[ILUG] SSH dictionary attacks.

[paul at clubi.ie]

On Thu, 24 Aug 2006, kevin lyda wrote:

> ok, yes, but there's a major difference: in general the user's ssh 
> key is not accessible directly via the net;

Hmm, that's a sweeping generalisation. What makes you say that?

I'd actually say that the presence of ssh secret keys on a computer 
means the computer *will* be connected to the internet (regularly or 
permanently).

> if i want to use paul's key to break into server target.com.ie i 
> have to go find paul's key.  where is that?  and once i figure out 
> that it's on laptop x that is usually behind a firewall, how do i 
> get to it?

Simple: You steal the laptop.

But most 'breaks' are not targetted but opportunistic. Worms and 
crackers target insecure hosts, not specific domains. If that then 
offers up pass-phraseless keys to more secure hosts..

> in my mind that's a big win.

You realise that the reason they had to change the known_hosts file 
to store hashes of hosts (rather than hostnames/IPs directly) was 
because of SSH 'worms' exploiting pass-phraseless secret keys and 
using known_hosts to find which remote host they "opened the door" 
to?

I bet though most long-time users still have lots of 'plain' 
hostnames and IPs in their known_hosts files.

regards,
-- 
Paul Jakma	paul at clubi.ie	paul at jakma.org	Key ID: 64A2FF6A
Fortune:
You are not my son!

  		-- Homer Simpson
  		   Boy-Scoutz n the Hood