full-disclosure - Re: OpenSSH User Enumeration Time-Based Attack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <51E053DF.8090004@curesec.com>
Date: Fri, 12 Jul 2013 20:07:11 +0100
From: Curesec Research Team <crt@...esec.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: OpenSSH User Enumeration Time-Based Attack

Am 11.07.2013 16:41, schrieb Jann Horn:
> FYI, the openssh guys have known this for quite a while and they don't
> treat it as an issue worth fixing. They don't want to introduce extra
> anti-timing code just to prevent user enumeration from working.
Oh really?

> By the way: If you can hog the CPU for seconds by sending a few kilobytes
> of data, isn't that a DoS issue?
Yes, you can raise the cpu usage massively. So you can definitly slow
down the system. Maybe it is possible with some more threads to increase
as well memory usage.
Of course you have to constantly sending ssh authentication messages to
the target system to hold up the cpu consumption.

Cheers,

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/