Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security FullDisclosure
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: [Full-disclosure] OpenSSH - System Account Enumeration if S/Key is u

from [Stanislaw Klekot] Network Security [Permanent Link]
Subject: Re: [Full-disclosure] OpenSSH - System Account Enumeration if S/Key is used
Date: Tue, 24 Apr 2007 11:10:27 +0200 
On Sat, Apr 21, 2007 at 02:27:17AM +0200, rembrandt wrote:

As you can see clearly OpenSSH discloses the existence of system accounts.
A possible solution for this problem would be to print a fake S/Key-Request
even for non existing users as well as it`s done with the 
Passwordauthentication.


This issue is known not only for S/Key, but for OPIE (PAM version) as
well, although it's a bit different for the latter.

Look closer to challenge message. There's salt and key number included.
Consider now three logins: first isn't valid account on the target
system, second is valid but without OTP set, and third with OTP set.
First two are indistinguishable for attacker as in these cases system
presents random challenge, but for third account system will present the
same challenge over and over again.

How about that?

-- 
Stanislaw Klekot

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  Re: [Full-disclosure] Apache Illegal Request Handling Possible XSS Vulnerability, Richard Moore
Next by Date:  Re: [Full-disclosure] Apache Illegal Request Handling Possible XSS Vulnerability, Michal Majchrowicz
Previous by Thread:  [Full-disclosure] OpenSSH - System Account Enumeration if S/Key is used, rembrandt
Next by Thread:  Re: [Full-disclosure] OpenSSH - System Account Enumeration if S/Key is used, Brian Eaton
Indexes:  [Date] [Thread] [Top] [All Lists]