oss-sec mailing list archives
Re: /dev/ptmx timing
From: "Dmitry V. Levin" <ldv () altlinux org>
Date: Tue, 8 Jan 2013 06:43:08 +0400
On Mon, Jan 07, 2013 at 08:11:11PM -0500, adam swanda wrote:
Don't you need to be running as root for this to be possible?
You certainly haven't followed the link listed below, have you? The elegance of this timing attack is that all you need is inotify_add_watch(fd, "/dev/ptmx", IN_MODIFY) which is usually available to everybody who has read access to /dev/ptmx.
I know you can use strace to capture keystroke "writes" for any given PID, but unless you want to capture only processes you are running you need to be root or use sudo strace <cmd>. It looks like your PoCs fall into the same category. Following that same logic, if a user has root access, what would they gain by sniffing password character length? Since they can view hashes, change passwords, etc, without this method. I might be completely wrong here but I personally wouldn't classify this as a security issue. Just putting in my own opinion, of course, as a casual reader of this list. On Jan 7, 2013 5:24 PM, "vladz" <vladz () devzero fr> wrote:I noticed that it was possible to measure inter-keystrokes timing thanks to the /dev/ptmx character device. Any local user that is using pseudo-terminal can be targeted. As it may also be used to disclose sensible information such as password length, I was wondering if it should be treat as a security issue? Description + PoC: http://vladz.devzero.fr/013_ptmx-timing.php. No sure right now but I think the only way to solve this is to modify the pts handling at kernel level. Any opinions on that?
-- ldv
Attachment:
_bin
Description:
Current thread:
- /dev/ptmx timing vladz (Jan 07)
- Re: /dev/ptmx timing adam swanda (Jan 07)
- Re: /dev/ptmx timing Dmitry V. Levin (Jan 07)
- Re: /dev/ptmx timing Vasily Kulikov (Jan 07)
- Re: /dev/ptmx timing Dmitry V. Levin (Jan 07)
- Re: /dev/ptmx timing Kurt Seifried (Jan 07)
- Re: /dev/ptmx timing adam swanda (Jan 07)