openssh unix dev - Feb 2004 - a story of compromise and an idea

There is a cluster of machines which I have an account on which was
recently compromised. the machines have thousands of users and the only
access is via ssh. 

via some mechanism (probably a weak password) the attacker was able to
compromise a single account and use a local-root exploit to hijack lots
of ssh-agents and any unpassword protected keys. they next tried to
repeat the process for every machine in the 'known_hosts' file for each
compromised account. 

of course, all this was automated and they quickly built a nice spanning
tree of cracked machines. (fortunately, I was paranoid enough to avoid
being hit, but many others weren't).

I was thinking that it would be a useful option to store a hash of the
host/ip in known_hosts rather than the host/ip in plaintext so that
there is not an immediate list of candidate machines to crack once an
account is compromised. in the case of possible key-compromise, anything
that slows down the attack long enough for you to hear about it and
re-key is a good thing.  Plus, as a privacy thing, one might not want a
list of the machines they connect to so obviously logged.

One might argue that this is security via obscurity, but a list of other
machines you connect to and probably use the same ssh key or password on
is real and very useful information to a cracker, and the idea is to
slow down an automated attack long enough to avoid logging into the
affected machine and rekey your other accounts before they find you.

It should be an option, since some people use their known_hosts as a
source of information for things like zsh completion, but for the
extra-paranoid or privacy conscious I think it would be a very practical
and simple change.

please respond to both me and the list as I am not subscribed.

        John
-- 
---------------------------------------------------------------------------
John Meacham - California Institute of Technology, Alum. - john at foo.net
---------------------------------------------------------------------------

On Fri, 20 Feb 2004, John Meacham wrote:
[..]
>
> I was thinking that it would be a useful option to store a hash of the
> host/ip in known_hosts rather than the host/ip in plaintext so that
> there is not an immediate list of candidate machines to crack once an
> account is compromised. in the case of possible key-compromise, anything
> that slows down the attack long enough for you to hear about it and
> re-key is a good thing.  Plus, as a privacy thing, one might not want a
> list of the machines they connect to so obviously logged.
>
Sure there is.. commandline history and last login history.  Both can be
checked automaticly.  None of which are affected by having some hashed
known_host file and at least one is OUT of your control.

To say nothing about existing sessions that are active.

- Ben

On Fri, 20 Feb 2004, John Meacham wrote:
> I was thinking that it would be a useful option to store a hash of the
> host/ip in known_hosts rather than the host/ip in plaintext so that
> there is not an immediate list of candidate machines to crack once an
> account is compromised. in the case of possible key-compromise, anything
> that slows down the attack long enough for you to hear about it and
> re-key is a good thing.  Plus, as a privacy thing, one might not want a
> list of the machines they connect to so obviously logged.
I don't think that this would by you much - if an attacker has root on a 
machine, they can trawl lastlog, shell history files, netstat and ps to 
find this information pretty quickly. 

I'd instead recommend that you encourage the use of the "ssh-add
-c"
option for users. If they aren't running the agent on the compromised 
machine itself, then they should notice unauthorised use of the agent and 
out-of-hours key theft would be impossible.

-d