implementation errors). These attacks require wiretapping and traffic
I've done some research and have seen reports on several "kits"
available to exploit the SSH1 protocol. It's apparent in these
reports (see securityfocus et al.) that these brute force kits
are relatively easy to use (any kiddie can pick one up and use it)
and work through the current versions of ssh (if SSH1 is enabled).
> manipulation capabilities. If the edge networks are trustworthy, you
> face a very powerful adversary. Why do you think you are so special?
Does there have to be a reason? How about: some script kiddie saw
The Matrix Reloaded, noticed Trinity using nmap and "sshnuke"
(fictional program) to break in and decided to try it for him/her
self.
If this is not an SSH1 exploit (for which there /are/ brute force
exploits available), then I don't know why we would be so important
as to warrant an attack. Perhaps someone looking to break in to
our clients' machines? Perhaps the clients are impressive enough
to warrant the attack?
We are still looking at a problem with SSH2 as well, since at least
one of the servers that was attacked used only SSH2. The attack
on these servers could have been due to a stolen key, but not likely.
Reply to: