Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security FullDisclosure
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: [Full-disclosure] OpenSSH - System Account Enumeration if S/Key is u

from [Brian Eaton] Network Security [Permanent Link]
Subject: Re: [Full-disclosure] OpenSSH - System Account Enumeration if S/Key is used
Date: Tue, 24 Apr 2007 10:06:58 -0400 
On 4/24/07, Stanislaw Klekot <dozzie@dynamit.im.pwr.wroc.pl> wrote:

Look closer to challenge message. There's salt and key number included.
Consider now three logins: first isn't valid account on the target
system, second is valid but without OTP set, and third with OTP set.
First two are indistinguishable for attacker as in these cases system
presents random challenge, but for third account system will present the
same challenge over and over again.

How about that?


Perhaps rather than presenting a random challenge, the challenge could
be based on a hash of the account name used and a per-system salt?

Regards,
Brian

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  [Full-disclosure] rPSA-2007-0081-1 postgresql postgresql-server, rPath Update Announcements
Next by Date:  [Full-disclosure] [ GLSA 200704-21 ] ClamAV: Multiple vulnerabilities, Matthias Geerdsen
Previous by Thread:  Re: [Full-disclosure] OpenSSH - System Account Enumeration if S/Key is used, Stanislaw Klekot
Next by Thread:  Re: [Full-disclosure] OpenSSH - System Account Enumeration if S/Key is used, rembrandt
Indexes:  [Date] [Thread] [Top] [All Lists]