4 ms·

Whilst I don't wish to rain on the author's parade, but from the final screenshot (and what I suspected), they're running these tools as Administrator (root), s

Whilst I don't wish to rain on the author's parade, but from the final screenshot (and what I suspected), they're running these tools as Administrator (root), so they're pretty well elevated privilege-wise. If an attacker has gotten that far on your machine then it's game over even before they start noodling around with the DPAPI to steal keys. I'd love to know (I don't have a suitable machine available at the moment) if they can pull this off as a regular user, my feeling is probably not.

userbinator 6y ago
Raymond Chen had a good article about people who do things like this and call them vulnerabilities: https://devblogs.microsoft.com/oldnewthing/20150923-00/?p=91531 https://devblogs.microsoft.com/oldnewthing/20150923-00/?p=91...
pletnes 6y ago
If you’re admin, can’t you just rsync the .ssh directory and be done with it?
- speedgoose 6y ago
  The private keys can be protected by passphrases.
  - crazydoggers 6y ago
    Which I can get as admin by installing a program to read your key presses
Arnavion 6y ago
The key is being read from HKCU. That hive is ACLed to you. You don't need admin to read it, but it also isn't a privilege escalation of any sort since it's your hive to read in the first place.
jrm4 6y ago
So, then, this still strikes me as bad in a different way, it contributes to the Windows-esque habit of presuming to know whats best for the user -- even when the user is an "administrator." It seems as if the Linux approach is more honest. "You're root? Okay, you can have access to your SSH-keys. Be careful."
- teh_klev 6y ago
  Well that behaviour can still be configured on Windows with not much effort provided your sysadmins RTFM. It's about how well you secure your machines, regulate behaviour and ensure good platform hygiene, the OS you're running is irrelevant. I speak as a platform agnostic shared hoster guy who managed fleets of Windows and Linux environments, all public facing, and inherited an unholy security mess many years ago, both Windows and Linux, and had to unfuck it all. I could go into detail for the curious.
  - azalemeth 6y ago
    I'm curious. Can you tell us more? While the plural of anecdotes isn't data, I'd like to know some examples of "the good, the bad and the ugly" on both OS fronts.
- formerly_proven 6y ago
  > It seems as if the Linux approach is more honest. "You're root? Okay, you can have access to your SSH-keys. Be careful." Actually even root will get plenty of permission denied errors on a Linux system configured for security.
- Dylan16807 6y ago
  There are three things in the way of getting the keys, and they all seem honest to me. 1. You need admin access to reach the data. 2. The user has to have entered their password to allow DPAPI to unencrypt the data. 3. The data is stored in a binary form because that was the most convenient. The DPAPI stuff wasn't just obfuscation, if that's what you're thinking. The steps you need are going to look roughly the same if you want to access someone's encrypted files on linux. It doesn't transparently decrypt the data, but that's because the encryption isn't built into the registry, not because it's trying to keep it away from you.
kerng 6y ago
There is an entire research area called offensive security which includes what is possible and what actions stay undetected. Attacker might be root/admin on this machine and gaining access to more creds allows the adversary to move to other machines. So in a sense we know its possible but unless someone abuses these things to demonstrate it, organizations won't care or be able to detect compromises and lateral movement. Real world adversaries do these things, most notably was when Google was throughly compromised by a foreign nation state for instance. Also, it gets even more interesting for malware if its running on a bastion host because then malware has access to all the forwarded keys!
- teh_klev 6y ago
  I totally take your point, especially the second paragraph, and agree. Maybe it's the deep cynic in me that tends to read these articles as another "oh look Windows bad" write up, rather than analyse what can happen if a stealthy attacker gains access to your machine and covers their footprints. These write ups get passed around in a sensationalised manner with very little thought about or understanding that the OS was functioning correctly given their user privileges.
djeiasbsbo 6y ago
I agree... the whole point is that admin/root can do everything. SSH agent hijacking is as easy as setting the SSH_AUTH_SOCK variable to that of any logged in user. This is why enabling ssh agent forwarding is something that should be evaluated on a per connection basis. You don't want to forward the agent holding your home keys to your work machine where someone else has root access. But then again, the author didn't claim to do anything special, it was just a little demonstration.

userbinator 6y ago

Raymond Chen had a good article about people who do things like this and call them vulnerabilities: https://devblogs.microsoft.com/oldnewthing/20150923-00/?p=91531 https://devblogs.microsoft.com/oldnewthing/20150923-00/?p=91...

pletnes 6y ago

If you’re admin, can’t you just rsync the .ssh directory and be done with it?

speedgoose 6y ago
The private keys can be protected by passphrases.
- crazydoggers 6y ago
  Which I can get as admin by installing a program to read your key presses

Arnavion 6y ago

The key is being read from HKCU. That hive is ACLed to you. You don't need admin to read it, but it also isn't a privilege escalation of any sort since it's your hive to read in the first place.

jrm4 6y ago

So, then, this still strikes me as bad in a different way, it contributes to the Windows-esque habit of presuming to know whats best for the user -- even when the user is an "administrator." It seems as if the Linux approach is more honest. "You're root? Okay, you can have access to your SSH-keys. Be careful."

teh_klev 6y ago
Well that behaviour can still be configured on Windows with not much effort provided your sysadmins RTFM. It's about how well you secure your machines, regulate behaviour and ensure good platform hygiene, the OS you're running is irrelevant. I speak as a platform agnostic shared hoster guy who managed fleets of Windows and Linux environments, all public facing, and inherited an unholy security mess many years ago, both Windows and Linux, and had to unfuck it all. I could go into detail for the curious.
- azalemeth 6y ago
  I'm curious. Can you tell us more? While the plural of anecdotes isn't data, I'd like to know some examples of "the good, the bad and the ugly" on both OS fronts.
formerly_proven 6y ago
> It seems as if the Linux approach is more honest. "You're root? Okay, you can have access to your SSH-keys. Be careful." Actually even root will get plenty of permission denied errors on a Linux system configured for security.
Dylan16807 6y ago
There are three things in the way of getting the keys, and they all seem honest to me. 1. You need admin access to reach the data. 2. The user has to have entered their password to allow DPAPI to unencrypt the data. 3. The data is stored in a binary form because that was the most convenient. The DPAPI stuff wasn't just obfuscation, if that's what you're thinking. The steps you need are going to look roughly the same if you want to access someone's encrypted files on linux. It doesn't transparently decrypt the data, but that's because the encryption isn't built into the registry, not because it's trying to keep it away from you.

kerng 6y ago

There is an entire research area called offensive security which includes what is possible and what actions stay undetected. Attacker might be root/admin on this machine and gaining access to more creds allows the adversary to move to other machines. So in a sense we know its possible but unless someone abuses these things to demonstrate it, organizations won't care or be able to detect compromises and lateral movement. Real world adversaries do these things, most notably was when Google was throughly compromised by a foreign nation state for instance. Also, it gets even more interesting for malware if its running on a bastion host because then malware has access to all the forwarded keys!

teh_klev 6y ago
I totally take your point, especially the second paragraph, and agree. Maybe it's the deep cynic in me that tends to read these articles as another "oh look Windows bad" write up, rather than analyse what can happen if a stealthy attacker gains access to your machine and covers their footprints. These write ups get passed around in a sensationalised manner with very little thought about or understanding that the OS was functioning correctly given their user privileges.

djeiasbsbo 6y ago

I agree... the whole point is that admin/root can do everything. SSH agent hijacking is as easy as setting the SSH_AUTH_SOCK variable to that of any logged in user. This is why enabling ssh agent forwarding is something that should be evaluated on a per connection basis. You don't want to forward the agent holding your home keys to your work machine where someone else has root access. But then again, the author didn't claim to do anything special, it was just a little demonstration.