Re: OpenSSH User Enumeration Time-Based Attack

[Curesec Research Team <crt () curesec com>]

Am 11.07.2013 16:41, schrieb Jann Horn:
> FYI, the openssh guys have known this for quite a while and they don't
> treat it as an issue worth fixing. They don't want to introduce extra
> anti-timing code just to prevent user enumeration from working.
Oh really?

> By the way: If you can hog the CPU for seconds by sending a few kilobytes
> of data, isn't that a DoS issue?
Yes, you can raise the cpu usage massively. So you can definitly slow
down the system. Maybe it is possible with some more threads to increase
as well memory usage.
Of course you have to constantly sending ssh authentication messages to
the target system to hold up the cpu consumption.

Cheers,

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/