Vulnerability Note VU#596827
Weaknesses in the SSH protocol simplify brute-force attacks against passwords typed in an existing SSH session
There is a vulnerability in the SSH protocol that can simplify brute force attacks against passwords typed within an existing SSH session.
Researchers at the University of California at Berkeley have determined that by monitoring the delays between SSH packets transmitted across the network, it is possible to make educated guesses about the keystrokes typed by the user. This vulnerability relies primarily upon the fact that in interactive SSH sessions, each keystroke made by the user causes the SSH client to transmit one IP packet to the SSH server. Similarly, as the remote server echoes the typed characters back to the user, the SSH server sends individual IP packets back to the SSH client.
This behavior (which is common to many terminal programs) creates identifiable patterns in the packet data that yield information about the user's activities. For example, as described in the Berkeley paper, if a system administrator logs into a remote Unix system and types the su command to become the superuser, the process will look similar to this:
Since this conversation takes place over an interactive terminal session, "sysadmin@hostname % " will be transmitted as group of characters (most likely in a single data packet), each character in "su" will result in two data packets (one keystroke and one echo), and "Password: " will be transmitted as a single data packet. Then, as the user types the root password, each character typed will result in a single data packet, but an echo will not be sent. This lack of an echo response is trivial to detect within a captured data stream and as a result, the attacker will know exactly which keystrokes (and how many) represent the system's root password. Then, by using the technique documented in the Berkeley paper, it is possible to analyze the delays between each keystroke of the password to simplify a brute-force attack against it.
This vulnerability has some noteworthy limitations that warrant mention
In addition to these limitations, there are a few other factors to consider when judging the severity of this vulnerability. First, this vulnerability does not rely upon a cryptographic flaw; it is based upon a statistical analysis of network traffic that is independent of cipher or SSH protocol version. Second, it is easy to misinterpret this vulnerability as a weakness in the initial SSH login authentication and to conclude that using strong SSH authentication (e.g. RSA) is a defense against this problem. In fact, the initial authentication method is irrelevant. This technique analyzes traffic generated after the initial authentication, and passwords are just one possible type of data that could be analyzed and exposed.
This vulnerability reduces the number of guesses needed to perform brute-force attacks against passwords typed in an existing SSH session.
The CERT/CC is currently unaware of a practical solution to this problem.
Mask echo behavior in terminal programs
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Apple||Affected||-||05 Nov 2001|
|Cisco||Affected||-||28 Sep 2001|
|Conectiva||Affected||-||14 Dec 2001|
|F-Secure||Affected||-||05 Nov 2001|
|Immunix||Affected||-||14 Dec 2001|
|MandrakeSoft||Affected||-||13 Dec 2001|
|Red Hat||Affected||-||14 Dec 2001|
|SSH Communications Security||Affected||-||05 Nov 2001|
|Trustix||Affected||-||14 Dec 2001|
CVSS Metrics (Learn More)
This vulnerability was discovered independently by Solar Designer and Dug Song of The Openwall Project as well as Dawn Xiaodong Song, David Wagner, and Xuqing Tian of the University of California at Berkeley; the CERT/CC thanks both parties for their research and analysis.
This document was written by Jeffrey Lanza.
- CVE IDs: Unknown
- Date Public: 19 Mar 2001
- Date First Published: 28 Sep 2001
- Date Last Updated: 14 Dec 2001
- Severity Metric: 5.77
- Document Revision: 41
If you have feedback, comments, or additional information about this vulnerability, please send us email.