IT Jobs
OpenSSH flaw is a hoax warn researchers
The vulnerability that wasn't
By Jeremy Kirk, IDG News Service
Published: 04:03 GMT, 10 July 09
Security researchers have warned that a reported flaw in OpenSSH (Secure Shell) is a probable hoax.
Earlier this week, SANS received an anonymous email claiming of a zero-day vulnerability in OpenSSH, which means a flaw in the software is already being exploited as it becomes public. OpenSSH (Secure Shell), is used by administrators to make encrypted connections with other computers and do tasks such as remotely updating files. OpenSSH is the open-source version, and there are commercial versions of the program.
A true zero-day vulnerability in OpenSSH could be devastating for the Internet, allowing hackers to have carte blanche access to servers and PCs until a workaround or a patch is readied.
"That's why I think people are actually creating quite a bit of a panic," said Bojan Zdrnja, a SANS analyst and senior information security consultant at Infigo, a security and penetration testing company in Zagreb, Croatia. "People should not panic right now. Nothing at this time points that there is an exploit being used in the wild."
The evidence of a true zero-day vulnerability in OpenSSH is weak, Zdrnja said. So far, analysts haven't seen a working exploit, despite worries that a group called Anti-Sec may have found a zero-day that allowed them to control a web server. Details on the hack were posted on Full Disclosure, which is an unmoderated forum for security information.
When pressed for more details, a person claiming to be part of Anti-Sec wrote an e-mail to the IDG news service saying "I'm not allowed to actually discuss the exploit (or whether or not it exists)," which was signed "Anonymous."
Zdrnja said the same group compromised another server recently, but it appeared to be a brute-force attack against OpenSSH. A brute-force attack is where a hacker tries many combinations of authentication credentials in order to get access to a server. If an administrator is using is using simple log-ins and passwords, it makes a server more vulnerable to a brute-force attack, Zdrnja said.
Both of the compromised servers were run by the same person. "I suppose what we are dealing with here are two hackers in a war between themselves," Zdrnja said.
But there are other factors that indicate a zero-day for OpenSSH doesn't exist. If the zero-day existed, hackers would probably be more likely to use it against a more high-profile server than the most recent one that was compromised, Zdrnja said.
One of OpenSSH's developers, Damien Miller, also threw cold water on the possibility of a zero-day. Miller wrote on an OpenSSH forum that he had exchanged mails with an alleged victim of the zero-day, but the attacks appeared to be "simple brute-force."
"So, I'm not persuaded that a zero-day exists at all," Miller wrote. "The only evidence so far are some anonymous rumors and unverifiable intrusion transcripts."
There also seems to be some confusion between the alleged zero-day and a different vulnerability in OpenSSH, Zdrnja said. That vulnerability, which is as of yet unpatched, could allow an attacker to recover up to 32 bits of plain text from an arbitrary block of ciphertext from a connection secured using the SSH protocol in the standard configuration, according to an advisory from the UK's Center for the Protection of National Infrastructure (CPNI).
The severity of the vulnerability is considered high, but the chance of successful exploitation is low, according to CPNI. Zdrnja said administrators can implement stronger authentication mechanisms in OpenSSH using public and private keys to guard against a successful attack. In an advisory, OpenSSH also stated that the possibility of a successful attack was low.
Add your commentComments