full-disclosure - Re: PuTTY private key passphrase stealing attack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 03 Jun 2010 14:18:51 +0200
From: Jan Schejbal <jan.mailinglisten@...glemail.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: PuTTY private key passphrase stealing attack

Am 02.06.2010 21:41, schrieb Joachim Schipper:
> But note that someone with access to a single account could use this to
> gain the password for that account, and hence possibly sudo access.

The attack, as suggested by me, is about passphrases for private keys 
that should never get transmitted to the server.

Gruß
Jan

-- 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/